Edit tour

Windows Analysis Report
jyRdJ06Naz.exe

Overview

General Information

Sample name:	jyRdJ06Naz.exe renamed because original name is a hash value
Original sample name:	489c9c7de5953234600a72ebe8686633e2e0eceb79c408e772e83d561da4b814.exe
Analysis ID:	1554438
MD5:	c83b55a55faf5ff57dcfb50c4344521a
SHA1:	efa22ba249f339111962fe109b256b215358c8b1
SHA256:	489c9c7de5953234600a72ebe8686633e2e0eceb79c408e772e83d561da4b814
Tags:	4-251-123-83exeuser-JAMESWT_MHT
Infos:

Detection

Meduza Stealer, PureLog Stealer, RedLine, zgRAT

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Meduza Stealer

Yara detected PureLog Stealer

Yara detected RedLine Stealer

Yara detected zgRAT

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Creates an undocumented autostart registry key

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for dropped file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

jyRdJ06Naz.exe (PID: 6900 cmdline: "C:\Users\user\Desktop\jyRdJ06Naz.exe" MD5: C83B55A55FAF5FF57DCFB50C4344521A)

jyRdJ06Naz.tmp (PID: 6948 cmdline: "C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp" /SL5="$2042A,48507756,797184,C:\Users\user\Desktop\jyRdJ06Naz.exe" MD5: 6F170135AEC26A106334B8FEF0F3AB5A)

ttgtggt.exe (PID: 2496 cmdline: "C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe" MD5: C9B68B9567CC9067794E32999C02BFA7)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: RedLine

{"C2 url": "4.251.123.83:6677"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Programs\My Program\is-E8O0B.tmp	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Users\user\AppData\Local\Programs\My Program\is-E8O0B.tmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Programs\My Program\is-E8O0B.tmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\Users\user\AppData\Local\Programs\My Program\is-E8O0B.tmp	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x45c19:$s1: file:/// 0x45b51:$s2: {11111-22222-10009-11112} 0x45ba9:$s3: {11111-22222-50001-00000} 0x423fa:$s4: get_Module 0x42864:$s5: Reverse 0x45226:$s6: BlockCopy 0x42c23:$s7: ReadByte 0x45c2b:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...

Memory Dumps

Source	Rule	Description	Author
00000006.00000000.1930311568.00000000003F2000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000006.00000000.1930311568.00000000003F2000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000006.00000002.2006656227.00000000027AD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ttgtggt.exe PID: 2496	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: ttgtggt.exe PID: 2496	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ttgtggt.exe PID: 2496	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
6.0.ttgtggt.exe.3f0000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
6.0.ttgtggt.exe.3f0000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.0.ttgtggt.exe.3f0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
6.0.ttgtggt.exe.3f0000.0.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x45c19:$s1: file:/// 0x45b51:$s2: {11111-22222-10009-11112} 0x45ba9:$s3: {11111-22222-50001-00000} 0x423fa:$s4: get_Module 0x42864:$s5: Reverse 0x45226:$s6: BlockCopy 0x42c23:$s7: ReadByte 0x45c2b:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T14:56:17.147993+0100	2022930	1	A Network Trojan was detected	172.202.163.200	443	192.168.2.4	49730	TCP
2024-11-12T14:56:56.284212+0100	2022930	1	A Network Trojan was detected	172.202.163.200	443	192.168.2.4	49743	TCP

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T14:56:25.138239+0100	2046056	1	A Network Trojan was detected	4.251.123.83	6677	192.168.2.4	49736	TCP

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T14:56:24.617611+0100	2046045	1	A Network Trojan was detected	192.168.2.4	49736	4.251.123.83	6677	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: ttgtggt.exe.2496.6.memstrmin

Malware Configuration Extractor: RedLine {"C2 url": "4.251.123.83:6677"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Programs\My Program\is-E8O0B.tmp	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe (copy)	ReversingLabs: Detection: 65%

Multi AV Scanner detection for submitted file

Source: jyRdJ06Naz.exe

ReversingLabs: Detection: 26%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.3% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Programs\My Program\is-E8O0B.tmp

Joe Sandbox ML: detected

Source: jyRdJ06Naz.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{873AD2E0-A2B0-482E-8E07-2D2EF1B74924}_is1

Jump to behavior

Source: jyRdJ06Naz.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\Decoder.pdb source: is-8QRAK.tmp.1.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\Decoder.pdb2 source: is-8QRAK.tmp.1.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\ExternalUi.pdbl source: is-8QRAK.tmp.1.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\ExternalUi.pdb source: is-8QRAK.tmp.1.dr

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.4:49736 -> 4.251.123.83:6677
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 4.251.123.83:6677 -> 192.168.2.4:49736

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 4.251.123.83:6677

Source: global traffic

TCP traffic: 192.168.2.4:49736 -> 4.251.123.83:6677

Source: Joe Sandbox View

IP Address: 4.251.123.83 4.251.123.83

Source: Joe Sandbox View

ASN Name: LEVEL3US LEVEL3US

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.4:49743
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.4:49730

Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83

Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 3IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: is-8QRAK.tmp.1.dr	String found in binary or memory: BLShlwapi.dllShell32.dllbinSoftware\JavaSoft\Java Development Kit\JavaHomeSoftware\JavaSoft\Java Runtime Environment\FlashWindowFlashWindowExKernel32.dllGetPackagePathhttp://www.yahoo.comhttp://www.google.comTESThttp://www.example.comtin9999.tmpHEAD.part=attachmentfilename "DLDcharsetPOST123utf-16utf-8US-ASCIIISO-8859-1GETAdvancedInstallerFTP ServerLocal Network ServerHTTP/1.0/If-Modified-Since: %s equals www.yahoo.com (Yahoo)
Source: ttgtggt.exe, 00000006.00000002.2026705014.000000001BA7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: ttgtggt.exe, 00000006.00000002.2006656227.00000000029C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: qC:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: ttgtggt.exe, 00000006.00000002.2006656227.00000000029C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: qC:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb8 equals www.youtube.com (Youtube)

Source: jyRdJ06Naz.tmp, 00000001.00000002.1939184757.0000000000AEC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: jyRdJ06Naz.tmp, 00000001.00000002.1939184757.0000000000AEC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: jyRdJ06Naz.tmp, 00000001.00000002.1939184757.0000000000AEC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: jyRdJ06Naz.tmp, 00000001.00000002.1939184757.0000000000AEC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: jyRdJ06Naz.tmp, 00000001.00000002.1939184757.0000000000AEC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: jyRdJ06Naz.tmp, 00000001.00000002.1939184757.0000000000AEC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: jyRdJ06Naz.tmp, 00000001.00000002.1939184757.0000000000AEC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field1
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field1Response
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field2
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2006656227.00000000027AD000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field2Response
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field3
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002875000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field3Response
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002BE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.o
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002BE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.oh
Source: ttgtggt.exe, 00000006.00000002.2018682966.000000001288A000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012ADF000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012B38000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012831000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.00000000127D8000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.00000000128E3000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.000000001273E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: ttgtggt.exe, 00000006.00000002.2018682966.000000001288A000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012ADF000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012B38000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012831000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.00000000127D8000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.00000000128E3000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.000000001273E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: ttgtggt.exe, 00000006.00000002.2018682966.000000001288A000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012ADF000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012B38000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012831000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.00000000127D8000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.00000000128E3000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.000000001273E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: ttgtggt.exe, 00000006.00000002.2018682966.000000001288A000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012ADF000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012B38000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012831000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.00000000127D8000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.00000000128E3000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.000000001273E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: ttgtggt.exe, 00000006.00000002.2018682966.000000001288A000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012ADF000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012B38000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012831000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.00000000127D8000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.00000000128E3000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.000000001273E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: ttgtggt.exe, 00000006.00000002.2018682966.000000001288A000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012ADF000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012B38000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012831000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.00000000127D8000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.00000000128E3000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.000000001273E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: ttgtggt.exe, 00000006.00000002.2018682966.000000001288A000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012ADF000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012B38000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012831000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.00000000127D8000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.00000000128E3000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.000000001273E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: jyRdJ06Naz.exe	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: jyRdJ06Naz.tmp, 00000001.00000002.1939184757.0000000000AEC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: ttgtggt.exe, 00000006.00000002.2018682966.000000001288A000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012ADF000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012B38000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012831000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.00000000127D8000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.00000000128E3000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.000000001273E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: jyRdJ06Naz.exe, 00000000.00000003.1942074613.0000000002873000.00000004.00001000.00020000.00000000.sdmp, jyRdJ06Naz.tmp, 00000001.00000003.1936101669.0000000002843000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.github.com/
Source: jyRdJ06Naz.exe, 00000000.00000003.1707261525.0000000002D10000.00000004.00001000.00020000.00000000.sdmp, jyRdJ06Naz.tmp, 00000001.00000003.1713318597.0000000003850000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.github.com/.https://www.github.com/.https://www.github.com/
Source: jyRdJ06Naz.tmp, 00000001.00000003.1936101669.0000000002843000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.github.com/Q9
Source: ttgtggt.exe, 00000006.00000002.2018682966.000000001288A000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012ADF000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012B38000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012831000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.00000000127D8000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.00000000128E3000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.000000001273E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: jyRdJ06Naz.exe, 00000000.00000003.1708458496.0000000002D10000.00000004.00001000.00020000.00000000.sdmp, jyRdJ06Naz.exe, 00000000.00000003.1708853583.000000007F46B000.00000004.00001000.00020000.00000000.sdmp, jyRdJ06Naz.tmp, 00000001.00000000.1710643781.00000000002B1000.00000020.00000001.01000000.00000004.sdmp, jyRdJ06Naz.tmp.0.dr	String found in binary or memory: https://www.innosetup.com/
Source: jyRdJ06Naz.exe, 00000000.00000003.1708458496.0000000002D10000.00000004.00001000.00020000.00000000.sdmp, jyRdJ06Naz.exe, 00000000.00000003.1708853583.000000007F46B000.00000004.00001000.00020000.00000000.sdmp, jyRdJ06Naz.tmp, 00000001.00000000.1710643781.00000000002B1000.00000020.00000001.01000000.00000004.sdmp, jyRdJ06Naz.tmp.0.dr	String found in binary or memory: https://www.remobjects.com/ps

Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 6.0.ttgtggt.exe.3f0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Programs\My Program\is-E8O0B.tmp, type: DROPPED	Matched rule: Detects zgRAT Author: ditekSHen

Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Code function: 6_2_00007FFD9B98C50A	6_2_00007FFD9B98C50A
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Code function: 6_2_00007FFD9B989D02	6_2_00007FFD9B989D02
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Code function: 6_2_00007FFD9B9816B3	6_2_00007FFD9B9816B3
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Code function: 6_2_00007FFD9BAE2B30	6_2_00007FFD9BAE2B30
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Code function: 6_2_00007FFD9BAE4A99	6_2_00007FFD9BAE4A99
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Code function: 6_2_00007FFD9BAE2AD0	6_2_00007FFD9BAE2AD0
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Code function: 6_2_00007FFD9BAE1AC7	6_2_00007FFD9BAE1AC7
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Code function: 6_2_00007FFD9BAE2AB0	6_2_00007FFD9BAE2AB0
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Code function: 6_2_00007FFD9BAD05B1	6_2_00007FFD9BAD05B1
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Code function: 6_2_00007FFD9BAE5491	6_2_00007FFD9BAE5491
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Code function: 6_2_00007FFD9BADB41D	6_2_00007FFD9BADB41D
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Code function: 6_2_00007FFD9BAE5A2C	6_2_00007FFD9BAE5A2C

Source: jyRdJ06Naz.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-6IG1B.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows

Source: jyRdJ06Naz.tmp.0.dr	Static PE information: Number of sections : 11 > 10
Source: is-6IG1B.tmp.1.dr	Static PE information: Number of sections : 11 > 10
Source: jyRdJ06Naz.exe	Static PE information: Number of sections : 11 > 10

Source: jyRdJ06Naz.exe, 00000000.00000003.1708853583.000000007F75B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs jyRdJ06Naz.exe
Source: jyRdJ06Naz.exe, 00000000.00000000.1706974568.0000000000189000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs jyRdJ06Naz.exe
Source: jyRdJ06Naz.exe, 00000000.00000003.1708458496.0000000002E1F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs jyRdJ06Naz.exe
Source: jyRdJ06Naz.exe	Binary or memory string: OriginalFileName vs jyRdJ06Naz.exe

Source: jyRdJ06Naz.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 6.0.ttgtggt.exe.3f0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: C:\Users\user\AppData\Local\Programs\My Program\is-E8O0B.tmp, type: DROPPED	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT

Source: classification engine

Classification label: mal80.troj.spyw.evad.winEXE@5/11@0/1

Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\jyRdJ06Naz.exe

File created: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp

Jump to behavior

Source: C:\Users\user\Desktop\jyRdJ06Naz.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\jyRdJ06Naz.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\jyRdJ06Naz.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: jyRdJ06Naz.exe

ReversingLabs: Detection: 26%

Source: jyRdJ06Naz.exe

String found in binary or memory: /LOADINF="filename"

Source: C:\Users\user\Desktop\jyRdJ06Naz.exe

File read: C:\Users\user\Desktop\jyRdJ06Naz.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\jyRdJ06Naz.exe "C:\Users\user\Desktop\jyRdJ06Naz.exe"
Source: C:\Users\user\Desktop\jyRdJ06Naz.exe	Process created: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp "C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp" /SL5="$2042A,48507756,797184,C:\Users\user\Desktop\jyRdJ06Naz.exe"
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Process created: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe "C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe"
Source: C:\Users\user\Desktop\jyRdJ06Naz.exe	Process created: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp "C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp" /SL5="$2042A,48507756,797184,C:\Users\user\Desktop\jyRdJ06Naz.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Process created: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe "C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe"	Jump to behavior

Source: C:\Users\user\Desktop\jyRdJ06Naz.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\jyRdJ06Naz.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: msftedit.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: globinputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: My Program.lnk.1.dr

LNK file: ..\..\..\..\..\Local\Programs\My Program\ttgtggt.exe

Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp

Window found: window name: TMainForm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Automated click: Next

Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp

File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{873AD2E0-A2B0-482E-8E07-2D2EF1B74924}_is1

Jump to behavior

Source: jyRdJ06Naz.exe

Static file information: File size 49460692 > 1048576

Source: jyRdJ06Naz.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\Decoder.pdb source: is-8QRAK.tmp.1.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\Decoder.pdb2 source: is-8QRAK.tmp.1.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\ExternalUi.pdbl source: is-8QRAK.tmp.1.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\ExternalUi.pdb source: is-8QRAK.tmp.1.dr

Source: is-E8O0B.tmp.1.dr

Static PE information: 0xE3FEC0F4 [Mon Mar 19 06:19:32 2091 UTC]

Source: jyRdJ06Naz.exe	Static PE information: section name: .didata
Source: jyRdJ06Naz.tmp.0.dr	Static PE information: section name: .didata
Source: is-6IG1B.tmp.1.dr	Static PE information: section name: .didata

Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Code function: 6_2_00007FFD9B8B6BAF push ebp; ret	6_2_00007FFD9B8B6BB0
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Code function: 6_2_00007FFD9B8B5CB5 push edx; iretd	6_2_00007FFD9B8B5CBB
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Code function: 6_2_00007FFD9B982004 pushad ; retf	6_2_00007FFD9B982005
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Code function: 6_2_00007FFD9B98CB50 push eax; retf	6_2_00007FFD9B98CB61

Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	File created: C:\Users\user\AppData\Local\Temp\is-OJBCC.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	File created: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	File created: C:\Users\user\AppData\Local\Programs\My Program\is-6IG1B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	File created: C:\Users\user\AppData\Local\Programs\My Program\is-8QRAK.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\jyRdJ06Naz.exe	File created: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	File created: C:\Users\user\AppData\Local\Programs\My Program\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	File created: C:\Users\user\AppData\Local\Programs\My Program\Octo_Browser_latest_win.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	File created: C:\Users\user\AppData\Local\Programs\My Program\is-E8O0B.tmp	Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Key value created or modified: HKEY_CURRENT_USER_Classes\.exe\OpenWithProgids Win64.exe			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Key value created or modified: HKEY_CURRENT_USER_Classes\.exe\OpenWithProgids Win64.exe			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\My Program.lnk

Jump to behavior

Source: C:\Users\user\Desktop\jyRdJ06Naz.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: \QEMU-GA.EXE

Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Memory allocated: B70000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Memory allocated: 1A700000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Window / User API: threadDelayed 1027			Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Window / User API: threadDelayed 3038			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-OJBCC.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\My Program\is-6IG1B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\My Program\is-8QRAK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\My Program\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\My Program\Octo_Browser_latest_win.exe (copy)	Jump to dropped file

Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe TID: 4852	Thread sleep time: -11068046444225724s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe TID: 4348	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe
Source: jyRdJ06Naz.tmp, 00000001.00000003.1937642336.0000000000C2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: is-8QRAK.tmp.1.dr	Binary or memory string: YqEmu^
Source: ttgtggt.exe, 00000006.00000002.2027209937.000000001BADD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll]

Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected Meduza Stealer

Source: Yara match

File source: Process Memory Space: ttgtggt.exe PID: 2496, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 6.0.ttgtggt.exe.3f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.1930311568.00000000003F2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Programs\My Program\is-E8O0B.tmp, type: DROPPED

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 6.0.ttgtggt.exe.3f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.1930311568.00000000003F2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ttgtggt.exe PID: 2496, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Programs\My Program\is-E8O0B.tmp, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: 6.0.ttgtggt.exe.3f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Programs\My Program\is-E8O0B.tmp, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: hieplnfojfccegoloniefimmbfjdgcgp\|Electrum
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ElectronCashE#
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: mhonjhhcgphdphdjcdoeodfdliikapmj\|Jaxx Liberty
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: idkppnahnmmggbmfkjhiakkbkdpnmnon\|Exodus
Source: ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: EthereumE#
Source: ttgtggt.exe, 00000006.00000000.1930311568.00000000003F2000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: set_UseMachineKeyStore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior

Source: Yara match	File source: 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2006656227.00000000027AD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ttgtggt.exe PID: 2496, type: MEMORYSTR

Remote Access Functionality

Yara detected Meduza Stealer

Source: Yara match

File source: Process Memory Space: ttgtggt.exe PID: 2496, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 6.0.ttgtggt.exe.3f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.1930311568.00000000003F2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Programs\My Program\is-E8O0B.tmp, type: DROPPED

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 6.0.ttgtggt.exe.3f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.1930311568.00000000003F2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ttgtggt.exe PID: 2496, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Programs\My Program\is-E8O0B.tmp, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: 6.0.ttgtggt.exe.3f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Programs\My Program\is-E8O0B.tmp, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 Windows Service	1 Windows Service	1 Masquerading	1 OS Credential Dumping	421 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	1 Process Injection	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	3 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	11 Registry Run Keys / Startup Folder	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Clipboard Data	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	2 System Owner/User Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	113 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
jyRdJ06Naz.exe	26%	ReversingLabs	ByteCode-MSIL.Trojan.Mamut

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Programs\My Program\is-E8O0B.tmp	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Programs\My Program\Octo_Browser_latest_win.exe (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\My Program\is-6IG1B.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\My Program\is-8QRAK.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\My Program\is-E8O0B.tmp	66%	ReversingLabs	ByteCode-MSIL.Ransomware.RedLine
C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe (copy)	66%	ReversingLabs	ByteCode-MSIL.Ransomware.RedLine
C:\Users\user\AppData\Local\Programs\My Program\unins000.exe (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-OJBCC.tmp\_isetup\_setup64.tmp	0%	ReversingLabs

