Edit tour

Windows Analysis Report
QtON0L47XD.exe

Overview

General Information

Sample name:	QtON0L47XD.exe renamed because original name is a hash value
Original sample name:	2c9328c93b4dd4e49229511677e107b7.exe
Analysis ID:	1502810
MD5:	2c9328c93b4dd4e49229511677e107b7
SHA1:	a7814ce1f61f998b35b4e4d45f963fd937c80652
SHA256:	5f386b56951dd0065a4f76ec8797e7dd82cbbb6a27b1865bfb9be5a9c6955935
Tags:	exeRedLineStealer
Infos:

Detection

PureLog Stealer, RedLine, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected PureLog Stealer

Yara detected RedLine Stealer

Yara detected zgRAT

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains very large array initializations

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to detect virtual machines (SLDT)

Contains long sleeps (>= 3 min)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

QtON0L47XD.exe (PID: 7652 cmdline: "C:\Users\user\Desktop\QtON0L47XD.exe" MD5: 2C9328C93B4DD4E49229511677E107B7)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: RedLine

{"C2 url": "176.109.101.167:6607"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
QtON0L47XD.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
QtON0L47XD.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
QtON0L47XD.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
QtON0L47XD.exe	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x45c17:$s1: file:/// 0x45b4f:$s2: {11111-22222-10009-11112} 0x45ba7:$s3: {11111-22222-50001-00000} 0x423fa:$s4: get_Module 0x42864:$s5: Reverse 0x45226:$s6: BlockCopy 0x42c23:$s7: ReadByte 0x45c29:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000000.1699132028.00000000008E2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000000.1699132028.00000000008E2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1769335971.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: QtON0L47XD.exe PID: 7652	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: QtON0L47XD.exe PID: 7652	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.QtON0L47XD.exe.8e0000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.0.QtON0L47XD.exe.8e0000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.0.QtON0L47XD.exe.8e0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.0.QtON0L47XD.exe.8e0000.0.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x45c17:$s1: file:/// 0x45b4f:$s2: {11111-22222-10009-11112} 0x45ba7:$s3: {11111-22222-50001-00000} 0x423fa:$s4: get_Module 0x42864:$s5: Reverse 0x45226:$s6: BlockCopy 0x42c23:$s7: ReadByte 0x45c29:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) - Source IP: 176.109.101.167 - Destination IP: 192.168.2.4

Timestamp:	2024-09-02T10:32:04.108531+0200
SID:	2046056
Severity:	1
Source Port:	6607
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.4 - Destination IP: 176.109.101.167

Timestamp:	2024-09-02T10:32:03.653098+0200
SID:	2046045
Severity:	1
Source Port:	49730
Destination Port:	6607
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: QtON0L47XD.exe

Avira: detected

Found malware configuration

Source: QtON0L47XD.exe.7652.0.memstrmin

Malware Configuration Extractor: RedLine {"C2 url": "176.109.101.167:6607"}

Multi AV Scanner detection for submitted file

Source: QtON0L47XD.exe	ReversingLabs: Detection: 70%
Source: QtON0L47XD.exe	Virustotal: Detection: 35%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: QtON0L47XD.exe

Joe Sandbox ML: detected

Source: QtON0L47XD.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: QtON0L47XD.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.4:49730 -> 176.109.101.167:6607
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 176.109.101.167:6607 -> 192.168.2.4:49730

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 176.109.101.167:6607

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 176.109.101.167:6607

Source: Joe Sandbox View

ASN Name: SPEEDYLINERU SPEEDYLINERU

Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167
Source: unknown	TCP traffic detected without corresponding DNS query: 176.109.101.167

Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 3IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: QtON0L47XD.exe, 00000000.00000002.1779386816.000000001BCAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000003414000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: qC:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000003414000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: qC:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldbP equals www.youtube.com (Youtube)

Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002F1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field1
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field1Response
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field2
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field2Response
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field3
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002F3B000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field3Response
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002FE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.o
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002FE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.oh
Source: QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012D6B000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012E76000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012C8F000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012DC4000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012E1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012D6B000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012E76000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012C8F000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012DC4000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012E1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012D6B000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012E76000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012C8F000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012DC4000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012E1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012D6B000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012E76000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012C8F000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012DC4000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012E1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012D6B000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012E76000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012C8F000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012DC4000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012E1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012D6B000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012E76000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012C8F000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012DC4000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012E1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012D6B000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012E76000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012C8F000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012DC4000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012E1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012D6B000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012E76000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012C8F000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012DC4000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012E1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012D6B000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012E76000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012C8F000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012DC4000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012E1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Users\user\Desktop\QtON0L47XD.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: QtON0L47XD.exe, type: SAMPLE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.0.QtON0L47XD.exe.8e0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen

.NET source code contains very large array initializations

Source: QtON0L47XD.exe, Strings.cs

Large array initialization: Strings: array initializer size 6160

Source: C:\Users\user\Desktop\QtON0L47XD.exe	Code function: 0_2_00007FFD9B7AC4CC	0_2_00007FFD9B7AC4CC
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Code function: 0_2_00007FFD9B8F3C51	0_2_00007FFD9B8F3C51
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Code function: 0_2_00007FFD9B90A2F5	0_2_00007FFD9B90A2F5
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Code function: 0_2_00007FFD9B8FAA1D	0_2_00007FFD9B8FAA1D
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Code function: 0_2_00007FFD9B90D86D	0_2_00007FFD9B90D86D
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Code function: 0_2_00007FFD9B90AFA5	0_2_00007FFD9B90AFA5
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Code function: 0_2_00007FFD9B904F09	0_2_00007FFD9B904F09

Source: QtON0L47XD.exe, 00000000.00000000.1699132028.000000000096E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameGristles.exe" vs QtON0L47XD.exe
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs QtON0L47XD.exe
Source: QtON0L47XD.exe	Binary or memory string: OriginalFilenameGristles.exe" vs QtON0L47XD.exe

Source: QtON0L47XD.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: QtON0L47XD.exe, type: SAMPLE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.0.QtON0L47XD.exe.8e0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT

Source: QtON0L47XD.exe, Strings.cs	Cryptographic APIs: 'CreateDecryptor'
Source: QtON0L47XD.exe, Class4.cs	Cryptographic APIs: 'CreateDecryptor'
Source: QtON0L47XD.exe, Class4.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/1@0/1

Source: C:\Users\user\Desktop\QtON0L47XD.exe

File created: C:\Users\user\AppData\Local\Microsoft\Wind?ws

Jump to behavior

Source: C:\Users\user\Desktop\QtON0L47XD.exe

Mutant created: NULL

Source: QtON0L47XD.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: QtON0L47XD.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\QtON0L47XD.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\QtON0L47XD.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\QtON0L47XD.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\QtON0L47XD.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: C:\Users\user\Desktop\QtON0L47XD.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: QtON0L47XD.exe	ReversingLabs: Detection: 70%
Source: QtON0L47XD.exe	Virustotal: Detection: 35%

Source: C:\Users\user\Desktop\QtON0L47XD.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\QtON0L47XD.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: QtON0L47XD.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: QtON0L47XD.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: QtON0L47XD.exe, Class4.cs

.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

Source: QtON0L47XD.exe

Static PE information: 0xE3FEC0F4 [Mon Mar 19 06:19:32 2091 UTC]

Source: C:\Users\user\Desktop\QtON0L47XD.exe	Code function: 0_2_00007FFD9B6D63EE push ss; retf	0_2_00007FFD9B6D63EF
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Code function: 0_2_00007FFD9B6D00BD pushad ; iretd	0_2_00007FFD9B6D00C1
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Code function: 0_2_00007FFD9B6D5CB0 push edi; iretd	0_2_00007FFD9B6D5CB6
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Code function: 0_2_00007FFD9B7A2004 pushad ; retf	0_2_00007FFD9B7A2005
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Code function: 0_2_00007FFD9B7A6B79 push 3000006Bh; ret	0_2_00007FFD9B7A6BB9
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Code function: 0_2_00007FFD9B7A4150 push eax; iretd	0_2_00007FFD9B7A4151
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Code function: 0_2_00007FFD9B8F2D75 pushad ; retf	0_2_00007FFD9B8F2D99

Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\QtON0L47XD.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\QtON0L47XD.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: \QEMU-GA.EXE

Source: C:\Users\user\Desktop\QtON0L47XD.exe	Memory allocated: 10C0000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Memory allocated: 1AC50000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\QtON0L47XD.exe

Code function: 0_2_00007FFD9B6D20F4 sldt word ptr [eax]

0_2_00007FFD9B6D20F4

Source: C:\Users\user\Desktop\QtON0L47XD.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\QtON0L47XD.exe	Window / User API: threadDelayed 841			Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Window / User API: threadDelayed 3098			Jump to behavior

Source: C:\Users\user\Desktop\QtON0L47XD.exe TID: 7848	Thread sleep time: -11068046444225724s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe TID: 7676	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\QtON0L47XD.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\QtON0L47XD.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe
Source: QtON0L47XD.exe, 00000000.00000002.1779497676.000000001BCEC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\QtON0L47XD.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\QtON0L47XD.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\QtON0L47XD.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\QtON0L47XD.exe	Queries volume information: C:\Users\user\Desktop\QtON0L47XD.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\QtON0L47XD.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: QtON0L47XD.exe, 00000000.00000002.1779862632.000000001C146000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\QtON0L47XD.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\QtON0L47XD.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\QtON0L47XD.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\QtON0L47XD.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\QtON0L47XD.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\QtON0L47XD.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: QtON0L47XD.exe, type: SAMPLE
Source: Yara match	File source: 0.0.QtON0L47XD.exe.8e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1699132028.00000000008E2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: QtON0L47XD.exe, type: SAMPLE
Source: Yara match	File source: 0.0.QtON0L47XD.exe.8e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1699132028.00000000008E2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QtON0L47XD.exe PID: 7652, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: QtON0L47XD.exe, type: SAMPLE
Source: Yara match	File source: 0.0.QtON0L47XD.exe.8e0000.0.unpack, type: UNPACKEDPE

Found many strings related to Crypto-Wallets (likely being stolen)

Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ElectrumE#
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ElectronCashE#
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: JaxxE#
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ExodusE#
Source: QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: EthereumE#
Source: QtON0L47XD.exe, 00000000.00000000.1699132028.00000000008E2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: set_UseMachineKeyStore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\QtON0L47XD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\QtON0L47XD.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\QtON0L47XD.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior

Source: Yara match	File source: 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1769335971.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QtON0L47XD.exe PID: 7652, type: MEMORYSTR

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: QtON0L47XD.exe, type: SAMPLE
Source: Yara match	File source: 0.0.QtON0L47XD.exe.8e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1699132028.00000000008E2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: QtON0L47XD.exe, type: SAMPLE
Source: Yara match	File source: 0.0.QtON0L47XD.exe.8e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1699132028.00000000008E2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QtON0L47XD.exe PID: 7652, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: QtON0L47XD.exe, type: SAMPLE
Source: Yara match	File source: 0.0.QtON0L47XD.exe.8e0000.0.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Masquerading	1 OS Credential Dumping	331 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	3 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	251 Virtualization/Sandbox Evasion	Security Account Manager	251 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Clipboard Data	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	113 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
QtON0L47XD.exe	71%	ReversingLabs	ByteCode-MSIL.Spyware.Redline
QtON0L47XD.exe	36%	Virustotal		Browse
QtON0L47XD.exe	100%	Avira	HEUR/AGEN.1312138
QtON0L47XD.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	0%	URL Reputation	safe
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/sc	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	0%	URL Reputation	safe
http://tempuri.org/	0%	Avira URL Cloud	safe
176.109.101.167:6607	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://tempuri.org/example/Field1Response	0%	Avira URL Cloud	safe
https://discord.com/api/v9/users/	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/06/addressingex	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/fault	0%	URL Reputation	safe
http://www.w3.oh	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://www.w3.o	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	0%	URL Reputation	safe
http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2002/12/policy	0%	URL Reputation	safe
http://tempuri.org/example/Field1	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue	0%	URL Reputation	safe
http://tempuri.org/example/Field2	0%	Avira URL Cloud	safe
http://tempuri.org/example/Field1Response	1%	Virustotal		Browse
176.109.101.167:6607	0%	Virustotal		Browse
http://tempuri.org/	1%	Virustotal		Browse
http://tempuri.org/example/Field3	0%	Avira URL Cloud	safe
http://tempuri.org/example/Field1	1%	Virustotal		Browse
http://tempuri.org/example/Field2	1%	Virustotal		Browse
https://discord.com/api/v9/users/	0%	Virustotal		Browse
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
176.109.101.167:6607	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012D6B000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012E76000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012C8F000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012DC4000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012E1D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012D6B000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012E76000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012C8F000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012DC4000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012E1D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://tempuri.org/	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://discord.com/api/v9/users/	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/example/Field1Response	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002F1B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ip.sb/ip	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012D6B000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012E76000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012C8F000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012DC4000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012E1D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012D6B000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012E76000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012C8F000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012DC4000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012E1D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.w3.oh	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002FE6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/example/Field1	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/example/Field2	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/example/Field3	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012D6B000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012E76000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012C8F000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012DC4000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012E1D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/06/addressingex	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/fault	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012D6B000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012E76000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012C8F000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012DC4000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012E1D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.w3.o	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002FE6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/example/Field3Response	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002F3B000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012D6B000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012E76000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012C8F000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012DC4000.00000004.00000800.00020000.00000000.sdmp, QtON0L47XD.exe, 00000000.00000002.1774991356.0000000012E1D000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2002/12/policy	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit	QtON0L47XD.exe, 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
176.109.101.167	unknown	Russian Federation		49342	SPEEDYLINERU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1502810
Start date and time:	2024-09-02 10:31:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	QtON0L47XD.exe renamed because original name is a hash value
Original Sample Name:	2c9328c93b4dd4e49229511677e107b7.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/1@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:32:04	API Interceptor	19x Sleep call for process: QtON0L47XD.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SPEEDYLINERU	firmware.i686.elf	Get hash	malicious	Unknown	Browse	178.215.96.174
	botx.x86.elf	Get hash	malicious	Mirai	Browse	176.114.120.113
	2GAcJejuxn.exe	Get hash	malicious	DCRat, PureLog Stealer, RedLine, zgRAT	Browse	176.123.161.158
	C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	176.123.168.151
	NMdpQecbkg.elf	Get hash	malicious	Mirai	Browse	213.108.22.242
	gZo873g1iv.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	176.123.169.110
	bXKYLbAIza.exe	Get hash	malicious	DCRat, zgRAT	Browse	176.123.168.238
	0rsj8JbJNU.dll	Get hash	malicious	Amadey	Browse	176.123.171.210
	0rsj8JbJNU.dll	Get hash	malicious	Amadey	Browse	176.123.171.210
	sora.arm.elf	Get hash	malicious	Mirai	Browse	176.109.66.246

Process:	C:\Users\user\Desktop\QtON0L47XD.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2611
Entropy (8bit):	5.363358188931451
Encrypted:	false
SSDEEP:	48:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhAHKKkafHKWA1eXrHKlT48BHK7HKmTHlHNW:iq+wmj0qCYqGSI6oPtzHeqKkGqhA7qZR
MD5:	CEA017D10C4D437981D19F21660A47FA
SHA1:	61AAFCECB5325DE172857CEF7C7E1F230F73AFFD
SHA-256:	60B099420455DECD1878FE84F217CFE478BA0BA5E6E574077150D08355A1DD96
SHA-512:	413384BF9D2EDC9BC2DF6D5175D09A33B91CCF9C53FE3CB21892CB57AF4FD8A9BE0608E9BCA57AF4A7F2709A4C110148719DA3210460DF433CFD77FA753B9CF8
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.180172860423383
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	QtON0L47XD.exe
File size:	743'424 bytes
MD5:	2c9328c93b4dd4e49229511677e107b7
SHA1:	a7814ce1f61f998b35b4e4d45f963fd937c80652
SHA256:	5f386b56951dd0065a4f76ec8797e7dd82cbbb6a27b1865bfb9be5a9c6955935
SHA512:	c1f965fc851bcf905f4e39ff58edad69fade14e1a161104c0f70c797a4f729cc3e4422021032bec099f31466fff7958670a9281e86554f44fe1ad7c675edd65e
SSDEEP:	12288:6D6YDzqx5XBNt1BrivR0V4TBjgYxs1wl206gBawFV2ceSb0BQ/GfM/4QiAzojgJ6:6D6Y3qx51NBXA
TLSH:	2EF4701C5BBC058CEC8CD531BE20C9326EA04E08919FCB49A569FA151EB6277B3F5BD1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ........@.. ....................................@................................