Name	Source	Malicious	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtab	ttgtggt.exe, 00000006.00000002.2018682966.000000001288A000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012ADF000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012B38000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012831000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.00000000127D8000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.00000000128E3000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.000000001273E000.00000004.00000800.00020000.00000000.sdmp	false	high
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	jyRdJ06Naz.exe	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	ttgtggt.exe, 00000006.00000002.2018682966.000000001288A000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012ADF000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012B38000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012831000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.00000000127D8000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.00000000128E3000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.000000001273E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	jyRdJ06Naz.tmp, 00000001.00000002.1939184757.0000000000AEC000.00000004.00000010.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.remobjects.com/ps	jyRdJ06Naz.exe, 00000000.00000003.1708458496.0000000002D10000.00000004.00001000.00020000.00000000.sdmp, jyRdJ06Naz.exe, 00000000.00000003.1708853583.000000007F46B000.00000004.00001000.00020000.00000000.sdmp, jyRdJ06Naz.tmp, 00000001.00000000.1710643781.00000000002B1000.00000020.00000001.01000000.00000004.sdmp, jyRdJ06Naz.tmp.0.dr	false	high
https://www.innosetup.com/	jyRdJ06Naz.exe, 00000000.00000003.1708458496.0000000002D10000.00000004.00001000.00020000.00000000.sdmp, jyRdJ06Naz.exe, 00000000.00000003.1708853583.000000007F46B000.00000004.00001000.00020000.00000000.sdmp, jyRdJ06Naz.tmp, 00000001.00000000.1710643781.00000000002B1000.00000020.00000001.01000000.00000004.sdmp, jyRdJ06Naz.tmp.0.dr	false	high
https://discord.com/api/v9/users/	ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/example/Field1Response	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.ip.sb/ip	ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/sc	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	ttgtggt.exe, 00000006.00000002.2018682966.000000001288A000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012ADF000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012B38000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012831000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.00000000127D8000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.00000000128E3000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.000000001273E000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.github.com/	jyRdJ06Naz.exe, 00000000.00000003.1942074613.0000000002873000.00000004.00001000.00020000.00000000.sdmp, jyRdJ06Naz.tmp, 00000001.00000003.1936101669.0000000002843000.00000004.00001000.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	ttgtggt.exe, 00000006.00000002.2018682966.000000001288A000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012ADF000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012B38000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012831000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.00000000127D8000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.00000000128E3000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.000000001273E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.w3.oh	ttgtggt.exe, 00000006.00000002.2006656227.0000000002BE9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.github.com/.https://www.github.com/.https://www.github.com/	jyRdJ06Naz.exe, 00000000.00000003.1707261525.0000000002D10000.00000004.00001000.00020000.00000000.sdmp, jyRdJ06Naz.tmp, 00000001.00000003.1713318597.0000000003850000.00000004.00001000.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/08/addressing	ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/trust	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://ocsp.sectigo.com0	jyRdJ06Naz.tmp, 00000001.00000002.1939184757.0000000000AEC000.00000004.00000010.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/example/Field1	ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/soap/envelope/	ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/example/Field2	ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/example/Field3	ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	ttgtggt.exe, 00000006.00000002.2018682966.000000001288A000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012ADF000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012B38000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012831000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.00000000127D8000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.00000000128E3000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.000000001273E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	jyRdJ06Naz.tmp, 00000001.00000002.1939184757.0000000000AEC000.00000004.00000010.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/06/addressingex	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wscoor	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/08/addressing/fault	ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	ttgtggt.exe, 00000006.00000002.2018682966.000000001288A000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012ADF000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012B38000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.0000000012831000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.00000000127D8000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.00000000128E3000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2018682966.000000001273E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.w3.o	ttgtggt.exe, 00000006.00000002.2006656227.0000000002BE9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/example/Field3Response	ttgtggt.exe, 00000006.00000002.2006656227.0000000002875000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
https://sectigo.com/CPS0	jyRdJ06Naz.tmp, 00000001.00000002.1939184757.0000000000AEC000.00000004.00000010.00020000.00000000.sdmp	false	high
https://www.github.com/Q9	jyRdJ06Naz.tmp, 00000001.00000003.1936101669.0000000002843000.00000004.00001000.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	ttgtggt.exe, 00000006.00000002.2006656227.0000000002701000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT	ttgtggt.exe, 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
4.251.123.83	unknown	United States		3356	LEVEL3US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1554438
Start date and time:	2024-11-12 14:55:03 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	jyRdJ06Naz.exe renamed because original name is a hash value
Original Sample Name:	489c9c7de5953234600a72ebe8686633e2e0eceb79c408e772e83d561da4b814.exe
Detection:	MAL
Classification:	mal80.troj.spyw.evad.winEXE@5/11@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: jyRdJ06Naz.exe

Simulations

Behavior and APIs

Time	Type	Description
08:56:26	API Interceptor	19x Sleep call for process: ttgtggt.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
4.251.123.83	VJoillkb6X.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse
	9LrEuTWP8s.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse
	HAeAec7no3.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse
	EUFOvMxM2H.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse
	i4w1K6ft2F.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse
	xMYbN0Yd2a.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse
	FaZM14kDMN.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse
	j7movK82QT.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse
	Z4uyrnCQ8L.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse
	file.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LEVEL3US	VJoillkb6X.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse	4.251.123.83
	9LrEuTWP8s.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse	4.251.123.83
	HAeAec7no3.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse	4.251.123.83
	EUFOvMxM2H.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse	4.251.123.83
	i4w1K6ft2F.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse	4.251.123.83
	xMYbN0Yd2a.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse	4.251.123.83
	FaZM14kDMN.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse	4.251.123.83
	j7movK82QT.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse	4.251.123.83
	Z4uyrnCQ8L.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse	4.251.123.83
	botnet.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	65.90.191.211

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\is-OJBCC.tmp\_isetup\_setup64.tmp	Order PO#2024010080.exe	Get hash	malicious	Unknown	Browse
	Order PO#2024010080.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar, Zhark RAT	Browse
	SecuriteInfo.com.Win32.Application.Agent.NSIF6L.17895.28880.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.Application.Agent.NSIF6L.17895.28880.exe	Get hash	malicious	Unknown	Browse
	KC0uZWwr8p.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse
	KC0uZWwr8p.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse
	$RC8PW8J.exe	Get hash	malicious	Unknown	Browse
	https://raw.githubusercontent.com/EthanBrooks1955/2x4Q/main/OCPEC.exe	Get hash	malicious	Unknown	Browse
	gxjIKuKnu7.exe	Get hash	malicious	Socks5Systemz	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ttgtggt.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2611
Entropy (8bit):	5.363358188931451
Encrypted:	false
SSDEEP:	48:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhAHKKkafHKWA1eXrHKlT48BHK7HKmTHlHNW:iq+wmj0qCYqGSI6oPtzHeqKkGqhA7qZR
MD5:	CEA017D10C4D437981D19F21660A47FA
SHA1:	61AAFCECB5325DE172857CEF7C7E1F230F73AFFD
SHA-256:	60B099420455DECD1878FE84F217CFE478BA0BA5E6E574077150D08355A1DD96
SHA-512:	413384BF9D2EDC9BC2DF6D5175D09A33B91CCF9C53FE3CB21892CB57AF4FD8A9BE0608E9BCA57AF4A7F2709A4C110148719DA3210460DF433CFD77FA753B9CF8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Programs\My Program\Octo_Browser_latest_win.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	50972704
Entropy (8bit):	7.975657545907245
Encrypted:	false
SSDEEP:	1572864:WPf/ytnQGQWXGdgiGwhFGkOz2pttD7y0/RS:efqteW3m7xdDe0/
MD5:	568140EFDEA9501CAF6B5D3DC0125453
SHA1:	9B4074B9E60540EE1B328BEF934D9D2B6C4692F7
SHA-256:	61E89BFC707CCFC999131C30AEC69E050EFF59F1ACF316A85919B9080DF6A5D4
SHA-512:	114A9265E1BBC789AE2FDD47DF80326C3826382F5E9019952065D848CD53BCA27509F761EBB73D3D2A0544AA4A02813E311AF22CE555DA36A851790D794B25DE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}..&9..u9..u9..u-..t4..u-..t...u-..t8..uk..t*..uk..t...uk..t[..u-..t ..u-..t:..u-..t8..u9..u...ua..t...ua..u8..u9.zu8..ua..t8..uRich9..u................PE..L...v..a.........."......b...(......a.............@...........................%...........@..................................m..(........0..........p........0$.h...(...p...............................@...................8D..`....................text....a.......b.................. ..`.rdata...............f..............@..@.data....n.......V...d..............@....rsrc....0.......2..................@..@.reloc..h....0$.......#.............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\My Program\is-6IG1B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3311677
Entropy (8bit):	6.571428369605009
Encrypted:	false
SSDEEP:	49152:MdJYVM+9JtzZWnoS2VC23aun8+f5KuG2OY9IG9ivyv2cLx1RQL33308:uJYVM+LtVt3P/KuG2ONG9iqLRQL333n
MD5:	FFB61779AA03F1D68DA83DFAB4824B6A
SHA1:	C8F029F3DDC12CF3F0D307E3FA3E91C744532536
SHA-256:	E9E132299F1184D65A18D9079A9EF2EE363F529C7E3AD3376F3DA7DEC1D224BF
SHA-512:	85D91B5AE47EE0887D675ACE5CD6D970869F5C24014B8EBDB56F4B1F1F0CEE584FF41E68881E6CE142EB4738BFDAD35DB308C68C192D5087A9791AEBA32D7BC5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f....................d..................@...........................3...........@......@...................P,.n.....,.j:...P0. .....................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc... ....P0......./.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Local\Programs\My Program\is-8QRAK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	50972704
Entropy (8bit):	7.975657545907245
Encrypted:	false
SSDEEP:	1572864:WPf/ytnQGQWXGdgiGwhFGkOz2pttD7y0/RS:efqteW3m7xdDe0/
MD5:	568140EFDEA9501CAF6B5D3DC0125453
SHA1:	9B4074B9E60540EE1B328BEF934D9D2B6C4692F7
SHA-256:	61E89BFC707CCFC999131C30AEC69E050EFF59F1ACF316A85919B9080DF6A5D4
SHA-512:	114A9265E1BBC789AE2FDD47DF80326C3826382F5E9019952065D848CD53BCA27509F761EBB73D3D2A0544AA4A02813E311AF22CE555DA36A851790D794B25DE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}..&9..u9..u9..u-..t4..u-..t...u-..t8..uk..t*..uk..t...uk..t[..u-..t ..u-..t:..u-..t8..u9..u...ua..t...ua..u8..u9.zu8..ua..t8..uRich9..u................PE..L...v..a.........."......b...(......a.............@...........................%...........@..................................m..(........0..........p........0$.h...(...p...............................@...................8D..`....................text....a.......b.................. ..`.rdata...............f..............@..@.data....n.......V...d..............@....rsrc....0.......2..................@..@.reloc..h....0$.......#.............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\My Program\is-E8O0B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	346112
Entropy (8bit):	6.572244662396641
Encrypted:	false
SSDEEP:	6144:2DKXJVqDD/qxgATuaBNt1BrivR0V4TBjgYxs1wl206gBawFV2ceSb0BQ/GfM/4Qx:2DgYDzqxdXBNt1BrivR0V4TBjgYxs1wQ
MD5:	C9B68B9567CC9067794E32999C02BFA7
SHA1:	D999F0701086E1ECC87380CF002F37F985C6DE4C
SHA-256:	8DBCECF4F09CDB10EF4F2AC2AC3F66A28D148A63A381877F413CD5F5B39DB4E0
SHA-512:	9E24E7FAB933FBD5AD500B0759582D3417CCD571C248010BE486C53574F21E38A5D10DD2B14128CC4D4B4D922DC25806A14D46793B9E2FFE951B8C797F458C6A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\AppData\Local\Programs\My Program\is-E8O0B.tmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Programs\My Program\is-E8O0B.tmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Programs\My Program\is-E8O0B.tmp, Author: Joe Security Rule: MALWARE_Win_zgRAT, Description: Detects zgRAT, Source: C:\Users\user\AppData\Local\Programs\My Program\is-E8O0B.tmp, Author: ditekSHen
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 66%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc...............F..............@..B........................H........K........../.......)............................................(O...(......{......{.....~....(....~....(.....(......}......}.....0..<........u......,0(.....{.....{....o....,.(.....{.....{....o....+... ..L0(.....{....o....X )UU.Z(.....{....o....X..0...........r...p......%..{.....................-.q.............-.&.+.......o.....%..{.....................-.q.............-.&.+.......o.....(......{......{.....~....(....~....(.....(......}......}....*...0..<...