File Icon


Icon Hash:	0e9696961617e982

Static PE Info

General

Entrypoint:	0x44d0ee
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xE3FEC0F4 [Mon Mar 19 06:19:32 2091 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4d098	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4e000	0x6a022	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xba000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x4b0f4	0x4b200	b08f646785b6ad7d00594054a20e45e9	False	0.4179979981281198	data	6.528629690725186	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x4e000	0x6a022	0x6a200	65e4195d76e2641b30f5c060426a53b1	False	0.04090059997055359	data	3.4733020781588206	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xba000	0xc	0x200	3a13fecd19ca9773d82cc3855bc1b8eb	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x4e2b0	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	0.019047548598988075
RT_ICON	0x902d8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	0.03903939429788241
RT_ICON	0xa0b00	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	0.0580460374185411
RT_ICON	0xa9fa8	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	0.08243992606284659
RT_ICON	0xaf430	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	0.0987836561171469
RT_ICON	0xb3658	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	0.14284232365145227
RT_ICON	0xb5c00	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	0.22537523452157598
RT_ICON	0xb6ca8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	0.30901639344262294
RT_ICON	0xb7630	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	0.4530141843971631
RT_GROUP_ICON	0xb7a98	0x84	data	0.7196969696969697
RT_VERSION	0xb7b1c	0x31c	data	0.4535175879396985
RT_MANIFEST	0xb7e38	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-09-02T10:32:04.108531+0200	TCP	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	6607	49730	176.109.101.167	192.168.2.4
2024-09-02T10:32:03.653098+0200	TCP	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	1	49730	6607	192.168.2.4	176.109.101.167

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 2, 2024 10:32:02.950047016 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:02.954989910 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:02.955065966 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:02.958393097 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:02.963166952 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:03.619014025 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:03.653098106 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:03.658255100 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:03.862777948 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:03.897571087 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:03.902488947 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:04.108118057 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:04.108145952 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:04.108160019 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:04.108202934 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:04.108212948 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:04.108223915 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:04.108230114 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:04.108278036 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:04.108278036 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:04.108530998 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:04.108542919 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:04.108583927 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:04.228377104 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:04.228405952 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:04.228502035 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:04.228705883 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:04.228729010 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:04.228766918 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:04.233026028 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:04.233088017 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:04.233143091 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:04.233454943 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:04.233474016 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:04.233484030 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:04.233496904 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:04.233525038 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:04.233547926 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:04.237791061 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:04.237806082 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:04.237879992 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:04.238121033 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:04.238135099 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:04.238183975 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:04.348962069 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:04.348985910 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:04.348999977 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:04.349076986 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:04.349184036 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:04.349232912 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.634432077 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.639481068 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.639508009 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.639539957 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.639556885 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.639556885 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.639568090 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.639607906 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.639619112 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.639633894 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.639650106 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.639677048 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.639681101 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.639693022 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.639710903 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.639741898 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.639769077 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.639774084 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.640021086 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.645042896 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.645055056 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.645116091 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.645126104 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.645167112 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.645170927 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.645210981 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.645216942 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.645221949 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.645266056 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.646001101 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.646060944 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.646270990 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.646352053 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.646445036 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.646513939 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.646591902 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.646641016 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.646894932 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.646919966 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.646989107 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.647563934 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.647661924 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.652913094 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.653074026 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.653079987 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.653137922 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.653343916 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.653417110 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.653455973 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.653608084 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.653733969 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.653779984 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.653940916 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.653981924 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.653991938 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.654002905 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.654038906 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.654062033 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.654186010 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.654202938 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.654213905 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.654248953 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.654249907 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.654261112 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.654272079 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.654352903 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.654376984 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.654433012 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.654475927 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.654486895 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.654495955 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.654508114 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.654517889 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.654532909 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.654550076 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.654565096 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.654633999 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.654675961 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.654701948 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.654711962 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.654721975 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.654761076 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.654783964 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.654814959 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.654824972 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.654833078 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.654864073 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.654881954 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.657609940 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.657694101 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.657932997 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.657985926 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.657990932 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.658034086 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.658081055 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.658133030 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.658143044 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.658186913 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.658258915 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.658304930 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.658339024 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.658366919 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.658415079 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.658427954 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.658436060 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.658444881 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.658452988 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.658482075 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.658669949 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.658682108 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.658691883 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.658736944 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.658746958 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.658776999 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.658896923 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.658906937 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.658916950 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.658927917 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.658938885 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.658994913 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.659004927 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.659013987 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.659035921 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.659045935 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.659054041 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.659135103 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.659188986 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.659238100 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.659248114 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.659256935 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.659266949 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.659280062 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.659317017 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.659336090 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.659344912 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.659377098 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.659394026 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.659404993 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.659415960 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.659483910 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.659492970 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.659538031 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.659548044 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.659569025 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.659593105 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.659657001 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.660284042 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.660295963 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.660305977 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.660315990 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.660325050 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.660335064 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.660343885 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.660353899 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.660363913 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.660373926 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.660382986 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.660392046 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.660402060 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.660410881 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.660420895 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.660429955 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.660445929 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.660454035 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.660463095 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.660473108 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.662532091 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.662631035 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.662806988 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.663369894 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.663425922 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.663435936 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.663445950 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.663506985 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.663517952 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.663544893 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.663554907 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.663578033 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.663589001 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.663626909 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.663636923 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.663645983 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.663696051 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.663706064 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.663714886 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.663769007 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.663779974 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.663789034 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.663800001 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.664031982 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.664092064 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.665450096 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.665461063 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.665580034 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.665589094 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.665610075 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.665621042 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.665718079 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.665730000 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.665741920 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.665751934 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.665806055 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.665862083 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.665966988 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.665983915 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.666038036 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.666049004 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.666058064 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.666068077 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.666110039 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.666168928 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.666178942 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.666188002 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.666198969 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.666207075 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.666255951 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.666285992 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.666295052 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.666302919 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.666315079 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.666367054 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.666378021 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.666387081 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.666398048 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.666407108 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.666452885 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.666510105 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.666520119 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.666529894 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.666608095 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.666661978 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.666707039 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.666717052 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.666726112 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.666742086 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.666752100 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.666759968 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.666785002 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.666862965 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.666872978 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.666882038 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.666901112 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.666914940 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.666944981 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.668963909 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.668975115 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669019938 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669112921 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669123888 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669132948 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669207096 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.669208050 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669219017 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669229984 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669239998 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669249058 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669260979 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669260979 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.669282913 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669294119 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669303894 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669312954 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669323921 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669332981 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669348955 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669399023 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669409037 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669416904 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669435024 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669445038 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669467926 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669490099 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669512987 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669523001 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669567108 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669576883 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669585943 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669604063 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669687986 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669698000 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669706106 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669715881 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669734001 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669743061 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669753075 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669763088 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669809103 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669819117 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669856071 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669871092 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669879913 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669889927 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669933081 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669943094 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669950962 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.669961929 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.670037985 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.670047998 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.670056105 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.674441099 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.674485922 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.674494982 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.674505949 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.674556017 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.674604893 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.674655914 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.674791098 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.674809933 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.674875021 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.675127983 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.675138950 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.675148010 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.675158024 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.675167084 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.675177097 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.675184965 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.675194979 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.675203085 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.675211906 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.675220966 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.675230980 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.675249100 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.675259113 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.675267935 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.675276995 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.675296068 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.675304890 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.675415039 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.675434113 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.675441980 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.675452948 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.675470114 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.675493956 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.675594091 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.675683975 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.675694942 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.675724983 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.675789118 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.675798893 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.675823927 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.675908089 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.675918102 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.675929070 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.676003933 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.676014900 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.676079988 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.676098108 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.676109076 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.676117897 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.676136017 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.676186085 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.676198006 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.676318884 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.676328897 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.680191040 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.680286884 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.680371046 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.680382013 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.680432081 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.680468082 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.680474997 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.680495977 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.680537939 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.680635929 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.680645943 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.680655003 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.680704117 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.680767059 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.680775881 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.680809021 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.680876970 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.680886984 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.681164980 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.681178093 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.681186914 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.681197882 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.681207895 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.681216955 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.681233883 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.681245089 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.681253910 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.681262970 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.681271076 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.681282997 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.681313992 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.681324005 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.681334972 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.681396008 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.681406021 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.681415081 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.681483984 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.681493044 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.681531906 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.681541920 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.681551933 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.681560993 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.681597948 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.681607962 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.681616068 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.681626081 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.681633949 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.681644917 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.681653976 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.681729078 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.681737900 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.681746960 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.681771040 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.681781054 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.681790113 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.685486078 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.685498953 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.685651064 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.685679913 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.685750961 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.685801983 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.685807943 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.685838938 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.685904980 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.685950041 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.686058998 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.686146975 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.686197996 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.686278105 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.686288118 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.686316013 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.686362028 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.686372042 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.686456919 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.686518908 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.686528921 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.686598063 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.686608076 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.686615944 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.686635971 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.686645985 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.686775923 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.686819077 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.686829090 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.686836958 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.686856985 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.686866999 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.686908960 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.686990023 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.687000036 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.687007904 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.702898979 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.708062887 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.708317995 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.708389997 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.708389997 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.708452940 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.715209007 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.715224028 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.715287924 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.715377092 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.715388060 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.715395927 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.715679884 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.715773106 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.715783119 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.715873003 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.715989113 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.716247082 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.716319084 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.716331005 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.716439009 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.723722935 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.723874092 CEST	49730	6607	192.168.2.4	176.109.101.167
Sep 2, 2024 10:32:07.732678890 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:07.751461983 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:08.851397038 CEST	6607	49730	176.109.101.167	192.168.2.4
Sep 2, 2024 10:32:08.865446091 CEST	49730	6607	192.168.2.4	176.109.101.167