C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	346112
Entropy (8bit):	6.572244662396641
Encrypted:	false
SSDEEP:	6144:2DKXJVqDD/qxgATuaBNt1BrivR0V4TBjgYxs1wl206gBawFV2ceSb0BQ/GfM/4Qx:2DgYDzqxdXBNt1BrivR0V4TBjgYxs1wQ
MD5:	C9B68B9567CC9067794E32999C02BFA7
SHA1:	D999F0701086E1ECC87380CF002F37F985C6DE4C
SHA-256:	8DBCECF4F09CDB10EF4F2AC2AC3F66A28D148A63A381877F413CD5F5B39DB4E0
SHA-512:	9E24E7FAB933FBD5AD500B0759582D3417CCD571C248010BE486C53574F21E38A5D10DD2B14128CC4D4B4D922DC25806A14D46793B9E2FFE951B8C797F458C6A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 66%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc...............F..............@..B........................H........K........../.......)............................................(O...(......{......{.....~....(....~....(.....(......}......}.....0..<........u......,0(.....{.....{....o....,.(.....{.....{....o....+... ..L0(.....{....o....X )UU.Z(.....{....o....X..0...........r...p......%..{.....................-.q.............-.&.+.......o.....%..{.....................-.q.............-.&.+.......o.....(......{......{.....~....(....~....(.....(......}......}....*...0..<...

C:\Users\user\AppData\Local\Programs\My Program\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp
File Type:	InnoSetup Log My Program {873AD2E0-A2B0-482E-8E07-2D2EF1B74924}, version 0x418, 2208 bytes, 580913\37\user\376, C:\Users\user\AppData\Local\Programs\My P
Category:	dropped
Size (bytes):	2208
Entropy (8bit):	3.4837352046569734
Encrypted:	false
SSDEEP:	48:8H9GQj9GQniCy1O9GQlU9GQN9GQqz6iCyQfiCyQMHxvKxPxeUhe:LC08zvCUCeHAtHhe
MD5:	4C874CEB6A2B370E9DA5800391177B74
SHA1:	98D6F41C95C54DF53080A6B2752D29F09AAE46B3
SHA-256:	A27859793875C05684F645D3EAEA23BC830C5F0B3A2EBDC438317C2EB424D99C
SHA-512:	8F2634A232D300E5B7334972BBF61DCDC5D778684110D8C4B8B1FB7B6C0499B2C381D8C9E1DFC6E6D37031D8C22ABABD7B93B76B063331DB2A968D4F0D9657BA
Malicious:	false
Reputation:	low
Preview:	Inno Setup Uninstall Log (b)....................................{873AD2E0-A2B0-482E-8E07-2D2EF1B74924}..........................................................................................My Program..................................................................................................................................%................................................................................................................%.>....+...(.qk...............5.8.0.9.1.3......j.o.n.e.s......C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.M.y. .P.r.o.g.r.a.m................8...... .....@..................C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.M.y. .P.r.o.g.r.a.m..d...C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.S.t.a.r.t. .M.e.n.u.\.P.r.o.g.r.a.m.s.\.(.D.e.f.a.u.l.t.)......(.D.e.f.a.u.l.t.)......e.n.g.l.i.s.h.............................f........C.:.\.U.s.e.r.

C:\Users\user\AppData\Local\Programs\My Program\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3311677
Entropy (8bit):	6.571428369605009
Encrypted:	false
SSDEEP:	49152:MdJYVM+9JtzZWnoS2VC23aun8+f5KuG2OY9IG9ivyv2cLx1RQL33308:uJYVM+LtVt3P/KuG2ONG9iqLRQL333n
MD5:	FFB61779AA03F1D68DA83DFAB4824B6A
SHA1:	C8F029F3DDC12CF3F0D307E3FA3E91C744532536
SHA-256:	E9E132299F1184D65A18D9079A9EF2EE363F529C7E3AD3376F3DA7DEC1D224BF
SHA-512:	85D91B5AE47EE0887D675ACE5CD6D970869F5C24014B8EBDB56F4B1F1F0CEE584FF41E68881E6CE142EB4738BFDAD35DB308C68C192D5087A9791AEBA32D7BC5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f....................d..................@...........................3...........@......@...................P,.n.....,.j:...P0. .....................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc... ....P0......./.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Local\Temp\is-OJBCC.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Order PO#2024010080.exe, Detection: malicious, Browse Filename: Order PO#2024010080.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Application.Agent.NSIF6L.17895.28880.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Application.Agent.NSIF6L.17895.28880.exe, Detection: malicious, Browse Filename: KC0uZWwr8p.exe, Detection: malicious, Browse Filename: KC0uZWwr8p.exe, Detection: malicious, Browse Filename: $RC8PW8J.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: gxjIKuKnu7.exe, Detection: malicious, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp

Download File

Process:	C:\Users\user\Desktop\jyRdJ06Naz.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3287552
Entropy (8bit):	6.584850392937076
Encrypted:	false
SSDEEP:	49152:0dJYVM+9JtzZWnoS2VC23aun8+f5KuG2OY9IG9ivyv2cLx1RQL3330n:WJYVM+LtVt3P/KuG2ONG9iqLRQL333u
MD5:	6F170135AEC26A106334B8FEF0F3AB5A
SHA1:	5A83B20CEBFF633D7223D140ECD2F704B976EBF9
SHA-256:	CCB3E5E44557337A34C89CF7B16B49229A3B2674220D387950E1C1A3705161B6
SHA-512:	C72D97A10CFF05498CD9D16EF6F53054A22A45D6ED0430D5CF87C77FAFEA8A9A1DB0F2DACD06CD97F4996DD9AD2D6417948069D29D4F47E056422BDC79C1E684
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f....................d..................@...........................3...........@......@...................P,.n.....,.j:...P0. .....................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc... ....P0......./.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\My Program.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Tue Nov 12 12:56:07 2024, mtime=Tue Nov 12 12:56:07 2024, atime=Sun Nov 10 04:07:02 2024, length=346112, window=hide
Category:	dropped
Size (bytes):	1279
Entropy (8bit):	4.814718568181584
Encrypted:	false
SSDEEP:	24:8mxHIdhR2+bO0w+xek0Sm88ANfWpGQz9GQHMfqyFm:8mxHITR2+bO0petI9uGQz9GQnyF
MD5:	1862F1CD7D6C6EB86F7F455882D3DE74
SHA1:	2E68852D48FB57E46F328253308F5D82538B58BC
SHA-256:	392CA6F86212E0D3C31A965F816235A6DB35D4C6C7BE136512B090D5935A4F70
SHA-512:	60DB2E9504E21870CF1984E99FA9EAAC93BDD76316C06B47ABBEB096ABA120475D47B815FCBEDC1B4231F5C8DDD41C01047712896436A00432D613E9BBD42B2F
Malicious:	false
Preview:	L..................F.... ........5...b...5..._.`.3...H......................(.:..DG..Yr?.D..U..k0.&...&......vk.v......[..5....I..5......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^lY.n...........................%..A.p.p.D.a.t.a...B.P.1.....lY.o..Local.<......CW.^lY.o....b......................o^.L.o.c.a.l.....Z.1.....lY.o..Programs..B......lY.olY.o....;......................o^.P.r.o.g.r.a.m.s.....^.1.....lY.o..MYPROG~1..F......lY.olY.o...........................T..M.y. .P.r.o.g.r.a.m.....b.2..H..jY.( .ttgtggt.exe.H......lY.olY.o..............................t.t.g.t.g.g.t...e.x.e.......k...............-.......j...........=..g.....C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe..4.....\.....\.....\.....\.....\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.M.y. .P.r.o.g.r.a.m.\.t.t.g.t.g.g.t...e.x.e.0.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.M.y. .P.r.o.g.r.a.m.........\|....I.J.H..K..:...`.......X.......580913.........

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9985671904914115
TrID:	Win32 Executable (generic) a (10002005/4) 98.45% Inno Setup installer (109748/4) 1.08% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	jyRdJ06Naz.exe
File size:	49'460'692 bytes
MD5:	c83b55a55faf5ff57dcfb50c4344521a
SHA1:	efa22ba249f339111962fe109b256b215358c8b1
SHA256:	489c9c7de5953234600a72ebe8686633e2e0eceb79c408e772e83d561da4b814
SHA512:	e4187182b1f50fccc1230e24a0ff650b22626e9ef20e3d3c54c147736b4da2c1e3c650c0dbfa6343e0fb7b18972f97356228ab7a28965e19147c151b7966b8a3
SSDEEP:	786432:n+uDmhiEVVJYMbNrxPLmkGpegNGXA+Ih1ZMGH5j+xjWa3fQ1wb9UrS:nFKhhVl9oOgYAn159+NHPR+S
TLSH:	D1B73323B3CB943DE06E473F1A61715454F7A620B827BE2699F4846CCF564A10E7FA23
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	0f0575e0c8713133

Static PE Info

General

Entrypoint:	0x4a83bc
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6690DABD [Fri Jul 12 07:26:53 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	40ab50289f7ef5fae60801f88d4541fc

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFA4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-3Ch], eax
mov dword ptr [ebp-40h], eax
mov dword ptr [ebp-5Ch], eax
mov dword ptr [ebp-30h], eax
mov dword ptr [ebp-38h], eax
mov dword ptr [ebp-34h], eax
mov dword ptr [ebp-2Ch], eax
mov dword ptr [ebp-28h], eax
mov dword ptr [ebp-14h], eax
mov eax, 004A2EBCh
call 00007FB75905C975h
xor eax, eax
push ebp
push 004A8AC1h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 004A8A7Bh
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [004B0634h]
call 00007FB7590EE2FBh
call 00007FB7590EDE4Eh
lea edx, dword ptr [ebp-14h]
xor eax, eax
call 00007FB7590E8B28h
mov edx, dword ptr [ebp-14h]
mov eax, 004B41F4h
call 00007FB759056A23h
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [004B41F4h]
mov dl, 01h
mov eax, dword ptr [0049CD14h]
call 00007FB7590E9E53h
mov dword ptr [004B41F8h], eax
xor edx, edx
push ebp
push 004A8A27h
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007FB7590EE383h
mov dword ptr [004B4200h], eax
mov eax, dword ptr [004B4200h]
cmp dword ptr [eax+0Ch], 01h
jne 00007FB7590F506Ah
mov eax, dword ptr [004B4200h]
mov edx, 00000028h
call 00007FB7590EA748h
mov edx, dword ptr [004B4200h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xb7000	0x71	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb5000	0xfec	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xcb000	0x5184	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xba000	0x10fa8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xb9000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xb52d4	0x25c	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xb6000	0x1a4	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xa568c	0xa5800	b889d302f6fc48a904de33d8d947ae80	False	0.3620185045317221	data	6.377190161826806	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0xa7000	0x1b64	0x1c00	588dd0a8ab499300d3701cbd11b017d9	False	0.548828125	data	6.109264411030635	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xa9000	0x3838	0x3a00	5c0c76e77aef52ebc6702430837ccb6e	False	0.35338092672413796	data	4.95916338709992	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xad000	0x7258	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xb5000	0xfec	0x1000	627340dff539ef99048969aa4824fb2d	False	0.380615234375	data	5.020404933181373	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0xb6000	0x1a4	0x200	fd11c1109737963cc6cb7258063abfd6	False	0.34765625	data	2.729290535217263	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0xb7000	0x71	0x200	7de8ca0c7a61668a728fd3a88dc0942d	False	0.1796875	data	1.305578535725827	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0xb8000	0x18	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xb9000	0x5d	0x200	d84006640084dc9f74a07c2ff9c7d656	False	0.189453125	data	1.3892750148744617	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xba000	0x10fa8	0x11000	a85fda2741bd9417695daa5fc5a9d7a5	False	0.5789579503676471	data	6.709466460182023	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0xcb000	0x5184	0x5200	5387b5990969ed6ef136c9bcfb958efc	False	0.5677877286585366	data	5.999416150640438	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xcb438	0x1c30	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.0015243902439024
RT_STRING	0xcd068	0x3f8	data			0.3198818897637795
RT_STRING	0xcd460	0x2dc	data			0.36475409836065575
RT_STRING	0xcd73c	0x430	data			0.40578358208955223
RT_STRING	0xcdb6c	0x44c	data			0.38636363636363635
RT_STRING	0xcdfb8	0x2d4	data			0.39226519337016574
RT_STRING	0xce28c	0xb8	data			0.6467391304347826
RT_STRING	0xce344	0x9c	data			0.6410256410256411
RT_STRING	0xce3e0	0x374	data			0.4230769230769231
RT_STRING	0xce754	0x398	data			0.3358695652173913
RT_STRING	0xceaec	0x368	data			0.3795871559633027
RT_STRING	0xcee54	0x2a4	data			0.4275147928994083
RT_RCDATA	0xcf0f8	0x10	data			1.5
RT_RCDATA	0xcf108	0x310	data			0.6173469387755102
RT_RCDATA	0xcf418	0x2c	data			1.1590909090909092
RT_GROUP_ICON	0xcf444	0x14	data	English	United States	1.2
RT_VERSION	0xcf458	0x584	data	English	United States	0.2577903682719547
RT_MANIFEST	0xcf9dc	0x7a8	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3377551020408163

Imports

DLL	Import
kernel32.dll	GetACP, GetExitCodeProcess, CloseHandle, LocalFree, SizeofResource, VirtualProtect, QueryPerformanceFrequency, VirtualFree, GetFullPathNameW, GetProcessHeap, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVolumeInformationW, GetVersion, GetDriveTypeW, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetCommandLineW, GetSystemInfo, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, LCMapStringW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
comctl32.dll	InitCommonControls
user32.dll	CreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
oleaut32.dll	SysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
advapi32.dll	ConvertStringSecurityDescriptorToSecurityDescriptorW, OpenThreadToken, AdjustTokenPrivileges, LookupPrivilegeValueW, RegOpenKeyExW, OpenProcessToken, FreeSid, AllocateAndInitializeSid, EqualSid, RegQueryValueExW, GetTokenInformation, ConvertSidToStringSidW, RegCloseKey

Exports

Name	Ordinal	Address
__dbk_fcall_wrapper	2	0x40fc10
dbkFCallWrapperAddr	1	0x4b063c

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-12T14:56:17.147993+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	172.202.163.200	443	192.168.2.4	49730	TCP
2024-11-12T14:56:24.617611+0100	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	1	192.168.2.4	49736	4.251.123.83	6677	TCP
2024-11-12T14:56:25.138239+0100	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	4.251.123.83	6677	192.168.2.4	49736	TCP
2024-11-12T14:56:56.284212+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	172.202.163.200	443	192.168.2.4	49743	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 12, 2024 14:56:23.750904083 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:23.756189108 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:23.756454945 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:23.758364916 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:23.763330936 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:24.600723982 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:24.617610931 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:24.622750998 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:24.882369995 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:24.892250061 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:24.897186041 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:25.138079882 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:25.138096094 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:25.138111115 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:25.138129950 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:25.138140917 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:25.138154030 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:25.138154984 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:25.138225079 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:25.138238907 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:25.138250113 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:25.138261080 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:25.138273001 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:25.138284922 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:25.138293982 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:25.138317108 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:25.138638020 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:25.143171072 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:25.143233061 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:25.143249989 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:25.143284082 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:25.257930994 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:25.257946968 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:25.257966042 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:25.257977962 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:25.257988930 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:25.258001089 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:25.258065939 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:25.258403063 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:25.310770035 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.539526939 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.547005892 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.547070026 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.547238111 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.547249079 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.547264099 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.547274113 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.547282934 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.547291994 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.547303915 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.547307014 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.547327995 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.547324896 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.547344923 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.547380924 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.547410011 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.553138971 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.553149939 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.553158998 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.553169012 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.553179026 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.553195953 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.553205013 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.553208113 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.553215027 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.553232908 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.553239107 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.553242922 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.553267956 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.553303957 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.553323984 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.553353071 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.553423882 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.558171034 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.558197975 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.558245897 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.558299065 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.558764935 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.558774948 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.558784008 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.558882952 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.558892965 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.558903933 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.558976889 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.558986902 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.559000015 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.559055090 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.559144974 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.559171915 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.559191942 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.559220076 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.563306093 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.563333035 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.563369036 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.563389063 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.563397884 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.563416004 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.563452005 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.563463926 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.563488960 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.563499928 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.563544035 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.563563108 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.563647985 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.563777924 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.563827991 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.564552069 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.564613104 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.564680099 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.564773083 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.564811945 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.564861059 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.564994097 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.565004110 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.565054893 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.565083981 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.565113068 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.565135956 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.565162897 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.565201998 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.565212011 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.565233946 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.565243959 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.565252066 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.565319061 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.565386057 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.565447092 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.565455914 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.565521955 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.565531015 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.565540075 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.565550089 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.565581083 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.565821886 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.565831900 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.565908909 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.565918922 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.565927982 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.565937042 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.565946102 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.566018105 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.566028118 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.566063881 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.566102028 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.566251040 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.566261053 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.566272020 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.566343069 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.566354036 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.566363096 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.566370010 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.566374063 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.566395044 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.566417933 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.566494942 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.566546917 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.566556931 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.566694021 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.566703081 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.566706896 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.566715956 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.566725969 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.566803932 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.566818953 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.568519115 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.568527937 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.568567038 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.568577051 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.568628073 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.568638086 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.568669081 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.568732023 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.568742037 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.568758965 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.568768024 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.568877935 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.568888903 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.568897009 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.568912983 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.568922997 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.569561005 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.569570065 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.569581032 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.569627047 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.569863081 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.569879055 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.569936037 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.570019007 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.570028067 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.570044994 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.570055962 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.570065022 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.570164919 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.570174932 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.570225000 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.570234060 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.570249081 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.570499897 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.570570946 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.571252108 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.571263075 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.571280956 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.571290970 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.571372032 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.571381092 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.571389914 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.571399927 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.571528912 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.571605921 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.571624041 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.571652889 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.571662903 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.571679115 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.571690083 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.571777105 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.571787119 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.571834087 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.571842909 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.571852922 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.571913958 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.571923971 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.571932077 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.572048903 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.572144985 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.572154999 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.572206020 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.572247982 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.572264910 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.572273970 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.572283030 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.572338104 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.572348118 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.572355986 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.572365999 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.572384119 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.572393894 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.572403908 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.572443962 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.572453022 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.572462082 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.572504044 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.572514057 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.572546959 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.572557926 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.572561979 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.572566986 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.572582960 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.572592020 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.572608948 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.572618008 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.572654009 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.572690010 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.572700024 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.572922945 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.573012114 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.575412035 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.575423002 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.575464010 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.575479031 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.575928926 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.575952053 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.575965881 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.575974941 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.575984955 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.575993061 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.576003075 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.576013088 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.576030970 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.576040030 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.576049089 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.576060057 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.576069117 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.576081038 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.576090097 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.618463993 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.618722916 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.618798971 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.618798971 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.618849039 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.666119099 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.666461945 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.666523933 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.666523933 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.666569948 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.690574884 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.690871000 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.691041946 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.691041946 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.691123009 CET	49736	6677	192.168.2.4	4.251.123.83
Nov 12, 2024 14:56:28.696078062 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.696089029 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.696098089 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.696106911 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.696213961 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.696388006 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.696472883 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.696496010 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.696506023 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.696557999 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.696567059 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.696703911 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:28.738173962 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:29.426928043 CET	6677	49736	4.251.123.83	192.168.2.4
Nov 12, 2024 14:56:29.438647985 CET	49736	6677	192.168.2.4	4.251.123.83

Target ID:	0
Start time:	08:55:58
Start date:	12/11/2024
Path:	C:\Users\user\Desktop\jyRdJ06Naz.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\jyRdJ06Naz.exe"
Imagebase:	0xd0000
File size:	49'460'692 bytes
MD5 hash:	C83B55A55FAF5FF57DCFB50C4344521A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:55:58
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp" /SL5="$2042A,48507756,797184,C:\Users\user\Desktop\jyRdJ06Naz.exe"
Imagebase:	0x2b0000
File size:	3'287'552 bytes
MD5 hash:	6F170135AEC26A106334B8FEF0F3AB5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:56:20
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe"
Imagebase:	0x3f0000
File size:	346'112 bytes
MD5 hash:	C9B68B9567CC9067794E32999C02BFA7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000006.00000000.1930311568.00000000003F2000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000006.00000000.1930311568.00000000003F2000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000006.00000002.2006656227.0000000002794000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.2006656227.00000000027AD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	16.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9BAE4A99 Relevance: 4.2, Strings: 1, Instructions: 2909
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

U, xrefs: 00007FFD9BAE4AAA

Memory Dump Source

Source File: 00000006.00000002.2036686566.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bad0000_ttgtggt.jbxd

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: d7cdfcb8bcc37a475850780d422f0e3db103d625102d7b65060c11e1a3a8b01d
Instruction ID: 594a42c57a6e93510d5002f29ef0391da55baf9cc5c62611f5b9be99c508fcee
Opcode Fuzzy Hash: d7cdfcb8bcc37a475850780d422f0e3db103d625102d7b65060c11e1a3a8b01d
Instruction Fuzzy Hash: B1438B70A1996D8FDFA8DF18C895BA9B7B1FB68301F5041EA900DE3291DE756E81CF40