Target ID:	0
Start time:	04:32:00
Start date:	02/09/2024
Path:	C:\Users\user\Desktop\QtON0L47XD.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\QtON0L47XD.exe"
Imagebase:	0x8e0000
File size:	743'424 bytes
MD5 hash:	2C9328C93B4DD4E49229511677E107B7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1769335971.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000000.1699132028.00000000008E2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000000.1699132028.00000000008E2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1769335971.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	15.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	12
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9B904F09 Relevance: 4.1, Strings: 1, Instructions: 2880
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

y&[H, xrefs: 00007FFD9B905814

Memory Dump Source

Source File: 00000000.00000002.1783783672.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8f0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID: y&[H
API String ID: 0-721110885
Opcode ID: 89f90978bf87a63c7311d561fa4598e81e54fd447b703799cda6499ba479c737
Instruction ID: 04a55cfad9610375c003f080c0cf4d907b58b010504ffb4a9663d5cf900e7d86
Opcode Fuzzy Hash: 89f90978bf87a63c7311d561fa4598e81e54fd447b703799cda6499ba479c737
Instruction Fuzzy Hash: 0333A874A1991D8FDFA8DF58C8A4BA9B7F1FB68301F5041EA904DE3291DA356E81CF40

Function 00007FFD9B8FAA1D Relevance: 3.5, Strings: 2, Instructions: 988
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/_H, xrefs: 00007FFD9B8FAF6F
y*_H, xrefs: 00007FFD9B8FAB6E

Memory Dump Source

Source File: 00000000.00000002.1783783672.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8f0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID: /_H$y*_H
API String ID: 0-548461173
Opcode ID: 442d1ab570ea02e30f1419b1c4e5b69784f808e9653d77e2f15b1c4537c87158
Instruction ID: 33bd693487951c33828f6a22f8f0f87f402cb8edd8928bc24df825941b3cfb49
Opcode Fuzzy Hash: 442d1ab570ea02e30f1419b1c4e5b69784f808e9653d77e2f15b1c4537c87158
Instruction Fuzzy Hash: 4482CC71A19A5D8FDBA5EB58C8A5BA8B7F1FF58300F5001E9D00DE32A5DE346E818F41

Function 00007FFD9B8F3C51 Relevance: 2.2, Strings: 1, Instructions: 923
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@B/, xrefs: 00007FFD9B8F3D11

Memory Dump Source

Source File: 00000000.00000002.1783783672.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8f0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID: @B/
API String ID: 0-3863299084
Opcode ID: e5e6a61bbee69c16543b78dcf33f60a99b911dad8958af56d6fbdfb4d6d347f5
Instruction ID: 580830d53b1e4de588ec7a91c4f03bace749cd349aab4fa12950977316e87a4a
Opcode Fuzzy Hash: e5e6a61bbee69c16543b78dcf33f60a99b911dad8958af56d6fbdfb4d6d347f5
Instruction Fuzzy Hash: 1A82BD70A19A1D8FDBA5DB58C8A5BA8B7B1FF58300F5501EAD00DE32A5DA356EC0CF41

Function 00007FFD9B90D86D Relevance: 2.1, Strings: 1, Instructions: 824
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

~'_H, xrefs: 00007FFD9B92A6EF

Memory Dump Source

Source File: 00000000.00000002.1783783672.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8f0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID: ~'_H
API String ID: 0-3531788527
Opcode ID: 6f6983b9dde9441fdfbdf4332b77d6c75b851d2f3f07a9a5fd2b843243f472df
Instruction ID: 73363e2efe2f2023395baca9aac44cf8a72cc21b9ff4279fbe2d62403d34aa95
Opcode Fuzzy Hash: 6f6983b9dde9441fdfbdf4332b77d6c75b851d2f3f07a9a5fd2b843243f472df
Instruction Fuzzy Hash: BF322B32F1D90D5FEBA8DB5C88656B973D2EF98700F4501BAE44DC32E6DE24AC428741

Function 00007FFD9B7AC4CC Relevance: 2.0, Strings: 1, Instructions: 723
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ZJ_H, xrefs: 00007FFD9B7AC9CF

Memory Dump Source

Source File: 00000000.00000002.1782843240.00007FFD9B7A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7a0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID: ZJ_H
API String ID: 0-3185422581
Opcode ID: 5575e2dfbb4d667b88e561037c83ef0320f4f9cdcdbee8a09d3e815faee17e87
Instruction ID: 7dcd7b69c60d138880b76b40271711cd3708a9ba7e8140a80db88d70b6e6c886
Opcode Fuzzy Hash: 5575e2dfbb4d667b88e561037c83ef0320f4f9cdcdbee8a09d3e815faee17e87
Instruction Fuzzy Hash: C622C171B1DB4D4FD7A8DB2C88A5A7877D2EF99700B4502BAE45EC72B6DE24AC018341

Function 00007FFD9B90A2F5 Relevance: 1.1, Instructions: 1113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1783783672.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8f0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 328237c6a256cdf273dcef07ee752244fc2fed612af56ad5013e062b66160ffd
Instruction ID: 687c1b8084456449e9db493c0da556a8a2f8142cd16727c6dfa306938e2921c6
Opcode Fuzzy Hash: 328237c6a256cdf273dcef07ee752244fc2fed612af56ad5013e062b66160ffd
Instruction Fuzzy Hash: C672A230B2DA0D5FDB68EB6C9465A7973D2FF58300B5501B9E48EC72A6DE24FC428781

Function 00007FFD9B90AFA5 Relevance: .9, Instructions: 922COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1783783672.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8f0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcf58fbcabc68da6bcc0b220e1cb4d8673dbc35e65437beeadb627036a7e140d
Instruction ID: 867690dab79ab5f92cbfa18c21950c3d55cc75ef3cf07dfb594765c9e0fe20b7
Opcode Fuzzy Hash: bcf58fbcabc68da6bcc0b220e1cb4d8673dbc35e65437beeadb627036a7e140d
Instruction Fuzzy Hash: C262A930B19A0E9FDBA8DB5CC4A4BA877E1FF58300F1541B9D44EC72A6DE34A981CB41

Function 00007FFD9B7ADAED Relevance: 1.8, Strings: 1, Instructions: 585
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_?_H, xrefs: 00007FFD9B7ADD5E

Memory Dump Source

Source File: 00000000.00000002.1782843240.00007FFD9B7A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7a0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID: _?_H
API String ID: 0-3627674236
Opcode ID: 8ae0288015ee22026dd4f64b03ddc11f1f746c340d7fb452167869c1ca1ae560
Instruction ID: c5640c59966c4434b9b308fd47ef629ea5e02f973df57a6fced2d4f2a7af5e36
Opcode Fuzzy Hash: 8ae0288015ee22026dd4f64b03ddc11f1f746c340d7fb452167869c1ca1ae560
Instruction Fuzzy Hash: B6F10461B1FBC90FD7A69B6888649643FE1EF56210B0A02FBD09DCB1F3DD28AC458351

Function 00007FFD9B8F6DAA Relevance: 1.7, APIs: 1, Instructions: 249
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00007FFD9B8F6F5F

Memory Dump Source

Source File: 00000000.00000002.1783783672.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8f0000_QtON0L47XD.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 9a10ca33cad4bb33c3623e7008574a7382d8aa3bbf73d9cc00f200ffa4200b94
Instruction ID: c1acd73810a47bf9d5ff0ce6607cb148b5a87624f97b062e85ad90abfb5fd93e
Opcode Fuzzy Hash: 9a10ca33cad4bb33c3623e7008574a7382d8aa3bbf73d9cc00f200ffa4200b94
Instruction Fuzzy Hash: 3371B671A18B4C4FDB68DF28D8567E97BD1FB58310F10426EE84EC7292DA74A941CBC2

Function 00007FFD9B8F78A1 Relevance: 1.7, APIs: 1, Instructions: 166
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE ref: 00007FFD9B8F79AA

Memory Dump Source

Source File: 00000000.00000002.1783783672.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8f0000_QtON0L47XD.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 03f13779891b27257205a324324b6305e1d0cda88ad965c30dcd0a2833b4e135
Instruction ID: 2fadee3a55c45d11e700895e891e2e298844e0058e0ad0e97c43d82e9fe1d9fd
Opcode Fuzzy Hash: 03f13779891b27257205a324324b6305e1d0cda88ad965c30dcd0a2833b4e135
Instruction Fuzzy Hash: 2D419F31E08A1C8FDB58EF989845AEDBBF1FB99310F00426ED44DD7256CA34A945CBC2

Function 00007FFD9B8F5609 Relevance: 1.6, APIs: 1, Instructions: 118
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateCompatibleBitmap.GDI32 ref: 00007FFD9B8F56AA

Memory Dump Source

Source File: 00000000.00000002.1783783672.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8f0000_QtON0L47XD.jbxd

Similarity

API ID: BitmapCompatibleCreate
String ID:
API String ID: 1901715728-0
Opcode ID: d345f7599e53a679af1b4c0cf2b12f824a4b5218024f959fe23d6c091378c2bf
Instruction ID: d03c0dc3fffb6800ca81ec76911f747f6b5b03b1bda50b5e9b8b3392ba2e0130
Opcode Fuzzy Hash: d345f7599e53a679af1b4c0cf2b12f824a4b5218024f959fe23d6c091378c2bf
Instruction Fuzzy Hash: DD312C31A1CA4C4FDB1CEF9898166F9BBE0EB59321F00427FD05EC3292DF6568028781

Function 00007FFD9B8F86C9 Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

DeleteDC.GDI32 ref: 00007FFD9B8F8757

Memory Dump Source

Source File: 00000000.00000002.1783783672.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8f0000_QtON0L47XD.jbxd

Similarity

API ID: Delete
String ID:
API String ID: 1035893169-0
Opcode ID: 13602f72da4ec75537066be462f6f0dc551540bb0fe6d7b19d4b770021866767
Instruction ID: 13ebf625c13ee0760399424de0460b4c361e8123c0b90d9b5eddb3f54e5ef3cc
Opcode Fuzzy Hash: 13602f72da4ec75537066be462f6f0dc551540bb0fe6d7b19d4b770021866767
Instruction Fuzzy Hash: 83210431A0C60C8FDB5CDFA8845A7FA7BE1EF95320F04416FD44DC7192DA7599068B81

Function 00007FFD9B7AC02C Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

|?_H, xrefs: 00007FFD9B7AC05E

Memory Dump Source

Source File: 00000000.00000002.1782843240.00007FFD9B7A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7a0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID: |?_H
API String ID: 0-1790896812
Opcode ID: 524cbd5b8fcfaa0c3a6dc4ac197393bc2b18d26dda02990d3e0b4c1848fe7dee
Instruction ID: 9cb43f6fa3667c26dc5ec23de036815b5eac09faf3135dd2226300313b2b1f16
Opcode Fuzzy Hash: 524cbd5b8fcfaa0c3a6dc4ac197393bc2b18d26dda02990d3e0b4c1848fe7dee
Instruction Fuzzy Hash: 1071F262B0EB894FE7A5EB7C8C655247BE1EF69210B0602BFD099C71F3D928AC458341

Function 00007FFD9B7ADD11 Relevance: 1.5, Strings: 1, Instructions: 233COMMON

Download Yara Rule

Strings

_?_H, xrefs: 00007FFD9B7ADD5E

Memory Dump Source

Source File: 00000000.00000002.1782843240.00007FFD9B7A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7a0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID: _?_H
API String ID: 0-3627674236
Opcode ID: c30743281a5b921d54458b0768ccac07a22c75800095bd4b8f75e16a6b5ae420
Instruction ID: b96e868b0df80337071522268caf40745c901816533d11898e5a48d5d8bd6be8
Opcode Fuzzy Hash: c30743281a5b921d54458b0768ccac07a22c75800095bd4b8f75e16a6b5ae420
Instruction Fuzzy Hash: B161F261B2EB990FD7A4DB288468A383BE1EF59710B0606BED09DC71F3DE24BC458345

Function 00007FFD9B7AD9CA Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD9B7ADA72

Memory Dump Source

Source File: 00000000.00000002.1782843240.00007FFD9B7A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7a0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 68991e5c7d1f39f1e572b1e641abfa2522e03ba59926068b00216bc9d0dadae6
Instruction ID: 68685b7df5c97968a8a16db452c414f635a19d50157abb9601dc203671d1c053
Opcode Fuzzy Hash: 68991e5c7d1f39f1e572b1e641abfa2522e03ba59926068b00216bc9d0dadae6
Instruction Fuzzy Hash: 1741707171CE0D4FDBA8EB1CD465A6473D2FB98710B5102AAE04EC72B6DE25EC428781

Function 00007FFD9B7A1B01 Relevance: .5, Instructions: 479COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782843240.00007FFD9B7A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7a0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b721424e1df939579bb04c4bc2569992e39bd40f78a0b8e3209fa4d268e4e6f
Instruction ID: c4e0c3676ea6a8a0e0cc76d86a3296d2bad156c2537f97b7c995e71ed2fc9196
Opcode Fuzzy Hash: 7b721424e1df939579bb04c4bc2569992e39bd40f78a0b8e3209fa4d268e4e6f
Instruction Fuzzy Hash: 7AD11331B0DA494FE7A8D65C9869A7537D2EF9A311F1503BAE04EC36F2DD14AD42C381

Function 00007FFD9B6D1922 Relevance: .4, Instructions: 430COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782258396.00007FFD9B6D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b6d0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccf4799cc3028b1891450eeca871330875eb337c5101e20a94b38b350514bc28
Instruction ID: 7a0e14ff0f39b2a739a86bf6aedc24886a5dda194864ca703abddcc1e9d197bf
Opcode Fuzzy Hash: ccf4799cc3028b1891450eeca871330875eb337c5101e20a94b38b350514bc28
Instruction Fuzzy Hash: 27F11A70A0991D8FDBA8DB58C8A5BA877F1FF98301F1102E9D41DD76A1DA74AE81CF40

Function 00007FFD9B6D3299 Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782258396.00007FFD9B6D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b6d0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1500ddd3e9e463cee60b7aed8319cc73177635f212691ea335590fc49565b49
Instruction ID: 11c1c2ff16dd34fe13bda5a792f7b123efc94503116ac01bab39041186a6f346
Opcode Fuzzy Hash: c1500ddd3e9e463cee60b7aed8319cc73177635f212691ea335590fc49565b49
Instruction Fuzzy Hash: B1D14F71E0955D8FEBA8DB98C8657A8B7A1FF98300F4042BAD01DD72A2DE346985CB41

Function 00007FFD9B6D7D65 Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782258396.00007FFD9B6D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b6d0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de9cedbf92f00403ddace1c73c595265d0dae60b2e82b67a61e574b6aa39bd7a
Instruction ID: 0e0785adfaf91434299a7f1818a21415deeb7aa65a04f1d2473f312f81e48df0
Opcode Fuzzy Hash: de9cedbf92f00403ddace1c73c595265d0dae60b2e82b67a61e574b6aa39bd7a
Instruction Fuzzy Hash: C5D14071E0995D8FEBA4EB588865AA8B3F1FF68340F5042F9D41CD3296DE346E818F01

Function 00007FFD9B7AC260 Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782843240.00007FFD9B7A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7a0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c0ae1bb671cbe791479ff7b40c93bada1386029636c410e673355c43fe707aa
Instruction ID: d6fc9f6fdb3779be3ebe7912c44a451f80cd7165ef7aae9777408325d2300a4b
Opcode Fuzzy Hash: 8c0ae1bb671cbe791479ff7b40c93bada1386029636c410e673355c43fe707aa
Instruction Fuzzy Hash: BE81183170DB4C4FE7A5DB6C98656757BD1EF9A310B0502BAE08AC72B3DD14EC428742

Function 00007FFD9B7ABD6C Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782843240.00007FFD9B7A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7a0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7756f39d47586f60359238bdee64a81101a06ad0e036802ca731e209293e75d
Instruction ID: 18df671cc636f559ee87d6bf103b839643af14320f3857a7aaf68736987a0d98
Opcode Fuzzy Hash: e7756f39d47586f60359238bdee64a81101a06ad0e036802ca731e209293e75d
Instruction Fuzzy Hash: D571277170DB4C4FDBA8DB1C9865A757BD2EF99710B0602AEE48AC72B3DD24EC428741

Function 00007FFD9B6D2FF0 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782258396.00007FFD9B6D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b6d0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d10431c1971c866897c773dd696538156b4bece65abcf9198ba2aac31ec03d5c
Instruction ID: d44818558e98e7842db40c8bf211ce8263ae7c83d3d568dfaf643e4e34dee162
Opcode Fuzzy Hash: d10431c1971c866897c773dd696538156b4bece65abcf9198ba2aac31ec03d5c
Instruction Fuzzy Hash: 1491D471B0DA8E4FDB94CB9C88756BD7BF1EFD8340F05027AE05DE72A2DA2469018741

Function 00007FFD9B6D0F4F Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782258396.00007FFD9B6D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b6d0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 777fe592c9a0386b787d5737d7e6733ed98739f09ad986935119765ba9902956
Instruction ID: fb6083c310ba020f2d573e610b13d4264e64ec1d4bf8d782b47aefe9f0e117cd
Opcode Fuzzy Hash: 777fe592c9a0386b787d5737d7e6733ed98739f09ad986935119765ba9902956
Instruction Fuzzy Hash: 54B17174A05A1C8FDBA4EB18C898BA8B7F1FF69300F1541E9915DE7265DB70AE81CF40

Function 00007FFD9B6D0DF5 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782258396.00007FFD9B6D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b6d0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 472a0c03fbddf014f81acf1cdb606ab5a6966d7adf7ffe4f2ad676aa69e54db7
Instruction ID: 38deba5a955c9df46f3f35081d383bca21a3ca9b26777545080c84bddf20a2d2
Opcode Fuzzy Hash: 472a0c03fbddf014f81acf1cdb606ab5a6966d7adf7ffe4f2ad676aa69e54db7
Instruction Fuzzy Hash: 31A1EE71A0965D8FDBA4DB58C8A8BA8B7F1FF58300F1542E9D41DD72A5DB34AE80CB40

Function 00007FFD9B6D2E90 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782258396.00007FFD9B6D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b6d0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d0133069bc2aef071a9761e64c245c12ad77263b5e5fd79e4d6bea6b24d85f2
Instruction ID: 470659752fd7b71fe0a8bbab10009bca5d44e7e3582f95595c67e04ef15b7859
Opcode Fuzzy Hash: 9d0133069bc2aef071a9761e64c245c12ad77263b5e5fd79e4d6bea6b24d85f2
Instruction Fuzzy Hash: E791FD70A0991D8FDFA4EB58C8A5BAC77F1FF98300F4501A9D01DDB2A6CE35A981CB40

Function 00007FFD9B7AD1D8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782843240.00007FFD9B7A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7a0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88eb8ad54357964998fabf966028b7707580a2631f3f729aa970eee6e9d5fc34
Instruction ID: f6cee862b903021f7806bde884d5dc6eaf79ca36533f3c11313cd677a2941df5
Opcode Fuzzy Hash: 88eb8ad54357964998fabf966028b7707580a2631f3f729aa970eee6e9d5fc34
Instruction Fuzzy Hash: A651E171B1DB4C4FEBA8DA1D986657437D2EF9930070A02EEE49EC32B2ED15EC428741

Function 00007FFD9B6D15AE Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782258396.00007FFD9B6D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b6d0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5b67380c25aa7618f702b6b234fd69442a1e26138a593d1994b171334f8ba23
Instruction ID: 629f2b8d1ef5f57a5971bae06025d1f992177928c9796ac1bccc10e39390f607
Opcode Fuzzy Hash: d5b67380c25aa7618f702b6b234fd69442a1e26138a593d1994b171334f8ba23
Instruction Fuzzy Hash: 07818675A0561D8FDBA8DB58C8A4BA8B7B1FF59300F5041E9D01EE72A5CB34AE81CF40

Function 00007FFD9B7A22EE Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782843240.00007FFD9B7A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7a0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7fb392fe89821493fdce7ae41c7a7916cbb69421f1751d13172aadf050ee628
Instruction ID: 95d22fb8fb59f4e56a3382127c60dd9bb7e17deb06e313b18a532f56b6a498ea
Opcode Fuzzy Hash: d7fb392fe89821493fdce7ae41c7a7916cbb69421f1751d13172aadf050ee628
Instruction Fuzzy Hash: 8E41C220B0EA894FEBA9D7AC84657747BE1EF9A310F1501BAD48EC71F3CD29AD418341

Function 00007FFD9B6D2F0D Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782258396.00007FFD9B6D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b6d0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95372c74d59a7988263c14c3cb8ac2851bdc2fe27b870f863d4ccabe96564142
Instruction ID: 7b8f8c464dc8bea1bc1bb5473d8080d0328cc55cd31554f88e42f0a2697ef7df
Opcode Fuzzy Hash: 95372c74d59a7988263c14c3cb8ac2851bdc2fe27b870f863d4ccabe96564142
Instruction Fuzzy Hash: 2751D171A0864D8FDB55EFA8C865AEE7BF0FF94310F0402BAE419D72A6DE34A544CB40

Function 00007FFD9B7A031D Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782843240.00007FFD9B7A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7a0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98d94e51c27bb88cbd47e71a7ad1879ce4362c7428f94c5967973214bcb37310
Instruction ID: a31af143b2557e3040ce5ba03271b2a5c892edefe9bb3619c094b983979cd1ee
Opcode Fuzzy Hash: 98d94e51c27bb88cbd47e71a7ad1879ce4362c7428f94c5967973214bcb37310
Instruction Fuzzy Hash: 57414631B0EB894FD7A5A66C88A96757BD1EF56720B0906FFD04DC71F3C919AC028381

Function 00007FFD9B6D0A52 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782258396.00007FFD9B6D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b6d0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 060b1884bc39201415b6d2acb11c299cb89f209dc9136a2a124554f0a7b152ab
Instruction ID: bb7396dac7c3ec297768ec5ef722936a2ed825f2f216f4464fab8feb58836c64
Opcode Fuzzy Hash: 060b1884bc39201415b6d2acb11c299cb89f209dc9136a2a124554f0a7b152ab
Instruction Fuzzy Hash: 59418271E58A4C8FE784CF58D8A87A97FE1FBA5704F9001AAD109D73DADB756404CB40

Function 00007FFD9B6D2CBD Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782258396.00007FFD9B6D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b6d0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf47bc9de849edaea0cb5dd65b375d442e349d91913bec59861243c77e6a7d49
Instruction ID: a0c849a84847ce38e0d17ac30b2697ef540a0efc96d30a3e8b5da7e8c2bddc48
Opcode Fuzzy Hash: bf47bc9de849edaea0cb5dd65b375d442e349d91913bec59861243c77e6a7d49
Instruction Fuzzy Hash: AC312C71A0FACD5FDB659BA8CC691A87FA0FF91300F4502FAD458CA0A2DA25B948C701

Function 00007FFD9B6D30D0 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782258396.00007FFD9B6D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b6d0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19be1bd9bc06ca9db04dde20de8f4b63a6dcbb9e1947f18aa061dd499deb9956
Instruction ID: 4c6a99dac0c3b3551057fb53f3cb6d5f91de01393215b99e199aa1acb3888f30
Opcode Fuzzy Hash: 19be1bd9bc06ca9db04dde20de8f4b63a6dcbb9e1947f18aa061dd499deb9956
Instruction Fuzzy Hash: BF21E032E09A4D4FEBA4DF9C8C642AD7BF2EFC8310F14426AE41DE7291DB3469018781

Function 00007FFD9B6D2742 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782258396.00007FFD9B6D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b6d0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a5ab93b3bd2a89140eaeefb6be68945373b862369db221f598a51af333e952f
Instruction ID: cdbfb8ebc1bf6f6980badc0350439d6294222d52cc3070960d8b3f5a3a362ed8
Opcode Fuzzy Hash: 3a5ab93b3bd2a89140eaeefb6be68945373b862369db221f598a51af333e952f
Instruction Fuzzy Hash: 9D21D571B1A58E4FF7A4EBA8CC665B9B790FF94300F8106B9E42DCA0E2DD2475408B41

Function 00007FFD9B6D225D Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782258396.00007FFD9B6D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b6d0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5430b4d165e92bf65e2beccbdd485f7336735b0749b34cd197122bba5deda3f
Instruction ID: 60651f5158b0c3ee45dc18f845b39bb413941282b24c6a728a190745f23edb1b
Opcode Fuzzy Hash: d5430b4d165e92bf65e2beccbdd485f7336735b0749b34cd197122bba5deda3f
Instruction Fuzzy Hash: A8212E74A0994D8FDB94EF98C898AA97BF0FF59300F0545A9E429C72A1D770AA54CB00

Function 00007FFD9B6D21F9 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782258396.00007FFD9B6D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b6d0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8902a7372049429954f2c12a75f1ed6eccff51ad859867c963ece9fd4a04d081
Instruction ID: 7066274066c4567479d668431935279fce7a6f5d864c401df0b4f737102a7cfe
Opcode Fuzzy Hash: 8902a7372049429954f2c12a75f1ed6eccff51ad859867c963ece9fd4a04d081
Instruction Fuzzy Hash: 8D219571A0994D8FDF91EF58C855AADBBB0FF55300F0546EAE42CC71A6DB34A941CB40

Function 00007FFD9B7A2119 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782843240.00007FFD9B7A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7a0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73674750bab1d69777459d792801d416ae33dfbdf73daa00116c1287eaa47424
Instruction ID: 0c6051cc1d94e56ea08ba8eb04551296c4ffc97576479cd1a148efb5994ca0de
Opcode Fuzzy Hash: 73674750bab1d69777459d792801d416ae33dfbdf73daa00116c1287eaa47424
Instruction Fuzzy Hash: B2119362B0EA894FE7E5979C88A51347BD2EF99750F1901BEE08DC72F3DD29AC418301

Function 00007FFD9B7A04FD Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782843240.00007FFD9B7A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7a0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af5e6fece16f536b9a2531e26a4d105b8dc89e17c3ce0f0a0e85544a55129907
Instruction ID: e6dae4470db4eb9d8f79b62a3f0b9df8b76a36146bc9f48fdea8e08d5dc49c98
Opcode Fuzzy Hash: af5e6fece16f536b9a2531e26a4d105b8dc89e17c3ce0f0a0e85544a55129907
Instruction Fuzzy Hash: 9911E761B0EB890FE7E5971C8474A3477D1EF99B50B1907BAE04DC32F2DE18AC418705

Function 00007FFD9B7A06E0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782843240.00007FFD9B7A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7a0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c165a7d6a0a55f6229e67a63c50698c59165856c1b70137f22d98e0d7d61734
Instruction ID: d743f061192641795c92ddf7b2eb1139f5ea859a70e96d353eafa6fee0f5d76b
Opcode Fuzzy Hash: 0c165a7d6a0a55f6229e67a63c50698c59165856c1b70137f22d98e0d7d61734
Instruction Fuzzy Hash: 56113662B0EB894FE7A4975C846552877D1FF94B50B1A07BAE08DC32F2DD39BD018705

Function 00007FFD9B6D2835 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782258396.00007FFD9B6D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b6d0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af5c51c3c44a2d18af64d04a8e7204ac2744f71889129b2cd4b8713161e86472
Instruction ID: 72309979b9935760a8976569a1e13c55267b53a6eea31d98162edf4f4a8019b1
Opcode Fuzzy Hash: af5c51c3c44a2d18af64d04a8e7204ac2744f71889129b2cd4b8713161e86472
Instruction Fuzzy Hash: B011D672F0954D4FDB64DB98CCA55E97BA1EFD5300F0102B6E028CB0A2DD24B5448741

Function 00007FFD9B6D323D Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782258396.00007FFD9B6D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b6d0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34ada1d75689a9d766749f516510657d6da543ce1eb78997650e33e21a85e581
Instruction ID: 82b6a745c01cd789558c20003b8950f0aaa3e1443886070153e4e5b9bf93265c
Opcode Fuzzy Hash: 34ada1d75689a9d766749f516510657d6da543ce1eb78997650e33e21a85e581
Instruction Fuzzy Hash: 1E11B131F5A54E4FE764EB94DCA11A87760FFC4300F8102B9E02CC60E6DE29BA45C741

Function 00007FFD9B6D0D01 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782258396.00007FFD9B6D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b6d0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 459ef80821608c9e0cab7f4d3947aee56ed559d040734e47941761346f5e039e
Instruction ID: f62c74d57bda3ae57762a43ec3894d70b363b959f8969cfbc1484707e1eec4a2
Opcode Fuzzy Hash: 459ef80821608c9e0cab7f4d3947aee56ed559d040734e47941761346f5e039e
Instruction Fuzzy Hash: 0901A561E0E54D5FE7A5AB6888366F97BA1EF94600F4506BBE418CA0E2ED287540C701

Function 00007FFD9B7A07CE Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782843240.00007FFD9B7A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7a0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48af3946dbdc52b4ca5045179863a9924cb45b03ba17964002917c630054c55f
Instruction ID: a7eae6d2c3f43b5aee8ab4e596d2947669a969d3e31027ba4f852a6394968c18
Opcode Fuzzy Hash: 48af3946dbdc52b4ca5045179863a9924cb45b03ba17964002917c630054c55f
Instruction Fuzzy Hash: 3511733170EA898FDBA5D758C464E2877E1EF55700B1906ADD04DC71F2CA28BC80C785

Function 00007FFD9B6D1F71 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782258396.00007FFD9B6D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b6d0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 569848bab3747f81be2acde8c62060ea1d4f246ee4e5f2557cc77a26ac8bc947
Instruction ID: 5e11e0446bcfca82acd74fabb64c34bf65adee434bff12768de3847e7a18a407
Opcode Fuzzy Hash: 569848bab3747f81be2acde8c62060ea1d4f246ee4e5f2557cc77a26ac8bc947
Instruction Fuzzy Hash: F1119530A0961C8FCFA9DB18C894AA873B6FB59300F1042E9D00DE72A1CA71AE81CF40

Function 00007FFD9B6D0850 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782258396.00007FFD9B6D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b6d0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 402bd15b364bc878bb2a2133e08da0875c554fe28e4d8663050307e14d51a39d
Instruction ID: 9d4d4142ba96714e90000a74e91a5425247d3fc7496a51f73576501076280836
Opcode Fuzzy Hash: 402bd15b364bc878bb2a2133e08da0875c554fe28e4d8663050307e14d51a39d
Instruction Fuzzy Hash: A701A713F0F58E46EB2623ADAC751F97B50EF83624F4903B2E4AD890E3DD097516C191