Function 00007FFD9B989D02 Relevance: 3.0, Instructions: 3013
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2034259929.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b980000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ba1a5376296d153b86ca4e791af0ec09abb54a0f75d4c78f0a011e5321e7c3
Instruction ID: c06a3349a83e611ec1fc9153ac48a3ec2b2e03c2c2dcd24c47b863c6ef6143ec
Opcode Fuzzy Hash: d8ba1a5376296d153b86ca4e791af0ec09abb54a0f75d4c78f0a011e5321e7c3
Instruction Fuzzy Hash: 8913A431B1EE8D4FD7A9EB2C8464A2877E1FF99710B0545BEE09EC72A3DD24AC418741

Function 00007FFD9B9816B3 Relevance: 1.0, Instructions: 995
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2034259929.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b980000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7716a99af5c253de07ad48974dd5064a80aed52d7689edffc456ee4f99fb06c
Instruction ID: a921624a313a9c628d0c894b28abcf5d849623368fb077d8fd180fd15bb0313c
Opcode Fuzzy Hash: b7716a99af5c253de07ad48974dd5064a80aed52d7689edffc456ee4f99fb06c
Instruction Fuzzy Hash: E7520530B1DE595FEBA8D76C9469A7537D1EF9A310B0502BAD04EC72F7DE24AC428381

Function 00007FFD9BAD05B1 Relevance: .9, Instructions: 857
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2036686566.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bad0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6afa4d2087bbc85e751f659a92054f7b273e5a988b57cd3e15d491890cfc02f5
Instruction ID: 6ea861ad3d2f098d062fecdfb2c0a25938ab0a7c2a78efdc149eb43174e3ba37
Opcode Fuzzy Hash: 6afa4d2087bbc85e751f659a92054f7b273e5a988b57cd3e15d491890cfc02f5
Instruction Fuzzy Hash: 1C72DC70E1996D8FDBA4EB58C8A5BA8B7B1FF58300F5141E9D00DE32A5DA746E81CF40

Function 00007FFD9BAE2AD0 Relevance: .8, Instructions: 823
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2036686566.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bad0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc5b66c51c649600ace9dcaaa9f218cc57d7a4ecc17c92ae193fcead22388ed9
Instruction ID: 8c030fca9aa8a08c507c8e6425dbb70b9b2a5370d59a24bb18e2ef5e0396c0d5
Opcode Fuzzy Hash: fc5b66c51c649600ace9dcaaa9f218cc57d7a4ecc17c92ae193fcead22388ed9
Instruction Fuzzy Hash: E4322521F1D60E4BE7799AAC947927973C1FF85318F16017EE4CEC32E6DE29A9428241

Function 00007FFD9BAE2B30 Relevance: .8, Instructions: 814
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2036686566.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bad0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe05b6b25a1812896801ccfd19edc373af93f3498994a011ff387b11820c5360
Instruction ID: c41c1e568b635d6fe219f46f8475e25cea1c6f3a41fbec413679f2756c83f219
Opcode Fuzzy Hash: fe05b6b25a1812896801ccfd19edc373af93f3498994a011ff387b11820c5360
Instruction Fuzzy Hash: AE32C531B1DA0D4FEBA8EB6C98656B877D1FF98314F0501BAE48DC32E6DD24AD428741

Function 00007FFD9B98C50A Relevance: .8, Instructions: 765COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2034259929.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b980000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08eaff0bf74c59a875975d2294feb2fef778c02361a027892a6ce248ddd8ea35
Instruction ID: 1813dca8816ccc8901ad4191bf099362fa808ef8e5d90a8465e9c10228bf61de
Opcode Fuzzy Hash: 08eaff0bf74c59a875975d2294feb2fef778c02361a027892a6ce248ddd8ea35
Instruction Fuzzy Hash: E822C371B2EE495FEBA8EB2C846566877E1FF55700B0601BEE44EC72B3DD24AC418341

Function 00007FFD9BAE5A2C Relevance: .7, Instructions: 691COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2036686566.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bad0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1f37aab9530ecf8a33ded7b5fc70286f883eca0b78f5cca710d8f93fa844576
Instruction ID: ea5f36292861f4e5c02da5c8008a43463dec840aee94e3e248632c5e65f47295
Opcode Fuzzy Hash: b1f37aab9530ecf8a33ded7b5fc70286f883eca0b78f5cca710d8f93fa844576
Instruction Fuzzy Hash: B852CD70A1992D8FDFA8DB58C8A4BA9B7B1FB58305F1041EA900DE3291DF756E81CF40

Function 00007FFD9BAE2AB0 Relevance: .5, Instructions: 532COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2036686566.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bad0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96def45affaa3e97104dba060e92ad3d99a62c4d37f9b6554ec36b1683667c38
Instruction ID: 694682819a1d28ef96e6d4de578f6b750dda59a403ea5a08f6137a1cdff05c7e
Opcode Fuzzy Hash: 96def45affaa3e97104dba060e92ad3d99a62c4d37f9b6554ec36b1683667c38
Instruction Fuzzy Hash: D5F13321F0DA5E4BE7799BA8846527A77C1EF85310F56017DE48EC31F2EFACA9428341

Function 00007FFD9BAE1AC7 Relevance: .5, Instructions: 490COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2036686566.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bad0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0cdd009866833bdfa906665e281ba2d49e57dc4b3279949d89a5cc5b4990c5e
Instruction ID: 501d1be99f826f690ee4abcd939684e0a0eafd3cdeff1a14728da33eb33a2d6c
Opcode Fuzzy Hash: a0cdd009866833bdfa906665e281ba2d49e57dc4b3279949d89a5cc5b4990c5e
Instruction Fuzzy Hash: 6C12AC70E1592D8FDBA8DB58C899BA9B7B1FB68301F5041EAD00DE3295DE746E81CF40

Function 00007FFD9BAE5491 Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2036686566.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bad0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd1f8596cda2603d4599507080bb95def9ab36e211d3e0f781d72be4dd37632d
Instruction ID: b88a7e530c6008a0cb60122495f2de5c0bf19f427baaad4f5f16a7709c423c35
Opcode Fuzzy Hash: bd1f8596cda2603d4599507080bb95def9ab36e211d3e0f781d72be4dd37632d
Instruction Fuzzy Hash: FDF1AB74A1592D8FDFA8DF18C895BA9B7B1FB68305F1041EA810DE3291DB716E81CF44

Function 00007FFD9B98D439 Relevance: 2.1, Strings: 1, Instructions: 867
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00007FFD9B98DAE2

Memory Dump Source

Source File: 00000006.00000002.2034259929.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b980000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 6017d42c95a0ad231432e880bf5117937352ffdb1f384cd020c219cb047d07c6
Instruction ID: 5f5171743f2879bb35fa66f42488b267c6adf3ed414a8c2902b8c1e54c558ed5
Opcode Fuzzy Hash: 6017d42c95a0ad231432e880bf5117937352ffdb1f384cd020c219cb047d07c6
Instruction Fuzzy Hash: 3A42F431B1EB891FE7A5EB6C98659287BE1EF56310B0A01FEE09DC71F3D924AC458341

Function 00007FFD9BAD8A5A Relevance: 1.7, APIs: 1, Instructions: 245
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00007FFD9BAD8C0F

Memory Dump Source

Source File: 00000006.00000002.2036686566.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bad0000_ttgtggt.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 643959bee2360c800f3879ff67e546a5cd6b431dc58d30f7b0c2740dc984aac4
Instruction ID: c4ec97c5dfb74a5433ec18306f9d7e020267def1a2d9ce3dc3d4c25b3698ba82
Opcode Fuzzy Hash: 643959bee2360c800f3879ff67e546a5cd6b431dc58d30f7b0c2740dc984aac4
Instruction Fuzzy Hash: 8E71C470A18A4C8FEB68EF2CD8567E977D1FB58310F14426AE84DC7251DB74E9418BC2

Function 00007FFD9BAD9551 Relevance: 1.7, APIs: 1, Instructions: 169
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE ref: 00007FFD9BAD965A

Memory Dump Source

Source File: 00000006.00000002.2036686566.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bad0000_ttgtggt.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 9261f44f992a676d6623adc87d5ae31cadb8fbb26d5638c5ba64a79d7eca966b
Instruction ID: a078294e3fb5498d4711d20ae298ce6f8d38de47ba5ee6b998f9c383a96c2222
Opcode Fuzzy Hash: 9261f44f992a676d6623adc87d5ae31cadb8fbb26d5638c5ba64a79d7eca966b
Instruction Fuzzy Hash: 9F41A131E08B1C8FDB58EF5898596EDBBE1FB99310F00426AD00DD7256CA74A945CBC2

Function 00007FFD9B98BDAC Relevance: 1.5, Strings: 1, Instructions: 287
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

~>_H, xrefs: 00007FFD9B98BE64

Memory Dump Source

Source File: 00000006.00000002.2034259929.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b980000_ttgtggt.jbxd

Similarity

API ID:
String ID: ~>_H
API String ID: 0-3245688848
Opcode ID: 43af228a1f3a3dc0ad3a0278ac60882259f67fcbc066e79203653ceafd6344b5
Instruction ID: b298d2e7341b7b9bf68d380c522aa6fdf8a4774ad4e52aad903a1b7081c9eb03
Opcode Fuzzy Hash: 43af228a1f3a3dc0ad3a0278ac60882259f67fcbc066e79203653ceafd6344b5
Instruction Fuzzy Hash: 0171177171DF4C4FDB98DB1C9465A657BE2EF99310B1901AEE48AC72B3DE21EC028781

Function 00007FFD9B8B3299 Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2032564007.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8b0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0d5988ab3e897ffbe46f50bc61fe7ee44174f5a38d8619964809d97329040b2
Instruction ID: 734e8365951b3ce92bbf9738738a8c6a8d93270ff21bc79707a951803ebefc26
Opcode Fuzzy Hash: e0d5988ab3e897ffbe46f50bc61fe7ee44174f5a38d8619964809d97329040b2
Instruction Fuzzy Hash: 41C14F71E0956D8FEBA8DB68C865BA8B7B1FF58300F5041BAD00DD3296DE346985CF40

Function 00007FFD9B8B0F4F Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2032564007.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8b0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 133559054d3f1399e1231d909f427055cd168fc8565e4f42b2bb151edebd8f93
Instruction ID: ad389dd2fc02da2181abb3c45d8253efb1ebdcf40e32b356836ec474e72754ea
Opcode Fuzzy Hash: 133559054d3f1399e1231d909f427055cd168fc8565e4f42b2bb151edebd8f93
Instruction Fuzzy Hash: C7D16574A05A2C8FDBA4EB18C898BA8B7F5FF59301F1541E9910DE7265DB70AE81CF40

Function 00007FFD9B8B0DF5 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2032564007.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8b0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e18d3eed694ca5b00eea672e83e32661af25934ddd1d89bf20436f2d96bb67f8
Instruction ID: 23f060fc35c73ec42d81e84f8a8dbdb6442d348ad958f05d2366524c57fa020f
Opcode Fuzzy Hash: e18d3eed694ca5b00eea672e83e32661af25934ddd1d89bf20436f2d96bb67f8
Instruction Fuzzy Hash: 8CC1A870A15A2D8FDBA8DB58C894BA9B7B5FF59300F1141E9D00DE72A5DB34AE81CF40

Function 00007FFD9B98BFFD Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2034259929.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b980000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2224d84cf5252be41689225d0c5ef779c8f4f00e449c12b07a37264b79162c2
Instruction ID: 5c33d85182074336e0bd96715f3e060e7bf1a277353e0045358b673ef602d1e7
Opcode Fuzzy Hash: d2224d84cf5252be41689225d0c5ef779c8f4f00e449c12b07a37264b79162c2
Instruction Fuzzy Hash: C2910321B1EBC91FE7669B6C88A55247BE1EF66310B0A41FFD089CB1F3D928AC45C351

Function 00007FFD9B8B1EDE Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2032564007.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8b0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54be58151ccb0162d731f65e5d181ebf1ae8ccf36794d658def65686778b264a
Instruction ID: 200cee728798cd9525ac5deb389ca80cc1573bd8824122fcaedf66da0579a240
Opcode Fuzzy Hash: 54be58151ccb0162d731f65e5d181ebf1ae8ccf36794d658def65686778b264a
Instruction Fuzzy Hash: 38B11F70A1962D8FDBA9EB58C8A5BA877B5FF59300F1001E9D40DD72A1CB34AE85CF40

Function 00007FFD9B9822EB Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2034259929.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b980000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4382fa235ad51fdca49b1de3a083111941a601f3b3901d7e378ba6a67e0f590a
Instruction ID: 0a98be7338dc4263607258d0e5cb15f962b42406b2cd9a0e10d48a3c3593f466
Opcode Fuzzy Hash: 4382fa235ad51fdca49b1de3a083111941a601f3b3901d7e378ba6a67e0f590a
Instruction Fuzzy Hash: F081F420B1DA490FE769D7AC9465A743BD1EF9A720B1501BBD08EC72F7DD28AD428381

Function 00007FFD9B98D1F9 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2034259929.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b980000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49c57e0d5fc57db58c3284c0ed09dcac1ef31e07ceed0a9c7e7f079a4b20c2b7
Instruction ID: 1207e5f36ecdc76d2938f54263e7f8bf85e0dc03cc20b189f232baef0d7c306a
Opcode Fuzzy Hash: 49c57e0d5fc57db58c3284c0ed09dcac1ef31e07ceed0a9c7e7f079a4b20c2b7
Instruction Fuzzy Hash: 9171D83171DE484FE799DB2C98659643BE2EF9A31070A02EFE48DC72B3DD24AC028741

Function 00007FFD9B8B2FF0 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2032564007.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8b0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07b546ad1d91cbc610e7514dd03aa48186b0632a8417a899e1dba18e0c3359d5
Instruction ID: eeb0d0098e3836fe3aec27249b9cd5feebd21a26e1dbc9d01657e5489cc0ff0c
Opcode Fuzzy Hash: 07b546ad1d91cbc610e7514dd03aa48186b0632a8417a899e1dba18e0c3359d5
Instruction Fuzzy Hash: FC91D471B0DA5D4FDB58CB6C88686AD7BE2FF9D350F05027EE04DE32A2DA2459018B81

Function 00007FFD9B8B15A8 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2032564007.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8b0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d525d0101e7c18f45384ed9946e52afe5fb9e816bdbb2ce95d7e6a8913c4288a
Instruction ID: 1c1c198ee1487a20e64920620db5cceb4f79f5d9e6fa5464d4550967bd9419ea
Opcode Fuzzy Hash: d525d0101e7c18f45384ed9946e52afe5fb9e816bdbb2ce95d7e6a8913c4288a
Instruction Fuzzy Hash: 7FB18870A1961D8FDBA9EB58C894BA8B7B5FF59301F5041E9D00DE72A5CB34AE81CF40

Function 00007FFD9B8B251D Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2032564007.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8b0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf0ad51154d09f2f36e1d379032c2f4d3da8ae252eb4c5165a231dc5ab7f4ab0
Instruction ID: cfe2c0445f01f1e9aaaac2afc2f07eb13791902963355da14315660e1a5133c3
Opcode Fuzzy Hash: bf0ad51154d09f2f36e1d379032c2f4d3da8ae252eb4c5165a231dc5ab7f4ab0
Instruction Fuzzy Hash: 4A811852B0E5AA4AE31A7BFC7C768F93F50EF46329B0941F7D09D4A0E3EC0964464786

Function 00007FFD9B8B2E90 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2032564007.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8b0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deed2a957e9e5ee23752ff015a277f9ad15d4904fcb6593793b8d4837708ef88
Instruction ID: 58ee7dde5028d9e43e19be248edc2281c2d902c80922b30cf059ba86f1e78556
Opcode Fuzzy Hash: deed2a957e9e5ee23752ff015a277f9ad15d4904fcb6593793b8d4837708ef88
Instruction Fuzzy Hash: 4D91E830A0991D8FDBA4EBA8D8A5BAD77E1FF59310F4101B9D00DD72A6CE74A985CF40

Function 00007FFD9B98C2A0 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2034259929.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b980000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffd5df7cc444c1813f96786b43cdda346965dc56fe7a79e763accea9b9072610
Instruction ID: fa9c3b07b808a32bc69132fb279f2f1c24bd26ed9af572419999fb8d82a96e49
Opcode Fuzzy Hash: ffd5df7cc444c1813f96786b43cdda346965dc56fe7a79e763accea9b9072610
Instruction Fuzzy Hash: 8451253172DE4C5FDBA8DA1C9465A757BE2EB99710B0501BFE08EC32A2DD21EC428381

Function 00007FFD9B8B1F71 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2032564007.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8b0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c81fe6db754cd9e86df82b9c39a63b6ae5d4e1932766b80c887e384cb1a9de7
Instruction ID: cdce7e76654d8410134bb0cca0f8142a48a43afb648e94e2d09735f7b529a116
Opcode Fuzzy Hash: 1c81fe6db754cd9e86df82b9c39a63b6ae5d4e1932766b80c887e384cb1a9de7
Instruction Fuzzy Hash: AF916774A15A2C8FDBA9EB58C894BA8B7B5FF59301F1001E9D00DE7265CB71AE81CF40

Function 00007FFD9B8B1E4F Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2032564007.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8b0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b321142d0f1e4c89bf5bb7494863baf58526e3d1d8ec75884f364ed2fa8aa869
Instruction ID: 2071b80d909384ef3f46c1b1e1a28cfc18e11a0bb06caeb3d7d6d2b92704b058
Opcode Fuzzy Hash: b321142d0f1e4c89bf5bb7494863baf58526e3d1d8ec75884f364ed2fa8aa869
Instruction Fuzzy Hash: 9881A870A0962D8FDBA9EB58C894BA8B7F5EF59301F1101E9D00DE7265CB74AE81CF41

Function 00007FFD9B8B30DD Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2032564007.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8b0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25307f1dca8e83771e07c9d5a9ea08caa7c4c442f9e82a25c4808cc0f8d89569
Instruction ID: 145b605c26e2577586b787d56775b4e0dd2b43445d2a675a8cc176d0593c097f
Opcode Fuzzy Hash: 25307f1dca8e83771e07c9d5a9ea08caa7c4c442f9e82a25c4808cc0f8d89569
Instruction Fuzzy Hash: 9E410D22B0F6BA4FD716E7BCBC754E87B60EF46268B0801F7D0988A0D7EC54654A87C1

Function 00007FFD9B98031D Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2034259929.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b980000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8bc870d7d29ca45f73aa78260de0c31ca9f57c8963ecaa87b84d9d4ee6cdae5
Instruction ID: b60187d0c650aa7ecf37d4811e464af730c1ea84228d971ca9b587b8102220ee
Opcode Fuzzy Hash: d8bc870d7d29ca45f73aa78260de0c31ca9f57c8963ecaa87b84d9d4ee6cdae5
Instruction Fuzzy Hash: 08410A3171EE885FD765D76C88699753BE1EF56720B0902FBD089C75F3D924AC068381

Function 00007FFD9B8B2CBD Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2032564007.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8b0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19471e94d4d81e438ef0b4d4a120bafa80f11a09c05e9be6f9d0252ffaf4d005
Instruction ID: 65091b0ac1471b10df662b1bac1a243fd6c476dac3536b346d7b255ef63de715
Opcode Fuzzy Hash: 19471e94d4d81e438ef0b4d4a120bafa80f11a09c05e9be6f9d0252ffaf4d005
Instruction Fuzzy Hash: 19416931A0F69D4FEB269FB898751A97FA0FF55300F0900BAD048C70E3DA25A949CB81

Function 00007FFD9B8B0A52 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2032564007.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8b0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00f7d6647b18b0e93be2c70c8fe868867cb0675fda13d2903e9c5450c83fbfe7
Instruction ID: ed78502c268818febe6e2bd93a6bf303deddeddd9e6846246e0132d55e4b6b88
Opcode Fuzzy Hash: 00f7d6647b18b0e93be2c70c8fe868867cb0675fda13d2903e9c5450c83fbfe7
Instruction Fuzzy Hash: FF419270918F598EE748CF58C8B47A97BE1FB5A704F60016AC108D73DDDBB52559CB40

Function 00007FFD9B8B30D0 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2032564007.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8b0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be94c6c101e6f7dbe76ebfcf4575f19d9136fc0f9338dd7229e41f3ef7d1e82d
Instruction ID: b62ae6f8205e969d4f64850aac7b4d5313e35e1898159552c6fd9503206e33ab
Opcode Fuzzy Hash: be94c6c101e6f7dbe76ebfcf4575f19d9136fc0f9338dd7229e41f3ef7d1e82d
Instruction Fuzzy Hash: 4C21E132E09A5D8FDB54CFAC88586AD7BF2FB9C300F04026AE40DE3251DB3499018B81

Function 00007FFD9B8B275A Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2032564007.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8b0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90196888de938dfb3d5c23560163d28da184e311c3e3179ded78da3166db6e48
Instruction ID: 020fe9e6c96df3fcce1ca63071cdeeb07d0485e4fadeb67387e14edd7c053924
Opcode Fuzzy Hash: 90196888de938dfb3d5c23560163d28da184e311c3e3179ded78da3166db6e48
Instruction Fuzzy Hash: 5C21E731A1A59D8FF798EFB488755A97BA0FF58300F4105BAE04DC71E7DD3469818B81