Function 00007FFD9B6D3775 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782258396.00007FFD9B6D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b6d0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4397318de1bb81eed2c50e1f107f66b11cbf392fdad6d73e2d0eb0d83dae07b
Instruction ID: 419f0912ef2185757dcb1e1b3a155a22c211331814d744d5f2bb79df2b485ecf
Opcode Fuzzy Hash: c4397318de1bb81eed2c50e1f107f66b11cbf392fdad6d73e2d0eb0d83dae07b
Instruction Fuzzy Hash: 19015E70908A4D8FDF84EF58C858AEE7BF0FF68300F0005AAD418C72A1D7309554CB81

Function 00007FFD9B6D2FA8 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782258396.00007FFD9B6D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b6d0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d85e1137e12c91c6f4a4a0786c9e81e2375c3ac3c72eaf1af0bce854be6d5cac
Instruction ID: 54433c643ece6aa9f85c76b2c6c2e6fa812e6bf5d6271a273cd8721533ba895e
Opcode Fuzzy Hash: d85e1137e12c91c6f4a4a0786c9e81e2375c3ac3c72eaf1af0bce854be6d5cac
Instruction Fuzzy Hash: 2701DA70914A4D9FDF84EF58C849AEE77F0FB68305F10066AA41DD7264DB30E690CB81

Function 00007FFD9B6D2EE0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782258396.00007FFD9B6D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b6d0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf23ceb0855ef4bf928cf5d7ea7078f7fa2b3b76ffb53218ce513a5ce2d47097
Instruction ID: d042fc1757a0f8dd13944bb6407db4dbcb56e27f35b11bffc7917f25bc33bdc6
Opcode Fuzzy Hash: cf23ceb0855ef4bf928cf5d7ea7078f7fa2b3b76ffb53218ce513a5ce2d47097
Instruction Fuzzy Hash: 0001DA70914A0D9FDF94EF58C849AEE77F0FB68305F11466AA419D7264DB70E590CB80

Function 00007FFD9B6D2F80 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782258396.00007FFD9B6D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b6d0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a433395c0ca3c2814313b646fb42dcef7093a539a1945f688115d9acecfa5d99
Instruction ID: dd0e986bff987ffa326cc535b603302af9b57a5c6c1d83c84afaa5093c829e46
Opcode Fuzzy Hash: a433395c0ca3c2814313b646fb42dcef7093a539a1945f688115d9acecfa5d99
Instruction Fuzzy Hash: 4B01BB7091494D8FDF94EF98C858AFE77F0FB68305F10456AA419D72A4DB30A690CB80

Function 00007FFD9B6D185F Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782258396.00007FFD9B6D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b6d0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2b09c8f633d754bdf720e48de3c171c392e1e63e32fa012aa531555d91ffa39
Instruction ID: 9a8b6acfc7cbfc2e024f8aa9c7bc3587982463014012916c017b0f4d21360a30
Opcode Fuzzy Hash: f2b09c8f633d754bdf720e48de3c171c392e1e63e32fa012aa531555d91ffa39
Instruction Fuzzy Hash: A0015C70A0965C8FDFA9DB58C894AA877B5FB55701F1011E9D01DE72A5CB71AE80CF40

Function 00007FFD9B6D2F08 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782258396.00007FFD9B6D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b6d0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1f7aa2d58b022493238e5e250c3431a18f35bb60031a19f3bfe8dc3c39fd2af
Instruction ID: 7fd0f2113b23a933269c5870674858fb44917140925f8ccbede1072556e7d8a5
Opcode Fuzzy Hash: a1f7aa2d58b022493238e5e250c3431a18f35bb60031a19f3bfe8dc3c39fd2af
Instruction Fuzzy Hash: 6501B67091490D8FDF94EF98C858ABE7BF0FB68305F10466AA41DD72A4DB30A690CB80

Function 00007FFD9B6D3790 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782258396.00007FFD9B6D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b6d0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dbfee83474246972207ebef265887b5067b044547b592d02bb37c545ec936ef
Instruction ID: 14adb26bd38b4d9e1f659f7350b801c57fb65a66fdf5c2a056ffd3ea24a47710
Opcode Fuzzy Hash: 5dbfee83474246972207ebef265887b5067b044547b592d02bb37c545ec936ef
Instruction Fuzzy Hash: AE01EC7091490D8FDF84EF58C848AEE7BF0FF68305F10456AE419D72A0DB70A694CB80

Function 00007FFD9B6D0D99 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782258396.00007FFD9B6D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b6d0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66ae3ba9e71f6569042e657a79866926145dd5545d55648ef97d699483bc0ab9
Instruction ID: 95cf5a84f0b34b895ceda950973f14077a8fbe0f9c68d45474501f51f9fd2ec4
Opcode Fuzzy Hash: 66ae3ba9e71f6569042e657a79866926145dd5545d55648ef97d699483bc0ab9
Instruction Fuzzy Hash: 42F0FC7190F78C5FE7629B648C391D87FA0EF95210F4501E7D458CB0E3DA257584C301

Function 00007FFD9B6D2D70 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782258396.00007FFD9B6D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b6d0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 855c8cd5258e1069d5d2ea526701914d03d9a58e4def025295c1b836c1a4d995
Instruction ID: 81d043e72c83f0a83b4dd5f37f3ae4569d6305a593a61c61525e50ce178a03df
Opcode Fuzzy Hash: 855c8cd5258e1069d5d2ea526701914d03d9a58e4def025295c1b836c1a4d995
Instruction Fuzzy Hash: 0BF01C3091494C9FDF94EFA8C858AE9BBF0FF68305F4045AAE41DC71A4DB31A694CB40

Function 00007FFD9B6D0873 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782258396.00007FFD9B6D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b6d0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d49600d95a4dd911cae6280ae9328bd7a33291565c3d45d4449af4aa2f5b0875
Instruction ID: a44d6651ec868f2427b7a11d8574e203a4c608fa550ec298e8340d4144e81cd4
Opcode Fuzzy Hash: d49600d95a4dd911cae6280ae9328bd7a33291565c3d45d4449af4aa2f5b0875
Instruction Fuzzy Hash: BDF01261A0E7CD9EDB2367F55C751A47F30AF93204F4A06A3E4A8CA0E3D9186618C362

Non-executed Functions

Function 00007FFD9B6D20F4 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1782258396.00007FFD9B6D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b6d0000_QtON0L47XD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41d2a8db6dec85406ce0e955c83f5c89f531efb474decd840dcdbe758263219c
Instruction ID: 88ac26f8bdde9275f4ee263601b6a872a719d2190de1bed69c5a10e62f116cac
Opcode Fuzzy Hash: 41d2a8db6dec85406ce0e955c83f5c89f531efb474decd840dcdbe758263219c
Instruction Fuzzy Hash: 0A41257190E6CE4FE7529FA0DC619E57FB0EF82324F0542F7E558CA0A3DA299946C341

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report QtON0L47XD.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\QtON0L47XD.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
QtON0L47XD.exe

Function 00007FFD9B904F09 Relevance: 4.1, Strings: 1, Instructions: 2880
COMMON

Function 00007FFD9B8FAA1D Relevance: 3.5, Strings: 2, Instructions: 988
COMMON

Function 00007FFD9B8F3C51 Relevance: 2.2, Strings: 1, Instructions: 923
COMMON

Function 00007FFD9B90D86D Relevance: 2.1, Strings: 1, Instructions: 824
COMMON

Function 00007FFD9B7AC4CC Relevance: 2.0, Strings: 1, Instructions: 723
COMMON

Function 00007FFD9B7ADAED Relevance: 1.8, Strings: 1, Instructions: 585
COMMON

Function 00007FFD9B8F6DAA Relevance: 1.7, APIs: 1, Instructions: 249
fileCOMMON

Function 00007FFD9B8F78A1 Relevance: 1.7, APIs: 1, Instructions: 166
fileCOMMON

Function 00007FFD9B8F5609 Relevance: 1.6, APIs: 1, Instructions: 118
windowCOMMON