Function 00007FFD9B982119 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2034259929.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b980000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 332d39c8b11bfc0387794f0fab426b01f85895866c81e4f2fc7aca830cc76b44
Instruction ID: 3e89a826b88e9ad3de9cdb0ee59e6fe5f4504d31c6956993ffcf2128b53d0ccb
Opcode Fuzzy Hash: 332d39c8b11bfc0387794f0fab426b01f85895866c81e4f2fc7aca830cc76b44
Instruction Fuzzy Hash: C111B961B1EE891FE7A6DB6C846463537D2EFA9750B25407ED09DC72E3DE34AC418301

Function 00007FFD9B9804FD Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2034259929.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b980000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49ba581db51096ec320a39825851098caf3a298a0b4a8b7ac815c46a06baf0fe
Instruction ID: 60f4fedb80c5de948a67fb91a65a283b367fb01453a8a44c30117d6376431133
Opcode Fuzzy Hash: 49ba581db51096ec320a39825851098caf3a298a0b4a8b7ac815c46a06baf0fe
Instruction Fuzzy Hash: 2911D661B1EA8A1FD7A9D76C84746353BD1EF9A710B1901BED04CC72F2DE28AC458305

Function 00007FFD9B9806E0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2034259929.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b980000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59749703153ec25db151afbec0748177b922792c9153a5480374c7f7b696d517
Instruction ID: 25d0fd01e919b68e6e758dceb0e8f9061e3ac35e8a9da3bf9573bae2cca93b52
Opcode Fuzzy Hash: 59749703153ec25db151afbec0748177b922792c9153a5480374c7f7b696d517
Instruction Fuzzy Hash: C6115E71B2EA891FD365DB5C84651293BD2EF95710B1A027EE08CC32F2CD39ED058705

Function 00007FFD9B8B0D01 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2032564007.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8b0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fb5db9aa7c5b1168cb8241967740f95d5cfcada3f25606703691c5368ee21c1
Instruction ID: eeb545a0a0703962e5af552c96083676aa4e17e07d0d9d9603745c3fcfcff269
Opcode Fuzzy Hash: 7fb5db9aa7c5b1168cb8241967740f95d5cfcada3f25606703691c5368ee21c1
Instruction Fuzzy Hash: 62010431E1E68D5FE7A5AB7488762FD7BA0EF58300F0502BAE018C60E3ED2825408B41

Function 00007FFD9B9807CE Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2034259929.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b980000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19e42cb769ec2d1738d793be2cbfcc8a204db213b206cad067b369c0153193d7
Instruction ID: 9a521ac7e3ac56bff4df55485d2d54232f2140562eafe81a66715f7b6de5951c
Opcode Fuzzy Hash: 19e42cb769ec2d1738d793be2cbfcc8a204db213b206cad067b369c0153193d7
Instruction Fuzzy Hash: 6611C83071ED899FDBA5DB6CD464A247BE1EF55700B1941ADE04DC71E2CE29EC80CB85

Function 00007FFD9B8B0850 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2032564007.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8b0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7b6cd07b8f28f65b11b73a2dc40cf106f15fd6dff15ec0a687c189a5addbcb4
Instruction ID: c054f9373aad6b20d0beb6ba2a7dfa07460385ea146deff083ec14e2f6f070e8
Opcode Fuzzy Hash: c7b6cd07b8f28f65b11b73a2dc40cf106f15fd6dff15ec0a687c189a5addbcb4
Instruction Fuzzy Hash: E701DB12A1E5AA46D72623FD6C751F93750EF46528F0D01B3E0DC850E3DC19661785D2

Function 00007FFD9B8B3775 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2032564007.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8b0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a16bb3174fbc97887c6adaa39f20fc6762e3d528c50c5d3146a2425f00b2b69d
Instruction ID: 659c2d758d5c529fd47000520082ac10f9e47314388dec7ec3f05a502aec692c
Opcode Fuzzy Hash: a16bb3174fbc97887c6adaa39f20fc6762e3d528c50c5d3146a2425f00b2b69d
Instruction Fuzzy Hash: DA014870908A4D8FDF85EF68C858AEA7BF0FF68300F0005AAD418C72A1DB309694CB81

Function 00007FFD9B8B2FA8 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2032564007.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8b0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 983800de7148414de21c807dd2d8ed1a4f4f7bb8a48ffc88d458da03b0d3e77d
Instruction ID: d422086ba30f2f51e41310e0c800d1de2899605838eb3f1afdb5954315783dca
Opcode Fuzzy Hash: 983800de7148414de21c807dd2d8ed1a4f4f7bb8a48ffc88d458da03b0d3e77d
Instruction Fuzzy Hash: 6001D630914A4D9FDF94EF68C849AEE7BF0FB28305F00056AE81DD3264DB30A690CB81

Function 00007FFD9B8B2EE0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2032564007.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8b0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ffb2757c0a8f2f01998afaba2945423a6eae733b365a1f2f2480bb178b3b032
Instruction ID: ba068c2ae7e26f6e1192144348e084ce3373b28b323a6e70584c7fb76dc9bfb3
Opcode Fuzzy Hash: 7ffb2757c0a8f2f01998afaba2945423a6eae733b365a1f2f2480bb178b3b032
Instruction Fuzzy Hash: D301C830914A1D9FDF84EF68C849AEE77F0FB68305F00056AA819D3260DB30A590CB81

Function 00007FFD9B8B21F9 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2032564007.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8b0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a2d6675995b1b6da12df57d8af86c2a9067706faa7ad95d6a26458afa39e130
Instruction ID: 478a67123f10f8f007bc938ef956ef052d724c9219300f3aa49f4946d72ced8a
Opcode Fuzzy Hash: 4a2d6675995b1b6da12df57d8af86c2a9067706faa7ad95d6a26458afa39e130
Instruction Fuzzy Hash: 7E017C30A0969D8FCB85EFA8C859AAD7BF0FF19300F0501EAD018C72A2DB34D944CB41

Function 00007FFD9B8B2F08 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2032564007.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8b0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1589ce2f4dc7bcc2d3d2d05f6000d6812a0c5cd623bc947a059c4a4c54bc3475
Instruction ID: c145cb83e56c6fee5dd916647369db88b0980318d59911983724e84089f69a60
Opcode Fuzzy Hash: 1589ce2f4dc7bcc2d3d2d05f6000d6812a0c5cd623bc947a059c4a4c54bc3475
Instruction Fuzzy Hash: 0901BB3091491D8FDF94EF68C858AEE77F0FF68305F10056AA41DD3264DB70A690CB80

Function 00007FFD9B8B0D99 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2032564007.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8b0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5ac05d272cfdeb2d6a32e2f52133fc8eb9c2c9e72ea33546446ac38ba8f37cb
Instruction ID: 8cda8539dfb579f501f0734c53f6dddfc8e7ccffe52c00a897374354dedb4043
Opcode Fuzzy Hash: a5ac05d272cfdeb2d6a32e2f52133fc8eb9c2c9e72ea33546446ac38ba8f37cb
Instruction Fuzzy Hash: 17F0F671A1E78D5FE7629B7488291D87FB0FF5A310F4A02FBD048C70E3E92865588741

Function 00007FFD9B8B2D70 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2032564007.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8b0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 839ab63d8fbb0621e9cc3a76cf7e51656bb670f1730475eeef967260f32f3112
Instruction ID: 2b74f284b7c98abb9828e97fe999a9a9b727650038a84f49dbe2dce4945bd393
Opcode Fuzzy Hash: 839ab63d8fbb0621e9cc3a76cf7e51656bb670f1730475eeef967260f32f3112
Instruction Fuzzy Hash: FEF01C3091494C9FDF84EFA8C458AE9BBF0FF68305F4441AAE41DC31A4DB31A694CB41

Function 00007FFD9B8B0873 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2032564007.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8b0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f5565c0832c09fe547c7eb3cd6662d63e1c5eead320ca4dcb0acba5dfcb26bc
Instruction ID: 55bc2e468c3efaa80f770df5d15b76056747a909f36083f4a052ad586d046816
Opcode Fuzzy Hash: 1f5565c0832c09fe547c7eb3cd6662d63e1c5eead320ca4dcb0acba5dfcb26bc
Instruction Fuzzy Hash: EEF0A72192E7CD4ED72723F51C201947F70BF57204F4A01E3E048C60E3D91C9628C7A2

Non-executed Functions

Function 00007FFD9BADB41D Relevance: 1.1, Instructions: 1099COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2036686566.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bad0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55fe1a044fa0c203380d63937bb82775350b93ded43961639c008d3e2218dd7d
Instruction ID: 5a1d4865d06103d6ca8f90de9b834ea64b4b22993e9ce58e8b2572c081a8c8fa
Opcode Fuzzy Hash: 55fe1a044fa0c203380d63937bb82775350b93ded43961639c008d3e2218dd7d
Instruction Fuzzy Hash: E692EC70E19A2D8FDBA5EB58C8A5BE9B7B1FB58300F5042E9D00DD3295DE746A81CF40

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report jyRdJ06Naz.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ttgtggt.exe.log

C:\Users\user\AppData\Local\Programs\My Program\Octo_Browser_latest_win.exe (copy)

C:\Users\user\AppData\Local\Programs\My Program\is-6IG1B.tmp

C:\Users\user\AppData\Local\Programs\My Program\is-8QRAK.tmp

C:\Users\user\AppData\Local\Programs\My Program\is-E8O0B.tmp

C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe (copy)

C:\Users\user\AppData\Local\Programs\My Program\unins000.dat

C:\Users\user\AppData\Local\Programs\My Program\unins000.exe (copy)

C:\Users\user\AppData\Local\Temp\is-OJBCC.tmp\_isetup\_setup64.tmp

C:\Users\user\AppData\Local\Temp\is-PUDAC.tmp\jyRdJ06Naz.tmp

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\My Program.lnk

Static File Info

General

File Icon

Windows Analysis Report
jyRdJ06Naz.exe

Function 00007FFD9BAE4A99 Relevance: 4.2, Strings: 1, Instructions: 2909
COMMON

Function 00007FFD9B989D02 Relevance: 3.0, Instructions: 3013
COMMON

Function 00007FFD9B9816B3 Relevance: 1.0, Instructions: 995
COMMON

Function 00007FFD9BAD05B1 Relevance: .9, Instructions: 857
COMMON

Function 00007FFD9BAE2AD0 Relevance: .8, Instructions: 823
COMMON

Function 00007FFD9BAE2B30 Relevance: .8, Instructions: 814
COMMON

Function 00007FFD9B98D439 Relevance: 2.1, Strings: 1, Instructions: 867
COMMON

Function 00007FFD9BAD8A5A Relevance: 1.7, APIs: 1, Instructions: 245
fileCOMMON

Function 00007FFD9BAD9551 Relevance: 1.7, APIs: 1, Instructions: 169
fileCOMMON

Function 00007FFD9B98BDAC Relevance: 1.5, Strings: 1, Instructions: 287
COMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre