Edit tour

Windows Analysis Report
rHACNp6WFk.exe

Overview

General Information

Sample name:	rHACNp6WFk.exe renamed because original name is a hash value
Original sample name:	f7d1d2548bed4be604171cd18e535106e4549d646afb585265fb27d09c0feb7a.exe
Analysis ID:	1554440
MD5:	e8257a3a7ba4046f50d7795afa5b90b9
SHA1:	26368c267e2545eaa34cd33898daa4d9e12ab159
SHA256:	f7d1d2548bed4be604171cd18e535106e4549d646afb585265fb27d09c0feb7a
Tags:	4-251-123-83exeuser-JAMESWT_MHT
Infos:

Detection

Meduza Stealer, PureLog Stealer, RedLine, zgRAT

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Meduza Stealer

Yara detected PureLog Stealer

Yara detected RedLine Stealer

Yara detected zgRAT

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Creates an undocumented autostart registry key

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for dropped file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

rHACNp6WFk.exe (PID: 7524 cmdline: "C:\Users\user\Desktop\rHACNp6WFk.exe" MD5: E8257A3A7BA4046F50D7795AFA5B90B9)

rHACNp6WFk.tmp (PID: 7580 cmdline: "C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp" /SL5="$10436,29074250,797184,C:\Users\user\Desktop\rHACNp6WFk.exe" MD5: D318E73231E30E6B64517F61073B5AF3)

ttgtggt.exe (PID: 7796 cmdline: "C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe" MD5: C9B68B9567CC9067794E32999C02BFA7)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: RedLine

{"C2 url": "4.251.123.83:6677"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Programs\My Program\is-FGFQ0.tmp	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Users\user\AppData\Local\Programs\My Program\is-FGFQ0.tmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Programs\My Program\is-FGFQ0.tmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\Users\user\AppData\Local\Programs\My Program\is-FGFQ0.tmp	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x45c19:$s1: file:/// 0x45b51:$s2: {11111-22222-10009-11112} 0x45ba9:$s3: {11111-22222-50001-00000} 0x423fa:$s4: get_Module 0x42864:$s5: Reverse 0x45226:$s6: BlockCopy 0x42c23:$s7: ReadByte 0x45c2b:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...

Memory Dumps

Source	Rule	Description	Author
00000004.00000000.1545790566.0000000000102000.00000002.00000001.01000000.00000008.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000004.00000000.1545790566.0000000000102000.00000002.00000001.01000000.00000008.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000004.00000002.1627199642.000000000264D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ttgtggt.exe PID: 7796	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: ttgtggt.exe PID: 7796	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ttgtggt.exe PID: 7796	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.0.ttgtggt.exe.100000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
4.0.ttgtggt.exe.100000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.0.ttgtggt.exe.100000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
4.0.ttgtggt.exe.100000.0.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x45c19:$s1: file:/// 0x45b51:$s2: {11111-22222-10009-11112} 0x45ba9:$s3: {11111-22222-50001-00000} 0x423fa:$s4: get_Module 0x42864:$s5: Reverse 0x45226:$s6: BlockCopy 0x42c23:$s7: ReadByte 0x45c2b:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T14:56:57.133259+0100	2022930	1	A Network Trojan was detected	172.202.163.200	443	192.168.2.8	49706	TCP
2024-11-12T14:57:35.309360+0100	2022930	1	A Network Trojan was detected	172.202.163.200	443	192.168.2.8	49712	TCP

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T14:56:54.275070+0100	2046056	1	A Network Trojan was detected	4.251.123.83	6677	192.168.2.8	49705	TCP

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T14:56:53.759174+0100	2046045	1	A Network Trojan was detected	192.168.2.8	49705	4.251.123.83	6677	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: ttgtggt.exe.7796.4.memstrmin

Malware Configuration Extractor: RedLine {"C2 url": "4.251.123.83:6677"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Programs\My Program\is-FGFQ0.tmp	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe (copy)	ReversingLabs: Detection: 65%

Multi AV Scanner detection for submitted file

Source: rHACNp6WFk.exe

ReversingLabs: Detection: 31%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 96.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Programs\My Program\is-FGFQ0.tmp

Joe Sandbox ML: detected

Source: rHACNp6WFk.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B61D3B6E-7045-4057-9E07-2D934A8C359C}_is1

Jump to behavior

Source: rHACNp6WFk.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\agent\_work\138\s\build\ship\x86\burn.pdb source: is-GUSOD.tmp.2.dr
Source:	Binary string: C:\agent\_work\138\s\build\ship\x86\burn.pdb/ source: is-GUSOD.tmp.2.dr

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.8:49705 -> 4.251.123.83:6677
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 4.251.123.83:6677 -> 192.168.2.8:49705

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 4.251.123.83:6677

Source: global traffic

TCP traffic: 192.168.2.8:49705 -> 4.251.123.83:6677

Source: Joe Sandbox View

IP Address: 4.251.123.83 4.251.123.83

Source: Joe Sandbox View

ASN Name: LEVEL3US LEVEL3US

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.8:49706
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.8:49712

Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83

Source: ttgtggt.exe, 00000004.00000002.1627199642.00000000025A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 3IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: ttgtggt.exe, 00000004.00000002.1649583814.000000001B59C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002C15000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: rC:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002C15000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: rC:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb( equals www.youtube.com (Youtube)

Source: is-GUSOD.tmp.2.dr	String found in binary or memory: http://appsyndication.org/2006/appsynapplicationc:
Source: rHACNp6WFk.tmp, 00000002.00000002.1554362154.000000000095C000.00000004.00000010.00020000.00000000.sdmp, is-GUSOD.tmp.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: rHACNp6WFk.tmp, 00000002.00000002.1554362154.000000000095C000.00000004.00000010.00020000.00000000.sdmp, is-GUSOD.tmp.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: rHACNp6WFk.tmp, 00000002.00000002.1554362154.000000000095C000.00000004.00000010.00020000.00000000.sdmp, is-GUSOD.tmp.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: rHACNp6WFk.tmp, 00000002.00000002.1554362154.000000000095C000.00000004.00000010.00020000.00000000.sdmp, is-GUSOD.tmp.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: rHACNp6WFk.tmp, 00000002.00000002.1554362154.000000000095C000.00000004.00000010.00020000.00000000.sdmp, is-GUSOD.tmp.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: rHACNp6WFk.tmp, 00000002.00000002.1554362154.000000000095C000.00000004.00000010.00020000.00000000.sdmp, is-GUSOD.tmp.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: rHACNp6WFk.tmp, 00000002.00000002.1554362154.000000000095C000.00000004.00000010.00020000.00000000.sdmp, is-GUSOD.tmp.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: is-GUSOD.tmp.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: rHACNp6WFk.tmp, 00000002.00000002.1554362154.000000000095C000.00000004.00000010.00020000.00000000.sdmp, is-GUSOD.tmp.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: rHACNp6WFk.tmp, 00000002.00000002.1554362154.000000000095C000.00000004.00000010.00020000.00000000.sdmp, is-GUSOD.tmp.2.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: rHACNp6WFk.tmp, 00000002.00000002.1554362154.000000000095C000.00000004.00000010.00020000.00000000.sdmp, is-GUSOD.tmp.2.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: rHACNp6WFk.tmp, 00000002.00000002.1554362154.000000000095C000.00000004.00000010.00020000.00000000.sdmp, is-GUSOD.tmp.2.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: rHACNp6WFk.tmp, 00000002.00000002.1554362154.000000000095C000.00000004.00000010.00020000.00000000.sdmp, is-GUSOD.tmp.2.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: ttgtggt.exe, 00000004.00000002.1627199642.00000000025A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: ttgtggt.exe, 00000004.00000002.1627199642.00000000025A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: ttgtggt.exe, 00000004.00000002.1627199642.00000000025A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: ttgtggt.exe, 00000004.00000002.1627199642.00000000025A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: ttgtggt.exe, 00000004.00000002.1627199642.00000000025A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: ttgtggt.exe, 00000004.00000002.1627199642.00000000025A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: ttgtggt.exe, 00000004.00000002.1627199642.00000000025A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: ttgtggt.exe, 00000004.00000002.1627199642.00000000025A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: ttgtggt.exe, 00000004.00000002.1627199642.00000000025A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: ttgtggt.exe, 00000004.00000002.1627199642.00000000025A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: ttgtggt.exe, 00000004.00000002.1627199642.00000000025A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: ttgtggt.exe, 00000004.00000002.1627199642.00000000025A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: ttgtggt.exe, 00000004.00000002.1627199642.00000000025A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002775000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: ttgtggt.exe, 00000004.00000002.1627199642.00000000025A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: ttgtggt.exe, 00000004.00000002.1627199642.00000000025A1000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: ttgtggt.exe, 00000004.00000002.1627199642.00000000025A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field1
Source: ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field1Response
Source: ttgtggt.exe, 00000004.00000002.1627199642.00000000025A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field2
Source: ttgtggt.exe, 00000004.00000002.1627199642.000000000264D000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000004.00000002.1627199642.00000000025A1000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field2Response
Source: ttgtggt.exe, 00000004.00000002.1627199642.00000000025A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field3
Source: ttgtggt.exe, 00000004.00000002.1627199642.000000000286F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field3Response
Source: rHACNp6WFk.tmp, 00000002.00000002.1554362154.000000000095C000.00000004.00000010.00020000.00000000.sdmp, is-GUSOD.tmp.2.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: ttgtggt.exe, 00000004.00000002.1627199642.000000000286F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.o
Source: ttgtggt.exe, 00000004.00000002.1627199642.000000000286F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.oh
Source: ttgtggt.exe, 00000004.00000002.1637709747.00000000125DA000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000004.00000002.1637709747.00000000129C7000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000004.00000002.1637709747.00000000127F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: ttgtggt.exe, 00000004.00000002.1627199642.00000000025A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: ttgtggt.exe, 00000004.00000002.1637709747.00000000125DA000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000004.00000002.1637709747.00000000129C7000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000004.00000002.1637709747.00000000127F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: ttgtggt.exe, 00000004.00000002.1637709747.00000000125DA000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000004.00000002.1637709747.00000000129C7000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000004.00000002.1637709747.00000000127F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: ttgtggt.exe, 00000004.00000002.1637709747.00000000125DA000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000004.00000002.1637709747.00000000129C7000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000004.00000002.1637709747.00000000127F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: ttgtggt.exe, 00000004.00000002.1627199642.00000000025A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: ttgtggt.exe, 00000004.00000002.1637709747.00000000125DA000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000004.00000002.1637709747.00000000129C7000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000004.00000002.1637709747.00000000127F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: ttgtggt.exe, 00000004.00000002.1637709747.00000000125DA000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000004.00000002.1637709747.00000000129C7000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000004.00000002.1637709747.00000000127F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: ttgtggt.exe, 00000004.00000002.1637709747.00000000125DA000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000004.00000002.1637709747.00000000129C7000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000004.00000002.1637709747.00000000127F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: rHACNp6WFk.exe	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: ttgtggt.exe, 00000004.00000002.1637709747.00000000125DA000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000004.00000002.1637709747.00000000129C7000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000004.00000002.1637709747.00000000127F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: rHACNp6WFk.tmp, 00000002.00000003.1551738373.0000000000FEC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.github.com/
Source: rHACNp6WFk.exe, 00000000.00000003.1407144583.0000000002CD0000.00000004.00001000.00020000.00000000.sdmp, rHACNp6WFk.tmp, 00000002.00000003.1412075685.0000000003770000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.github.com/.https://www.github.com/.https://www.github.com/
Source: rHACNp6WFk.exe, 00000000.00000003.1557115941.000000000282C000.00000004.00001000.00020000.00000000.sdmp, rHACNp6WFk.tmp, 00000002.00000003.1551738373.0000000000FEC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.github.com/a
Source: ttgtggt.exe, 00000004.00000002.1637709747.00000000125DA000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000004.00000002.1637709747.00000000129C7000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000004.00000002.1637709747.00000000127F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: rHACNp6WFk.exe, 00000000.00000003.1408743597.000000007F88B000.00000004.00001000.00020000.00000000.sdmp, rHACNp6WFk.exe, 00000000.00000003.1408348042.0000000002CD0000.00000004.00001000.00020000.00000000.sdmp, rHACNp6WFk.tmp, 00000002.00000000.1410351911.00000000002B1000.00000020.00000001.01000000.00000004.sdmp, is-2T33C.tmp.2.dr	String found in binary or memory: https://www.innosetup.com/
Source: rHACNp6WFk.exe, 00000000.00000003.1408743597.000000007F88B000.00000004.00001000.00020000.00000000.sdmp, rHACNp6WFk.exe, 00000000.00000003.1408348042.0000000002CD0000.00000004.00001000.00020000.00000000.sdmp, rHACNp6WFk.tmp, 00000002.00000000.1410351911.00000000002B1000.00000020.00000001.01000000.00000004.sdmp, is-2T33C.tmp.2.dr	String found in binary or memory: https://www.remobjects.com/ps

Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.0.ttgtggt.exe.100000.0.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Programs\My Program\is-FGFQ0.tmp, type: DROPPED	Matched rule: Detects zgRAT Author: ditekSHen

Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Code function: 4_2_00007FFB4A0C16B3	4_2_00007FFB4A0C16B3
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Code function: 4_2_00007FFB4A0C9CE5	4_2_00007FFB4A0C9CE5
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Code function: 4_2_00007FFB4A0CC50A	4_2_00007FFB4A0CC50A
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Code function: 4_2_00007FFB4A231309	4_2_00007FFB4A231309
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Code function: 4_2_00007FFB4A2118C9	4_2_00007FFB4A2118C9
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Code function: 4_2_00007FFB4A220275	4_2_00007FFB4A220275
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Code function: 4_2_00007FFB4A23070D	4_2_00007FFB4A23070D
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Code function: 4_2_00007FFB4A229F91	4_2_00007FFB4A229F91
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Code function: 4_2_00007FFB4A21BD39	4_2_00007FFB4A21BD39
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Code function: 4_2_00007FFB4A21F5CD	4_2_00007FFB4A21F5CD
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Code function: 4_2_00007FFB4A21DAF4	4_2_00007FFB4A21DAF4
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Code function: 4_2_00007FFB4A21C499	4_2_00007FFB4A21C499
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Code function: 4_2_00007FFB4A2270D9	4_2_00007FFB4A2270D9
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Code function: 4_2_00007FFB4A227090	4_2_00007FFB4A227090
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Code function: 4_2_00007FFB4A226579	4_2_00007FFB4A226579

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Programs\My Program\is-FGFQ0.tmp 8DBCECF4F09CDB10EF4F2AC2AC3F66A28D148A63A381877F413CD5F5B39DB4E0
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe (copy) 8DBCECF4F09CDB10EF4F2AC2AC3F66A28D148A63A381877F413CD5F5B39DB4E0

Source: rHACNp6WFk.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-2T33C.tmp.2.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows

Source: rHACNp6WFk.exe	Static PE information: Number of sections : 11 > 10
Source: is-2T33C.tmp.2.dr	Static PE information: Number of sections : 11 > 10
Source: rHACNp6WFk.tmp.0.dr	Static PE information: Number of sections : 11 > 10

Source: rHACNp6WFk.exe, 00000000.00000003.1408743597.000000007FB7B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs rHACNp6WFk.exe
Source: rHACNp6WFk.exe, 00000000.00000000.1406891117.0000000000B69000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs rHACNp6WFk.exe
Source: rHACNp6WFk.exe, 00000000.00000003.1408348042.0000000002DDF000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs rHACNp6WFk.exe
Source: rHACNp6WFk.exe	Binary or memory string: OriginalFileName vs rHACNp6WFk.exe

Source: rHACNp6WFk.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 4.0.ttgtggt.exe.100000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: C:\Users\user\AppData\Local\Programs\My Program\is-FGFQ0.tmp, type: DROPPED	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT

Source: classification engine

Classification label: mal80.troj.spyw.evad.winEXE@5/11@0/1

Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\rHACNp6WFk.exe

File created: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp

Jump to behavior

Source: C:\Users\user\Desktop\rHACNp6WFk.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\rHACNp6WFk.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\rHACNp6WFk.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: rHACNp6WFk.exe

ReversingLabs: Detection: 31%

Source: rHACNp6WFk.exe

String found in binary or memory: /LOADINF="filename"

Source: C:\Users\user\Desktop\rHACNp6WFk.exe

File read: C:\Users\user\Desktop\rHACNp6WFk.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\rHACNp6WFk.exe "C:\Users\user\Desktop\rHACNp6WFk.exe"
Source: C:\Users\user\Desktop\rHACNp6WFk.exe	Process created: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp "C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp" /SL5="$10436,29074250,797184,C:\Users\user\Desktop\rHACNp6WFk.exe"
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Process created: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe "C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe"
Source: C:\Users\user\Desktop\rHACNp6WFk.exe	Process created: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp "C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp" /SL5="$10436,29074250,797184,C:\Users\user\Desktop\rHACNp6WFk.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Process created: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe "C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe"	Jump to behavior

Source: C:\Users\user\Desktop\rHACNp6WFk.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\rHACNp6WFk.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: My Program.lnk.2.dr

LNK file: ..\..\..\..\..\Local\Programs\My Program\ttgtggt.exe

Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp

Window found: window name: TMainForm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Automated click: Next

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B61D3B6E-7045-4057-9E07-2D934A8C359C}_is1

Jump to behavior

Source: rHACNp6WFk.exe

Static file information: File size 30026469 > 1048576

Source: rHACNp6WFk.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\agent\_work\138\s\build\ship\x86\burn.pdb source: is-GUSOD.tmp.2.dr
Source:	Binary string: C:\agent\_work\138\s\build\ship\x86\burn.pdb/ source: is-GUSOD.tmp.2.dr

Source: is-FGFQ0.tmp.2.dr

Static PE information: 0xE3FEC0F4 [Mon Mar 19 06:19:32 2091 UTC]

Source: rHACNp6WFk.exe	Static PE information: section name: .didata
Source: rHACNp6WFk.tmp.0.dr	Static PE information: section name: .didata
Source: is-2T33C.tmp.2.dr	Static PE information: section name: .didata
Source: is-GUSOD.tmp.2.dr	Static PE information: section name: .wixburn

Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Code function: 4_2_00007FFB49FF5CB5 push edx; iretd	4_2_00007FFB49FF5CBB
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Code function: 4_2_00007FFB49FF5D0E push edx; iretd	4_2_00007FFB49FF5CBB
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Code function: 4_2_00007FFB4A0CCB4F push eax; retf	4_2_00007FFB4A0CCB61
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Code function: 4_2_00007FFB4A0C6170 pushad ; ret	4_2_00007FFB4A0C6171
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Code function: 4_2_00007FFB4A0C2004 pushad ; retf	4_2_00007FFB4A0C2005
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Code function: 4_2_00007FFB4A2270D9 push ds; ret	4_2_00007FFB4A22795F
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Code function: 4_2_00007FFB4A227090 push ds; ret	4_2_00007FFB4A22795F

Source: C:\Users\user\Desktop\rHACNp6WFk.exe	File created: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	File created: C:\Users\user\AppData\Local\Programs\My Program\is-2T33C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	File created: C:\Users\user\AppData\Local\Programs\My Program\is-FGFQ0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	File created: C:\Users\user\AppData\Local\Temp\is-3O9NM.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	File created: C:\Users\user\AppData\Local\Programs\My Program\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	File created: C:\Users\user\AppData\Local\Programs\My Program\python-3.13.0-amd64.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	File created: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	File created: C:\Users\user\AppData\Local\Programs\My Program\is-GUSOD.tmp	Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Key value created or modified: HKEY_CURRENT_USER_Classes\.exe\OpenWithProgids File.exe			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Key value created or modified: HKEY_CURRENT_USER_Classes\.exe\OpenWithProgids File.exe			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\My Program.lnk

Jump to behavior

Source: C:\Users\user\Desktop\rHACNp6WFk.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: ttgtggt.exe, 00000004.00000002.1627199642.00000000025A1000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: \QEMU-GA.EXE

Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Memory allocated: 880000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Memory allocated: 1A5A0000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Window / User API: threadDelayed 1892			Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Window / User API: threadDelayed 2810			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\My Program\is-2T33C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-3O9NM.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\My Program\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\My Program\python-3.13.0-amd64.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\My Program\is-GUSOD.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe TID: 8052	Thread sleep time: -13835058055282155s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe TID: 7820	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: ttgtggt.exe, 00000004.00000002.1637709747.00000000126CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: ttgtggt.exe, 00000004.00000002.1637709747.00000000126CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696494690f
Source: ttgtggt.exe, 00000004.00000002.1637709747.00000000126CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696494690
Source: ttgtggt.exe, 00000004.00000002.1637709747.00000000126CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: ttgtggt.exe, 00000004.00000002.1637709747.00000000126CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: ttgtggt.exe, 00000004.00000002.1637709747.00000000126CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: ttgtggt.exe, 00000004.00000002.1637709747.00000000126CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: ttgtggt.exe, 00000004.00000002.1637709747.00000000126CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: ttgtggt.exe, 00000004.00000002.1637709747.00000000126CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: ttgtggt.exe, 00000004.00000002.1637709747.00000000126CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: ttgtggt.exe, 00000004.00000002.1637709747.00000000126CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: ttgtggt.exe, 00000004.00000002.1637709747.00000000126CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: ttgtggt.exe, 00000004.00000002.1637709747.00000000126CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: ttgtggt.exe, 00000004.00000002.1637709747.00000000126CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: ttgtggt.exe, 00000004.00000002.1637709747.00000000126CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: ttgtggt.exe, 00000004.00000002.1637709747.00000000126CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: ttgtggt.exe, 00000004.00000002.1637709747.00000000126CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: ttgtggt.exe, 00000004.00000002.1637709747.00000000126CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: ttgtggt.exe, 00000004.00000002.1649583814.000000001B5FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll5
Source: ttgtggt.exe, 00000004.00000002.1637709747.00000000126CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: ttgtggt.exe, 00000004.00000002.1637709747.00000000126CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: ttgtggt.exe, 00000004.00000002.1637709747.00000000126CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: ttgtggt.exe, 00000004.00000002.1627199642.00000000025A1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe
Source: ttgtggt.exe, 00000004.00000002.1637709747.00000000126CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: ttgtggt.exe, 00000004.00000002.1637709747.00000000126CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696494690
Source: ttgtggt.exe, 00000004.00000002.1637709747.00000000126CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: ttgtggt.exe, 00000004.00000002.1637709747.00000000126CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: ttgtggt.exe, 00000004.00000002.1637709747.00000000126CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: ttgtggt.exe, 00000004.00000002.1637709747.00000000126CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: ttgtggt.exe, 00000004.00000002.1637709747.00000000126CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: ttgtggt.exe, 00000004.00000002.1637709747.00000000126CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: ttgtggt.exe, 00000004.00000002.1637709747.00000000126CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: ttgtggt.exe, 00000004.00000002.1637709747.00000000126CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE

Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected Meduza Stealer

Source: Yara match

File source: Process Memory Space: ttgtggt.exe PID: 7796, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 4.0.ttgtggt.exe.100000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000000.1545790566.0000000000102000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Programs\My Program\is-FGFQ0.tmp, type: DROPPED

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 4.0.ttgtggt.exe.100000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000000.1545790566.0000000000102000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ttgtggt.exe PID: 7796, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Programs\My Program\is-FGFQ0.tmp, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: 4.0.ttgtggt.exe.100000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Programs\My Program\is-FGFQ0.tmp, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: ttgtggt.exe, 00000004.00000002.1627199642.000000000264D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: ttgtggt.exe, 00000004.00000002.1627199642.000000000264D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ElectronCash
Source: ttgtggt.exe, 00000004.00000002.1627199642.000000000264D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: com.liberty.jaxx
Source: ttgtggt.exe, 00000004.00000002.1627199642.000000000264D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Exodus
Source: ttgtggt.exe, 00000004.00000002.1627199642.000000000264D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: ttgtggt.exe, 00000004.00000000.1545790566.0000000000102000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: set_UseMachineKeyStore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior

Source: Yara match	File source: 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1627199642.000000000264D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ttgtggt.exe PID: 7796, type: MEMORYSTR

Remote Access Functionality

Yara detected Meduza Stealer

Source: Yara match

File source: Process Memory Space: ttgtggt.exe PID: 7796, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 4.0.ttgtggt.exe.100000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000000.1545790566.0000000000102000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Programs\My Program\is-FGFQ0.tmp, type: DROPPED

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 4.0.ttgtggt.exe.100000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000000.1545790566.0000000000102000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ttgtggt.exe PID: 7796, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Programs\My Program\is-FGFQ0.tmp, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: 4.0.ttgtggt.exe.100000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Programs\My Program\is-FGFQ0.tmp, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 Windows Service	1 Windows Service	1 Masquerading	1 OS Credential Dumping	421 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	1 Process Injection	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	3 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	11 Registry Run Keys / Startup Folder	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Clipboard Data	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	2 System Owner/User Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	113 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
rHACNp6WFk.exe	32%	ReversingLabs	ByteCode-MSIL.Trojan.Mamut

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Programs\My Program\is-FGFQ0.tmp	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Programs\My Program\is-FGFQ0.tmp	66%	ReversingLabs	ByteCode-MSIL.Ransomware.RedLine
C:\Users\user\AppData\Local\Programs\My Program\is-GUSOD.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\My Program\python-3.13.0-amd64.exe (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe (copy)	66%	ReversingLabs	ByteCode-MSIL.Ransomware.RedLine
C:\Users\user\AppData\Local\Temp\is-3O9NM.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp	0%	ReversingLabs

Name	Malicious	Antivirus Detection	Reputation
4.251.123.83:6677	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtab	ttgtggt.exe, 00000004.00000002.1637709747.00000000125DA000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000004.00000002.1637709747.00000000129C7000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000004.00000002.1637709747.00000000127F6000.00000004.00000800.00020000.00000000.sdmp	false	high
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	rHACNp6WFk.exe	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	ttgtggt.exe, 00000004.00000002.1637709747.00000000125DA000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000004.00000002.1637709747.00000000129C7000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000004.00000002.1637709747.00000000127F6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/	ttgtggt.exe, 00000004.00000002.1627199642.00000000025A1000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://appsyndication.org/2006/appsynapplicationc:	is-GUSOD.tmp.2.dr	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	ttgtggt.exe, 00000004.00000002.1627199642.00000000025A1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.remobjects.com/ps	rHACNp6WFk.exe, 00000000.00000003.1408743597.000000007F88B000.00000004.00001000.00020000.00000000.sdmp, rHACNp6WFk.exe, 00000000.00000003.1408348042.0000000002CD0000.00000004.00001000.00020000.00000000.sdmp, rHACNp6WFk.tmp, 00000002.00000000.1410351911.00000000002B1000.00000020.00000001.01000000.00000004.sdmp, is-2T33C.tmp.2.dr	false	high
https://www.innosetup.com/	rHACNp6WFk.exe, 00000000.00000003.1408743597.000000007F88B000.00000004.00001000.00020000.00000000.sdmp, rHACNp6WFk.exe, 00000000.00000003.1408348042.0000000002CD0000.00000004.00001000.00020000.00000000.sdmp, rHACNp6WFk.tmp, 00000002.00000000.1410351911.00000000002B1000.00000020.00000001.01000000.00000004.sdmp, is-2T33C.tmp.2.dr	false	high
https://discord.com/api/v9/users/	ttgtggt.exe, 00000004.00000002.1627199642.00000000025A1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/example/Field1Response	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	ttgtggt.exe, 00000004.00000002.1627199642.0000000002775000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.ip.sb/ip	ttgtggt.exe, 00000004.00000002.1627199642.00000000025A1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/sc	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	ttgtggt.exe, 00000004.00000002.1637709747.00000000125DA000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000004.00000002.1637709747.00000000129C7000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000004.00000002.1637709747.00000000127F6000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.github.com/	rHACNp6WFk.tmp, 00000002.00000003.1551738373.0000000000FEC000.00000004.00001000.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	ttgtggt.exe, 00000004.00000002.1637709747.00000000125DA000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000004.00000002.1637709747.00000000129C7000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000004.00000002.1637709747.00000000127F6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	ttgtggt.exe, 00000004.00000002.1627199642.00000000025A1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.w3.oh	ttgtggt.exe, 00000004.00000002.1627199642.000000000286F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.github.com/.https://www.github.com/.https://www.github.com/	rHACNp6WFk.exe, 00000000.00000003.1407144583.0000000002CD0000.00000004.00001000.00020000.00000000.sdmp, rHACNp6WFk.tmp, 00000002.00000003.1412075685.0000000003770000.00000004.00001000.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/08/addressing	ttgtggt.exe, 00000004.00000002.1627199642.00000000025A1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/trust	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	ttgtggt.exe, 00000004.00000002.1627199642.00000000025A1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/example/Field1	ttgtggt.exe, 00000004.00000002.1627199642.00000000025A1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/soap/envelope/	ttgtggt.exe, 00000004.00000002.1627199642.00000000025A1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/example/Field2	ttgtggt.exe, 00000004.00000002.1627199642.00000000025A1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/example/Field3	ttgtggt.exe, 00000004.00000002.1627199642.00000000025A1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	ttgtggt.exe, 00000004.00000002.1637709747.00000000125DA000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000004.00000002.1637709747.00000000129C7000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000004.00000002.1637709747.00000000127F6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/06/addressingex	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wscoor	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	ttgtggt.exe, 00000004.00000002.1627199642.00000000025A1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/08/addressing/fault	ttgtggt.exe, 00000004.00000002.1627199642.00000000025A1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	ttgtggt.exe, 00000004.00000002.1637709747.00000000125DA000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000004.00000002.1637709747.00000000129C7000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000004.00000002.1637709747.00000000127F6000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.github.com/a	rHACNp6WFk.exe, 00000000.00000003.1557115941.000000000282C000.00000004.00001000.00020000.00000000.sdmp, rHACNp6WFk.tmp, 00000002.00000003.1551738373.0000000000FEC000.00000004.00001000.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.w3.o	ttgtggt.exe, 00000004.00000002.1627199642.000000000286F000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/example/Field3Response	ttgtggt.exe, 00000004.00000002.1627199642.000000000286F000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	ttgtggt.exe, 00000004.00000002.1627199642.00000000025A1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	ttgtggt.exe, 00000004.00000002.1627199642.00000000025A1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	ttgtggt.exe, 00000004.00000002.1637709747.00000000125DA000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000004.00000002.1637709747.00000000129C7000.00000004.00000800.00020000.00000000.sdmp, ttgtggt.exe, 00000004.00000002.1637709747.00000000127F6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1	ttgtggt.exe, 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
4.251.123.83	unknown	United States		3356	LEVEL3US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1554440
Start date and time:	2024-11-12 14:55:41 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	rHACNp6WFk.exe renamed because original name is a hash value
Original Sample Name:	f7d1d2548bed4be604171cd18e535106e4549d646afb585265fb27d09c0feb7a.exe
Detection:	MAL
Classification:	mal80.troj.spyw.evad.winEXE@5/11@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: rHACNp6WFk.exe

Simulations

Behavior and APIs

Time	Type	Description
08:56:56	API Interceptor	23x Sleep call for process: ttgtggt.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
4.251.123.83	jyRdJ06Naz.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse
	rePERU8VUs.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse
	VJoillkb6X.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse
	9LrEuTWP8s.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse
	HAeAec7no3.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse
	EUFOvMxM2H.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse
	i4w1K6ft2F.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse
	xMYbN0Yd2a.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse
	FaZM14kDMN.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse
	j7movK82QT.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LEVEL3US	jyRdJ06Naz.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse	4.251.123.83
	rePERU8VUs.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse	4.251.123.83
	VJoillkb6X.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse	4.251.123.83
	9LrEuTWP8s.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse	4.251.123.83
	HAeAec7no3.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse	4.251.123.83
	EUFOvMxM2H.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse	4.251.123.83
	i4w1K6ft2F.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse	4.251.123.83
	xMYbN0Yd2a.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse	4.251.123.83
	FaZM14kDMN.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse	4.251.123.83
	j7movK82QT.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse	4.251.123.83

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe (copy)	jyRdJ06Naz.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse
C:\Users\user\AppData\Local\Programs\My Program\is-FGFQ0.tmp	jyRdJ06Naz.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ttgtggt.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2611
Entropy (8bit):	5.363358188931451
Encrypted:	false
SSDEEP:	48:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhAHKKkafHKWA1eXrHKlT48BHK7HKmTHlHNW:iq+wmj0qCYqGSI6oPtzHeqKkGqhA7qZR
MD5:	CEA017D10C4D437981D19F21660A47FA
SHA1:	61AAFCECB5325DE172857CEF7C7E1F230F73AFFD
SHA-256:	60B099420455DECD1878FE84F217CFE478BA0BA5E6E574077150D08355A1DD96
SHA-512:	413384BF9D2EDC9BC2DF6D5175D09A33B91CCF9C53FE3CB21892CB57AF4FD8A9BE0608E9BCA57AF4A7F2709A4C110148719DA3210460DF433CFD77FA753B9CF8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Programs\My Program\is-2T33C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3311677
Entropy (8bit):	6.5714241602852965
Encrypted:	false
SSDEEP:	49152:MdJYVM+9JtzZWnoS2VC23aun8+f5KuG2OY9IG9ivyv2cLx1RQL3330Y:uJYVM+LtVt3P/KuG2ONG9iqLRQL333f
MD5:	0CD7B69C1A41E8F5671DC1EF6044B567
SHA1:	8B393D9F344D02129433EA93EF8CA3E324A9A2BA
SHA-256:	6E543D5B3B0A1F76DAFFA72CE3E789FB14A19E0556EE7370F3788FE67FD68FC0
SHA-512:	2A97ABD15DEF952AA3EB3F51321B14B5B316F0CEECD5308C172A03845099358DE9AA80D0C8E1153E648C7889207DE12E2E190361DADFB8E0F8EE3A3D35684FF6
Malicious:	true
Reputation:	low
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f....................d..................@...........................3...........@......@...................P,.n.....,.j:...P0. .....................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc... ....P0......./.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Local\Programs\My Program\is-FGFQ0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	346112
Entropy (8bit):	6.572244662396641
Encrypted:	false
SSDEEP:	6144:2DKXJVqDD/qxgATuaBNt1BrivR0V4TBjgYxs1wl206gBawFV2ceSb0BQ/GfM/4Qx:2DgYDzqxdXBNt1BrivR0V4TBjgYxs1wQ
MD5:	C9B68B9567CC9067794E32999C02BFA7
SHA1:	D999F0701086E1ECC87380CF002F37F985C6DE4C
SHA-256:	8DBCECF4F09CDB10EF4F2AC2AC3F66A28D148A63A381877F413CD5F5B39DB4E0
SHA-512:	9E24E7FAB933FBD5AD500B0759582D3417CCD571C248010BE486C53574F21E38A5D10DD2B14128CC4D4B4D922DC25806A14D46793B9E2FFE951B8C797F458C6A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\AppData\Local\Programs\My Program\is-FGFQ0.tmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Programs\My Program\is-FGFQ0.tmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Programs\My Program\is-FGFQ0.tmp, Author: Joe Security Rule: MALWARE_Win_zgRAT, Description: Detects zgRAT, Source: C:\Users\user\AppData\Local\Programs\My Program\is-FGFQ0.tmp, Author: ditekSHen
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 66%
Joe Sandbox View:	Filename: jyRdJ06Naz.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc...............F..............@..B........................H........K........../.......)............................................(O...(......{......{.....~....(....~....(.....(......}......}.....0..<........u......,0(.....{.....{....o....,.(.....{.....{....o....+... ..L0(.....{....o....X )UU.Z(.....{....o....X..0...........r...p......%..{.....................-.q.............-.&.+.......o.....%..{.....................-.q.............-.&.+.......o.....(......{......{.....~....(....~....(.....(......}......}....*...0..<...

C:\Users\user\AppData\Local\Programs\My Program\is-GUSOD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28160096
Entropy (8bit):	7.997949543387279
Encrypted:	true
SSDEEP:	393216:NQs3AMrF2S7Pr96of7sv2iZpAs2vEqhlKBe//u4fW9Xj9uXU//EAa6L4pGROW:NQs31rFn7Pr4Y4vbpCye//zf0TAEVJGq
MD5:	F5E5D48BA86586D4BEF67BCB3790D339
SHA1:	118838D3BC5D1A13CE71D8D83DE52427B1562124
SHA-256:	78156AD0CF0EC4123BFB5333B40F078596EBF15F2D062A10144863680AFBDEFC
SHA-512:	FFAEF212D55E3BDD87E79CBFACEBC0612FFC1C8C4B495585392746202DCE6332383199F0206113EE95EBB4A76D718D0700E1AED9AD518D43B7569A44F0A39427
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........[.s...s...s.......s......$s.......s.......s.......s.......s.......s.......s...s...r.......s....Q..s...s9..s.......s..Rich.s..........................PE..L....RKa..........................................@......................................@.................................<............e..........P..../...P...=...{..T....................{.......z..@............................................text.............................. ..`.rdata..t...........................@..@.data...............................@....wixburn8...........................@..@.rsrc....e.......f..................@..@.reloc...=...P...>..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\My Program\python-3.13.0-amd64.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28160096
Entropy (8bit):	7.997949543387279
Encrypted:	true
SSDEEP:	393216:NQs3AMrF2S7Pr96of7sv2iZpAs2vEqhlKBe//u4fW9Xj9uXU//EAa6L4pGROW:NQs31rFn7Pr4Y4vbpCye//zf0TAEVJGq
MD5:	F5E5D48BA86586D4BEF67BCB3790D339
SHA1:	118838D3BC5D1A13CE71D8D83DE52427B1562124
SHA-256:	78156AD0CF0EC4123BFB5333B40F078596EBF15F2D062A10144863680AFBDEFC
SHA-512:	FFAEF212D55E3BDD87E79CBFACEBC0612FFC1C8C4B495585392746202DCE6332383199F0206113EE95EBB4A76D718D0700E1AED9AD518D43B7569A44F0A39427
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........[.s...s...s.......s......$s.......s.......s.......s.......s.......s.......s...s...r.......s....Q..s...s9..s.......s..Rich.s..........................PE..L....RKa..........................................@......................................@.................................<............e..........P..../...P...=...{..T....................{.......z..@............................................text.............................. ..`.rdata..t...........................@..@.data...............................@....wixburn8...........................@..@.rsrc....e.......f..................@..@.reloc...=...P...>..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	346112
Entropy (8bit):	6.572244662396641
Encrypted:	false
SSDEEP:	6144:2DKXJVqDD/qxgATuaBNt1BrivR0V4TBjgYxs1wl206gBawFV2ceSb0BQ/GfM/4Qx:2DgYDzqxdXBNt1BrivR0V4TBjgYxs1wQ
MD5:	C9B68B9567CC9067794E32999C02BFA7
SHA1:	D999F0701086E1ECC87380CF002F37F985C6DE4C
SHA-256:	8DBCECF4F09CDB10EF4F2AC2AC3F66A28D148A63A381877F413CD5F5B39DB4E0
SHA-512:	9E24E7FAB933FBD5AD500B0759582D3417CCD571C248010BE486C53574F21E38A5D10DD2B14128CC4D4B4D922DC25806A14D46793B9E2FFE951B8C797F458C6A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 66%
Joe Sandbox View:	Filename: jyRdJ06Naz.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc...............F..............@..B........................H........K........../.......)............................................(O...(......{......{.....~....(....~....(.....(......}......}.....0..<........u......,0(.....{.....{....o....,.(.....{.....{....o....+... ..L0(.....{....o....X )UU.Z(.....{....o....X..0...........r...p......%..{.....................-.q.............-.&.+.......o.....%..{.....................-.q.............-.&.+.......o.....(......{......{.....~....(....~....(.....(......}......}....*...0..<...

C:\Users\user\AppData\Local\Programs\My Program\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp
File Type:	InnoSetup Log My Program {B61D3B6E-7045-4057-9E07-2D934A8C359C}, version 0x418, 2214 bytes, 965969\37\user\37, C:\Users\user\AppData\Local\Programs\My
Category:	dropped
Size (bytes):	2214
Entropy (8bit):	3.4889963235470005
Encrypted:	false
SSDEEP:	48:EMGQQC3GQDCy1bGQl1GQyGQjCyQJCyQMztxvjUxA8xeUh7HAM:HBC0mC7CeBhUi8HhzAM
MD5:	D47C9BFA387FA41AFCBDAEC1CC36E611
SHA1:	E6DF4D7FD09604E0D5D0A81433FEDCCBF67EE83C
SHA-256:	0DD0AB2CA8571EE765F03C20F4C4DDB1CDED5CFA43756F02DBC5D75C69256C72
SHA-512:	7D3E5CD0AE0090575DE39C353F275B5F576451F463F31D831855E6FC47B7574E131E4160F21F47BC4CFD5E237F13316396270577C86D5983762E8682AD32F7FC
Malicious:	false
Preview:	Inno Setup Uninstall Log (b)....................................{B61D3B6E-7045-4057-9E07-2D934A8C359C}..........................................................................................My Program..................................................................................................................................%......................................................................................................................%....:M+...............9.6.5.9.6.9......h.u.b.e.r.t......C.:.\.U.s.e.r.s.\.h.u.b.e.r.t.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.M.y. .P.r.o.g.r.a.m................8.-.... .....D..................C.:.\.U.s.e.r.s.\.h.u.b.e.r.t.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.M.y. .P.r.o.g.r.a.m..b...C.:.\.U.s.e.r.s.\.h.u.b.e.r.t.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.S.t.a.r.t. .M.e.n.u.\.P.r.o.g.r.a.m.s.\.(.D.e.f.a.u.l.t.)......(.D.e.f.a.u.l.t.)......e.n.g.l.i.s.h.............................h........C.:.\.

C:\Users\user\AppData\Local\Programs\My Program\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3311677
Entropy (8bit):	6.5714241602852965
Encrypted:	false
SSDEEP:	49152:MdJYVM+9JtzZWnoS2VC23aun8+f5KuG2OY9IG9ivyv2cLx1RQL3330Y:uJYVM+LtVt3P/KuG2ONG9iqLRQL333f
MD5:	0CD7B69C1A41E8F5671DC1EF6044B567
SHA1:	8B393D9F344D02129433EA93EF8CA3E324A9A2BA
SHA-256:	6E543D5B3B0A1F76DAFFA72CE3E789FB14A19E0556EE7370F3788FE67FD68FC0
SHA-512:	2A97ABD15DEF952AA3EB3F51321B14B5B316F0CEECD5308C172A03845099358DE9AA80D0C8E1153E648C7889207DE12E2E190361DADFB8E0F8EE3A3D35684FF6
Malicious:	true
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f....................d..................@...........................3...........@......@...................P,.n.....,.j:...P0. .....................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc... ....P0......./.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Local\Temp\is-3O9NM.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp

Download File

Process:	C:\Users\user\Desktop\rHACNp6WFk.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3287552
Entropy (8bit):	6.584850058337391
Encrypted:	false
SSDEEP:	49152:0dJYVM+9JtzZWnoS2VC23aun8+f5KuG2OY9IG9ivyv2cLx1RQL3330T:WJYVM+LtVt3P/KuG2ONG9iqLRQL333y
MD5:	D318E73231E30E6B64517F61073B5AF3
SHA1:	B6F9500E965322ACC32A714BE68463DFD02B389C
SHA-256:	F18525A6444DAC6425191227CEB6023EBE1B02DB164BF627D173587A45576BA8
SHA-512:	84AAEC6EAB831E95E09DABA871329B4BB3B22B8CFEF39B4F96E4135EC1762DB396BCCC75B869EB736D10B0DBA0EC173DA6D905B1C8CABD1070B76C1FE0FDAD41
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f....................d..................@...........................3...........@......@...................P,.n.....,.j:...P0. .....................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc... ....P0......./.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\My Program.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Tue Nov 12 12:56:46 2024, mtime=Tue Nov 12 12:56:46 2024, atime=Sun Nov 10 04:07:02 2024, length=346112, window=hide
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	4.820102650418543
Encrypted:	false
SSDEEP:	24:8mYcHvDdDRyEZkI0r/qek00AySWpGQpGQHcbMKqygm:8mDHvDdDRyEZB0r/qeDFuGQpGQ1Hyg
MD5:	BA0F5F4EEF0E1044407FE3E3224B4EEE
SHA1:	2023BB00D3E4FC5957E99699A20E52704475AAC0
SHA-256:	029EE932A31B8D3E11B4B5680DDFDA4241F06EC589631B4FB7E7CFD1E5C7D523
SHA-512:	06FFBFA7CBF2AA3BB3B7D9519E2E5794281965EB7B0967878812F7F00B2743A19BB5CE64AA2DD2C065E6BECA63E6F7115F790BEC712A478E714E4124FBF8D009
Malicious:	false
Preview:	L..................F.... ...^.1..5....6..5..._.`.3...H......................(.:..DG..Yr?.D..U..k0.&...&.......y.Yd....Z...5...mQ..5......t...CFSF..1.....EW)B..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW)BlY.o..........................d...A.p.p.D.a.t.a...B.P.1.....lY.o..Local.<......EW)BlY.o..........................]..L.o.c.a.l.....Z.1.....lY.o..Programs..B......lY.olY.o.....).....................]..P.r.o.g.r.a.m.s.....^.1.....lY.o..MYPROG~1..F......lY.olY.o.....)......................A.M.y. .P.r.o.g.r.a.m.....b.2..H..jY.( .ttgtggt.exe.H......lY.olY.o.....)........................t.t.g.t.g.g.t...e.x.e.......l...............-.......k............r......C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe..4.....\.....\.....\.....\.....\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.M.y. .P.r.o.g.r.a.m.\.t.t.g.t.g.g.t...e.x.e.1.C.:.\.U.s.e.r.s.\.h.u.b.e.r.t.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.M.y. .P.r.o.g.r.a.m.........\|....I.J.H..K..:...`.......X.......965969......

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.996431388433169
TrID:	Win32 Executable (generic) a (10002005/4) 98.45% Inno Setup installer (109748/4) 1.08% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	rHACNp6WFk.exe
File size:	30'026'469 bytes
MD5:	e8257a3a7ba4046f50d7795afa5b90b9
SHA1:	26368c267e2545eaa34cd33898daa4d9e12ab159
SHA256:	f7d1d2548bed4be604171cd18e535106e4549d646afb585265fb27d09c0feb7a
SHA512:	c220fd861f3ac586e9436691506ce4fb6cfbbe4af52649f9fd3bdfeda86b5ab53973f8fd2f50e2ff955e7e2a23d1a400aa7f065b276af5641bac5e27cfd594d7
SSDEEP:	786432:1WLbcF8n4x1BtKXy7Gn54fytYESCn124Fg:kLbcFLqz54atYESCnQ4S
TLSH:	C1673323B2C7A03EE05D0B3B11B2B215A5FB79627827BD66D6F084ACDE254500D3EB57
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	0f0575e0c8713133

Static PE Info

General

Entrypoint:	0x4a83bc
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6690DABD [Fri Jul 12 07:26:53 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	40ab50289f7ef5fae60801f88d4541fc

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFA4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-3Ch], eax
mov dword ptr [ebp-40h], eax
mov dword ptr [ebp-5Ch], eax
mov dword ptr [ebp-30h], eax
mov dword ptr [ebp-38h], eax
mov dword ptr [ebp-34h], eax
mov dword ptr [ebp-2Ch], eax
mov dword ptr [ebp-28h], eax
mov dword ptr [ebp-14h], eax
mov eax, 004A2EBCh
call 00007FB9F8A62685h
xor eax, eax
push ebp
push 004A8AC1h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 004A8A7Bh
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [004B0634h]
call 00007FB9F8AF400Bh
call 00007FB9F8AF3B5Eh
lea edx, dword ptr [ebp-14h]
xor eax, eax
call 00007FB9F8AEE838h
mov edx, dword ptr [ebp-14h]
mov eax, 004B41F4h
call 00007FB9F8A5C733h
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [004B41F4h]
mov dl, 01h
mov eax, dword ptr [0049CD14h]
call 00007FB9F8AEFB63h
mov dword ptr [004B41F8h], eax
xor edx, edx
push ebp
push 004A8A27h
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007FB9F8AF4093h
mov dword ptr [004B4200h], eax
mov eax, dword ptr [004B4200h]
cmp dword ptr [eax+0Ch], 01h
jne 00007FB9F8AFAD7Ah
mov eax, dword ptr [004B4200h]
mov edx, 00000028h
call 00007FB9F8AF0458h
mov edx, dword ptr [004B4200h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xb7000	0x71	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb5000	0xfec	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xcb000	0x5184	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xba000	0x10fa8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xb9000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xb52d4	0x25c	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xb6000	0x1a4	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xa568c	0xa5800	b889d302f6fc48a904de33d8d947ae80	False	0.3620185045317221	data	6.377190161826806	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0xa7000	0x1b64	0x1c00	588dd0a8ab499300d3701cbd11b017d9	False	0.548828125	data	6.109264411030635	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xa9000	0x3838	0x3a00	5c0c76e77aef52ebc6702430837ccb6e	False	0.35338092672413796	data	4.95916338709992	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xad000	0x7258	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xb5000	0xfec	0x1000	627340dff539ef99048969aa4824fb2d	False	0.380615234375	data	5.020404933181373	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0xb6000	0x1a4	0x200	fd11c1109737963cc6cb7258063abfd6	False	0.34765625	data	2.729290535217263	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0xb7000	0x71	0x200	7de8ca0c7a61668a728fd3a88dc0942d	False	0.1796875	data	1.305578535725827	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0xb8000	0x18	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xb9000	0x5d	0x200	d84006640084dc9f74a07c2ff9c7d656	False	0.189453125	data	1.3892750148744617	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xba000	0x10fa8	0x11000	a85fda2741bd9417695daa5fc5a9d7a5	False	0.5789579503676471	data	6.709466460182023	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0xcb000	0x5184	0x5200	bdc81b14ae9fd6f8c0457dec57e5e445	False	0.5676448170731707	data	5.999241935326499	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xcb438	0x1c30	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.0015243902439024
RT_STRING	0xcd068	0x3f8	data			0.3198818897637795
RT_STRING	0xcd460	0x2dc	data			0.36475409836065575
RT_STRING	0xcd73c	0x430	data			0.40578358208955223
RT_STRING	0xcdb6c	0x44c	data			0.38636363636363635
RT_STRING	0xcdfb8	0x2d4	data			0.39226519337016574
RT_STRING	0xce28c	0xb8	data			0.6467391304347826
RT_STRING	0xce344	0x9c	data			0.6410256410256411
RT_STRING	0xce3e0	0x374	data			0.4230769230769231
RT_STRING	0xce754	0x398	data			0.3358695652173913
RT_STRING	0xceaec	0x368	data			0.3795871559633027
RT_STRING	0xcee54	0x2a4	data			0.4275147928994083
RT_RCDATA	0xcf0f8	0x10	data			1.5
RT_RCDATA	0xcf108	0x310	data			0.6173469387755102
RT_RCDATA	0xcf418	0x2c	data			1.1590909090909092
RT_GROUP_ICON	0xcf444	0x14	data	English	United States	1.2
RT_VERSION	0xcf458	0x584	data	English	United States	0.2563739376770538
RT_MANIFEST	0xcf9dc	0x7a8	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3377551020408163

Imports

DLL	Import
kernel32.dll	GetACP, GetExitCodeProcess, CloseHandle, LocalFree, SizeofResource, VirtualProtect, QueryPerformanceFrequency, VirtualFree, GetFullPathNameW, GetProcessHeap, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVolumeInformationW, GetVersion, GetDriveTypeW, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetCommandLineW, GetSystemInfo, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, LCMapStringW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
comctl32.dll	InitCommonControls
user32.dll	CreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
oleaut32.dll	SysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
advapi32.dll	ConvertStringSecurityDescriptorToSecurityDescriptorW, OpenThreadToken, AdjustTokenPrivileges, LookupPrivilegeValueW, RegOpenKeyExW, OpenProcessToken, FreeSid, AllocateAndInitializeSid, EqualSid, RegQueryValueExW, GetTokenInformation, ConvertSidToStringSidW, RegCloseKey

Exports

Name	Ordinal	Address
__dbk_fcall_wrapper	2	0x40fc10
dbkFCallWrapperAddr	1	0x4b063c

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-12T14:56:53.759174+0100	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	1	192.168.2.8	49705	4.251.123.83	6677	TCP
2024-11-12T14:56:54.275070+0100	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	4.251.123.83	6677	192.168.2.8	49705	TCP
2024-11-12T14:56:57.133259+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	172.202.163.200	443	192.168.2.8	49706	TCP
2024-11-12T14:57:35.309360+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	172.202.163.200	443	192.168.2.8	49712	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 12, 2024 14:56:52.822416067 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:52.827342987 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:52.827605963 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:52.832276106 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:52.837165117 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:53.650696039 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:53.698899031 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:53.759174109 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:53.765940905 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:53.996568918 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:54.035516977 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:54.040524960 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:54.274965048 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:54.275002956 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:54.275018930 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:54.275049925 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:54.275069952 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:54.275089025 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:54.275113106 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:54.275119066 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:54.275127888 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:54.275144100 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:54.275160074 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:54.275176048 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:54.275182962 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:54.275212049 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:54.275244951 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:54.275641918 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:54.275674105 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:54.275737047 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:54.280067921 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:54.323936939 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:54.391880035 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:54.391906023 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:54.391921043 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:54.391952038 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:54.391954899 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:54.391987085 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:54.392009020 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:54.392015934 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:54.392030001 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:54.392060995 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:54.433263063 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.251796007 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.256779909 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.256803036 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.256808996 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.256819010 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.256824970 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.256839037 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.256843090 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.256846905 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.256869078 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.256911039 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.256916046 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.256921053 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.256942034 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.256973028 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.256999016 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.261719942 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.261771917 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.261774063 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.261775970 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.261804104 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.261820078 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.261847019 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.261863947 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.261878014 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.261914968 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.261931896 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.261939049 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.261959076 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.261987925 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.262008905 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.262025118 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.262037039 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.262069941 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.262080908 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.262109995 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.262160063 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.267324924 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.267374992 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.267385960 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.267420053 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.267631054 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.267640114 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.267689943 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.267704010 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.267740965 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.267746925 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.267797947 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.267801046 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.267823935 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.267853975 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.267879963 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.267926931 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.267992973 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.268022060 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.268081903 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.268096924 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.268126965 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.268167019 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.268227100 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.268235922 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.268271923 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.268301964 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.268313885 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.268318892 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.268340111 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.268378973 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.268388987 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.268470049 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.268548012 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.268553972 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.268563986 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.268567085 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.268575907 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.268582106 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.268601894 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.268605947 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.268613100 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.268637896 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.268657923 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.268701077 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.268706083 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.268749952 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.272470951 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.272511005 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.272546053 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.272556067 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.272572041 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.272597075 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.272614002 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.272614956 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.272639990 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.272660971 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.272697926 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.272699118 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.272737026 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.272790909 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.272795916 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.272800922 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.272820950 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.272850037 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.272875071 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.272890091 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.272906065 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.273066998 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.273072004 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.273137093 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.273140907 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.273319006 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.273339033 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.273444891 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.273452044 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.273541927 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.273547888 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.273627043 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.273677111 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.273763895 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.273767948 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.273832083 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.273840904 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.273865938 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.273869991 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.273902893 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.273906946 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.273942947 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.273988008 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.273992062 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.274029970 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.274041891 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.274045944 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.274110079 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.274113894 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.274204016 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.274220943 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.274240017 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.274256945 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.274260998 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.274271011 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.274275064 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.274302006 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.274312019 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.274318933 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.274334908 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.274358988 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.274411917 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.274415970 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.274465084 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.274477959 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.274488926 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.274493933 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.274529934 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.274534941 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.274564981 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.274601936 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.274663925 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.274667978 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.274677038 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.274681091 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.274712086 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.274715900 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.274758101 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.274761915 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.277652979 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.277657032 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.277693033 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.277695894 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.277739048 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.277743101 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.277776957 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.277857065 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.277861118 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.277910948 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.277915001 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.277947903 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.277991056 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.277995110 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.278039932 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.278043985 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.278089046 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.278093100 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.278140068 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.278148890 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.278352976 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.278429031 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.279300928 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.279305935 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.279371023 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.279408932 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.279508114 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.279561996 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.279570103 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.279575109 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.279597998 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.279602051 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.279654026 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.279658079 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.279704094 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.279707909 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.279743910 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.279799938 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.279803991 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.279918909 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.279922962 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.279932022 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.279936075 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.279946089 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.279951096 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.279962063 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.280019999 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.280024052 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.280051947 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.280056000 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.280060053 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.280143023 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.280148029 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.280157089 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.280159950 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.280169964 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.280174017 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.280184031 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.280226946 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.280230999 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.280239105 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.280242920 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.280270100 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.280273914 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.280318975 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.280323029 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.280366898 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.280370951 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.280416965 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.280421019 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.280457973 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.280481100 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.280484915 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.280539989 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.280544043 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.283375978 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.283380032 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.283415079 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.283418894 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.283454895 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.283458948 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.283483028 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.283514023 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.283535004 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.283546925 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.283552885 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.283555984 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.283576965 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.283627987 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.283648014 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.283652067 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.283662081 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.283665895 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.283726931 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.283730984 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.283835888 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.283839941 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.283848047 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.283852100 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.283890963 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.283895016 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.283931017 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.283935070 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.284024954 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.284029007 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.284084082 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.284089088 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.284118891 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.284122944 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.284261942 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.284271955 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.284276009 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.284285069 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.284295082 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.284300089 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.284303904 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.284312963 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.284318924 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.284327030 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.284331083 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.284338951 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.284343004 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.284352064 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.284356117 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.284364939 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.284368992 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.284390926 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.284394979 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.284404039 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.284482956 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.288697004 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.288701057 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.288747072 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.288750887 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.288755894 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.288808107 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.288840055 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.288871050 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.288892984 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.288902044 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.288991928 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.288995981 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.289010048 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.289025068 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.289056063 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.289060116 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.289172888 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.289176941 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.289185047 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.289187908 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.289197922 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.289300919 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.289310932 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.289319038 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.289323092 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.289334059 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.289336920 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.289402962 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.289412975 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.289417982 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.289448977 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.289453983 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.289486885 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.289519072 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.289521933 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.289566040 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.289570093 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.289599895 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.289608002 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.289644957 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.289654016 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.289694071 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.289697886 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.289741993 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.289747000 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.289777994 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.289782047 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.289819002 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.289827108 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.289891958 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.289896011 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.289952993 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.289958000 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.289999008 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.290013075 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.294504881 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.294596910 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.294611931 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.294652939 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.294691086 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.294735909 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.294796944 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.294801950 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.294811964 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.294819117 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.294823885 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.294832945 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.294861078 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.294863939 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.294893980 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.294926882 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.294930935 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.295023918 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.295027971 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.295037031 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.295039892 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.295089960 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.295094013 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.295103073 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.295106888 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.295116901 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.295222044 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.295231104 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.295290947 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.295304060 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.295324087 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.295327902 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.295366049 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.295370102 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.295420885 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.295424938 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.295459986 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.295464039 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.295516014 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.295519114 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.295542002 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.295546055 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.295584917 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.295589924 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.295618057 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.295665979 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.295674086 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.295716047 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.295720100 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.295758963 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.295763016 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.295804977 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.295809984 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.295851946 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.295855999 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.299680948 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.299772978 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.299777985 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.299841881 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.299845934 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.299889088 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.299894094 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.299905062 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.299918890 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.299953938 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.299982071 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.299994946 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.299998999 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.300028086 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.300031900 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.300056934 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.300060987 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.300106049 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.300110102 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.300148964 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.300169945 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.300223112 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.300225973 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.300261021 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.300265074 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.300297976 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.300301075 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.300358057 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.300362110 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.300395966 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.300426006 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.300462008 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.300470114 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.300492048 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.300496101 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.342128992 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:58.342365026 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.342457056 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.342457056 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.342506886 CET	49705	6677	192.168.2.8	4.251.123.83
Nov 12, 2024 14:56:58.390114069 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:59.114747047 CET	6677	49705	4.251.123.83	192.168.2.8
Nov 12, 2024 14:56:59.160463095 CET	49705	6677	192.168.2.8	4.251.123.83

Target ID:	0
Start time:	08:56:36
Start date:	12/11/2024
Path:	C:\Users\user\Desktop\rHACNp6WFk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\rHACNp6WFk.exe"
Imagebase:	0xab0000
File size:	30'026'469 bytes
MD5 hash:	E8257A3A7BA4046F50D7795AFA5B90B9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:56:37
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp" /SL5="$10436,29074250,797184,C:\Users\user\Desktop\rHACNp6WFk.exe"
Imagebase:	0x2b0000
File size:	3'287'552 bytes
MD5 hash:	D318E73231E30E6B64517F61073B5AF3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:56:50
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe"
Imagebase:	0x100000
File size:	346'112 bytes
MD5 hash:	C9B68B9567CC9067794E32999C02BFA7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000004.00000000.1545790566.0000000000102000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000004.00000000.1545790566.0000000000102000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000004.00000002.1627199642.0000000002630000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.1627199642.000000000264D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	15.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	12
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFB4A21BD39 Relevance: 12.0, Strings: 7, Instructions: 3217
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0<*J, xrefs: 00007FFB4A21DAE8
C J, xrefs: 00007FFB4A21DFA8
xI J, xrefs: 00007FFB4A21D0F6
9*J, xrefs: 00007FFB4A21D661
C J, xrefs: 00007FFB4A21C9C0
P5*J, xrefs: 00007FFB4A21C474
E4_H, xrefs: 00007FFB4A21DECE

Memory Dump Source

Source File: 00000004.00000002.1656406266.00007FFB4A210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4a210000_ttgtggt.jbxd

Similarity

API ID:
String ID: 0<*J$E4_H$P5*J$xI J$9*J$C J$C J
API String ID: 0-1637708201
Opcode ID: 9eed08f4451450a9099fbfcf7e12a6bde55c4f0c21bd28b618caa3905c02c4e8
Instruction ID: 6fb55e987f2d4fd0a32095fa3cfd81fdd018522bc5838a3a4965a7ef15a90082
Opcode Fuzzy Hash: 9eed08f4451450a9099fbfcf7e12a6bde55c4f0c21bd28b618caa3905c02c4e8
Instruction Fuzzy Hash: 5153A770D19A2D8FDBA8EF18C895BA9B7B1FB68305F1041EA900DE3651CE356E81DF41

Function 00007FFB4A2118C9 Relevance: 4.7, Strings: 3, Instructions: 987
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

I, xrefs: 00007FFB4A21229F
I, xrefs: 00007FFB4A2126A0
@B/, xrefs: 00007FFB4A211C21

Memory Dump Source

Source File: 00000004.00000002.1656406266.00007FFB4A210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4a210000_ttgtggt.jbxd

Similarity

API ID:
String ID: @B/$I$I
API String ID: 0-565819723
Opcode ID: de43b20e9064803f84001a7cf76efdd5f2809f2e789378fe57c41933e821b5b9
Instruction ID: 3cd213489abfd2a60e33e50a45ed1ea26b043fde050bdfc04c50f9a68ae2d9fd
Opcode Fuzzy Hash: de43b20e9064803f84001a7cf76efdd5f2809f2e789378fe57c41933e821b5b9
Instruction Fuzzy Hash: 8082E9B0919A1D8FDBA9EF28C8957A8B7B5FF58300F5041F9D00DE7292DE356A81DB40

Function 00007FFB4A21C499 Relevance: 3.4, Strings: 2, Instructions: 928
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

xI J, xrefs: 00007FFB4A21D0F6
C J, xrefs: 00007FFB4A21C9C0

Memory Dump Source

Source File: 00000004.00000002.1656406266.00007FFB4A210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4a210000_ttgtggt.jbxd

Similarity

API ID:
String ID: xI J$C J
API String ID: 0-2807787609
Opcode ID: 576a001fdd26e797cb3927164214344da80fd9d4193e8aa7487bd86ad3e57cc1
Instruction ID: 9dddfc5194b4d34567db0bd9f98efdccf1e5a03328319e72438ab8efcf10a1b1
Opcode Fuzzy Hash: 576a001fdd26e797cb3927164214344da80fd9d4193e8aa7487bd86ad3e57cc1
Instruction Fuzzy Hash: F48287B4918A2D8FDBA9EF18C895BA9B7B1FB58305F5041EA900DE3251CF356E81DF40

Function 00007FFB4A0C9CE5 Relevance: 2.9, Instructions: 2918
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.1654496716.00007FFB4A0C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A0C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4a0c0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aeabda8dfa7e3c8221f4f4c11a0c963c3bf8468bc1109eb137a26b06680830c
Instruction ID: 3722adb12b63b5bf5a5f5c6a5ff8f3e58f4d091c561e45d140800f8e086670f4
Opcode Fuzzy Hash: 9aeabda8dfa7e3c8221f4f4c11a0c963c3bf8468bc1109eb137a26b06680830c
Instruction Fuzzy Hash: F713C271A1DA8A4FD799EF2CC855669BBE1FF99300B1405FEE08EC7293DD28AC418741

Function 00007FFB4A231309 Relevance: 1.3, Instructions: 1293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1656406266.00007FFB4A210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4a210000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61fb1d3c8d149c8398905193a83c2e52a5389c59af510b68fe67aa178435f46e
Instruction ID: 82b6e82bb1b53d4ef7ae5818c8286ede1ea9023b0c6d8b4b966ece06f54b3a2b
Opcode Fuzzy Hash: 61fb1d3c8d149c8398905193a83c2e52a5389c59af510b68fe67aa178435f46e
Instruction Fuzzy Hash: 0D92D3B1A0DA464FE798FF39C4552B4B7D1EF99300F2441BED48EC7292DE28A846D781

Function 00007FFB4A229F91 Relevance: 1.1, Instructions: 1141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1656406266.00007FFB4A210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4a210000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c983e54a7f2aaa90dbcdae9c5023ab363f0fdb6a5a7858188280afb6cc0a477
Instruction ID: bacb0f759df1a88ebd3a1e769dd391c4c4fac74829488990f3a639a9179945f8
Opcode Fuzzy Hash: 9c983e54a7f2aaa90dbcdae9c5023ab363f0fdb6a5a7858188280afb6cc0a477
Instruction Fuzzy Hash: 8D8290B1A1CA4A8FDB99EF28C491AA9B7E1FF58300F5005BDD04AC7692DE34F845DB41

Function 00007FFB4A0C16B3 Relevance: 1.0, Instructions: 1002COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1654496716.00007FFB4A0C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A0C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4a0c0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bb0ba9337b3b1388ca3b526d1e656c45ce351f7e79ff67d496f320d74407820
Instruction ID: 8a5238fcfb6b35ddca6bb18a0e6ec18e78d86f3c6ed227e0222c8c102d10c302
Opcode Fuzzy Hash: 1bb0ba9337b3b1388ca3b526d1e656c45ce351f7e79ff67d496f320d74407820
Instruction Fuzzy Hash: ED52D260A0DA4A4FE799EF2CD8556747BD6EF9A310B1402FBD44EC72E3DD18AC428781

Function 00007FFB4A21F5CD Relevance: 1.0, Instructions: 1000COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1656406266.00007FFB4A210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4a210000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea79c6305fcbe236e2437ff5602cd14bd843edd51bd1f30a9d9e47f84bb6ffbe
Instruction ID: a26697e4875bc99f349ec4c0474e5931849402f8fd026534400725de6f61c682
Opcode Fuzzy Hash: ea79c6305fcbe236e2437ff5602cd14bd843edd51bd1f30a9d9e47f84bb6ffbe
Instruction Fuzzy Hash: 76527D71A1CA0A8FEB58FF2CD455A7577D2FF58300B6401BAE45EC72A2DE24EC429781

Function 00007FFB4A220275 Relevance: .8, Instructions: 849COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1656406266.00007FFB4A210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4a210000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12ef5c62403b179d50d883f449da7f327b72bef447def6998b751ba467ef2bf5
Instruction ID: 2b8427d959acfd0c50bf6677da9c8f28bba491b660a520feaee3cebdf8612462
Opcode Fuzzy Hash: 12ef5c62403b179d50d883f449da7f327b72bef447def6998b751ba467ef2bf5
Instruction Fuzzy Hash: 5C527571A1CA4A8FEBA8FF28C495BA5B7E1FF58300F5441A9D44DD7292CE34AC81DB41

Function 00007FFB4A0CC50A Relevance: .7, Instructions: 746COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1654496716.00007FFB4A0C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A0C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4a0c0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b1964b8d053360863dd024628fb51a291b6e8fea74edc12f013e77ca5233844
Instruction ID: f8bd3409a0660293786a569cf19065e92a532c73db032974179cff1e6480d750
Opcode Fuzzy Hash: 5b1964b8d053360863dd024628fb51a291b6e8fea74edc12f013e77ca5233844
Instruction Fuzzy Hash: DD22A1B1A1DA4A4FE798EF2CC499668B7D1FF59700B1501FED44EC72A3DE28AC418741

Function 00007FFB4A23070D Relevance: .7, Instructions: 731COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1656406266.00007FFB4A210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4a210000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24257c993d4db8c4e4fafa4b36b062cbb5d464ebaed1c351c460a9dc7dcd5133
Instruction ID: 5e696fbcdd91ed037d506140f612fe27ae1202d03dd5824c219cddd039923fe8
Opcode Fuzzy Hash: 24257c993d4db8c4e4fafa4b36b062cbb5d464ebaed1c351c460a9dc7dcd5133
Instruction Fuzzy Hash: 43325E71A1CA4A8FEB98FF28C455AA9B7E1FF59300F2041B9D44AC7296DE35EC41D780

Function 00007FFB49FF0DF5 Relevance: 2.8, Strings: 2, Instructions: 313
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XeI, xrefs: 00007FFB49FF176E
XeI, xrefs: 00007FFB49FF0ED7

Memory Dump Source

Source File: 00000004.00000002.1653586020.00007FFB49FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb49ff0000_ttgtggt.jbxd

Similarity

API ID:
String ID: XeI$XeI
API String ID: 0-1011707637
Opcode ID: 601ddd6a616b30e229f9102a7758e3a02a4ce9ce22cb21136f11f86edad9d37a
Instruction ID: b14c6c4d7e143cf713def34813dc61686211d363c51c70a3893176b687ae7bcf
Opcode Fuzzy Hash: 601ddd6a616b30e229f9102a7758e3a02a4ce9ce22cb21136f11f86edad9d37a
Instruction Fuzzy Hash: 6AC1C971A09A1D8FDB95EF18C899BA8B7B5FB58300F1441EAD40DE7295DA30AE81CF40

Function 00007FFB4A214977 Relevance: 1.7, APIs: 1, Instructions: 195
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00007FFB4A214AEF

Memory Dump Source

Source File: 00000004.00000002.1656406266.00007FFB4A210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4a210000_ttgtggt.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 757322d8699815aa2996f21df4776cd3dcb7fc711a1d3a5612cf85b38a9ab054
Instruction ID: 1c674e2de855a39c2feabb38837a3487022e7ed7c48765da0b86ceef97b507b4
Opcode Fuzzy Hash: 757322d8699815aa2996f21df4776cd3dcb7fc711a1d3a5612cf85b38a9ab054
Instruction Fuzzy Hash: 23517470918B8D8FDB68EF2CC8557E97BD1FB58310F14426AE84DC3252DA74E9418BC2

Function 00007FFB4A21575D Relevance: 1.7, APIs: 1, Instructions: 166
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE ref: 00007FFB4A21586A

Memory Dump Source

Source File: 00000004.00000002.1656406266.00007FFB4A210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4a210000_ttgtggt.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: e4a5c2bd858510cb3e3f39ae8b7b76da767097901f46e021b8b58172dbd1d3ed
Instruction ID: aa3959ba74bf968c133be51d0544166ca313079b795cae1e56bdf4c12e7108ce
Opcode Fuzzy Hash: e4a5c2bd858510cb3e3f39ae8b7b76da767097901f46e021b8b58172dbd1d3ed
Instruction Fuzzy Hash: DA51B07190CB1D8FDB58EF68D8456EDBBF1FB99310F0482AAD44DD7246CA34A845CB81

Function 00007FFB4A213113 Relevance: 1.7, APIs: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.1656406266.00007FFB4A210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4a210000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 948ed990f2e15492f2280fa5a0e9f7efa2245578fef42d7ab1aaa5041888db8e
Instruction ID: 0aecf088bdbee6da335af10a579c6a1d8317e5a2059b73537b21d8963134fc73
Opcode Fuzzy Hash: 948ed990f2e15492f2280fa5a0e9f7efa2245578fef42d7ab1aaa5041888db8e
Instruction Fuzzy Hash: 7A41787194CA4C4FDB19AF78AC065FABBE4EB42321F0402BFD04DC3182DE696956C791

Function 00007FFB4A213145 Relevance: 1.7, APIs: 1, Instructions: 157
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateCompatibleBitmap.GDI32 ref: 00007FFB4A21322A

Memory Dump Source

Source File: 00000004.00000002.1656406266.00007FFB4A210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4a210000_ttgtggt.jbxd

Similarity

API ID: BitmapCompatibleCreate
String ID:
API String ID: 1901715728-0
Opcode ID: 43cd50636387e84d24924ec913d1d9ff49501ee03a215ff5247fb813008c4772
Instruction ID: 3928727ad870a2b9a9267ca8064acba99bafbc4cda3340ba195ae757ed499439
Opcode Fuzzy Hash: 43cd50636387e84d24924ec913d1d9ff49501ee03a215ff5247fb813008c4772
Instruction Fuzzy Hash: 5741797184D6885FD71AAB78AC175F6BFE4EB42321F0442AFD089C3593C96D2443C791

Function 00007FFB4A216259 Relevance: 1.6, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

DeleteDC.GDI32 ref: 00007FFB4A2162E7

Memory Dump Source

Source File: 00000004.00000002.1656406266.00007FFB4A210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4a210000_ttgtggt.jbxd

Similarity

API ID: Delete
String ID:
API String ID: 1035893169-0
Opcode ID: 38295b6965bbafd09b9e32e72ab0d232cb1ac4fd277a75a34fdd09a55cf186f2
Instruction ID: 0061d14e2768bba913b2207054f1d89e41c3a5642cb3bfc4e88765148de0d4da
Opcode Fuzzy Hash: 38295b6965bbafd09b9e32e72ab0d232cb1ac4fd277a75a34fdd09a55cf186f2
Instruction Fuzzy Hash: 3521457190CA0C8FDB59EF68C44A6FDBBE0EF95321F04416FD449C7152CA749806CB81

Function 00007FFB49FF0F4F Relevance: 1.6, Strings: 1, Instructions: 316COMMON

Download Yara Rule

Strings

XeI, xrefs: 00007FFB49FF176E

Memory Dump Source

Source File: 00000004.00000002.1653586020.00007FFB49FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb49ff0000_ttgtggt.jbxd

Similarity

API ID:
String ID: XeI
API String ID: 0-515379846
Opcode ID: f580ef031724dccc55ea1c1e61289e44aee15f44a222a6fa43332db78e2286b3
Instruction ID: 621a6e58a983ce7f1281c3111e1f7ad6ea127b2913daad9cd5460237def87389
Opcode Fuzzy Hash: f580ef031724dccc55ea1c1e61289e44aee15f44a222a6fa43332db78e2286b3
Instruction Fuzzy Hash: B3D16270A09A1D8FDBA4EF18C898BA8B7F1FF58301F1441E9950DE7265CA30AE81CF40

Function 00007FFB49FF1EDE Relevance: 1.5, Strings: 1, Instructions: 297COMMON

Download Yara Rule

Strings

XeI, xrefs: 00007FFB49FF176E

Memory Dump Source

Source File: 00000004.00000002.1653586020.00007FFB49FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb49ff0000_ttgtggt.jbxd

Similarity

API ID:
String ID: XeI
API String ID: 0-515379846
Opcode ID: 1e2f6d7155f1986710c6cc097de91d4513a5a879ffccdb43004fcb396e1ed489
Instruction ID: cefbdc82e63df8793eb88c74bd673d70c7c3eddfdec44df1313da7e135944c5c
Opcode Fuzzy Hash: 1e2f6d7155f1986710c6cc097de91d4513a5a879ffccdb43004fcb396e1ed489
Instruction Fuzzy Hash: 65B1F871A09A1E8FDBA9EF28C895BA877B5EF58300F1001E9D40DD7695DB34AE85CF40

Function 00007FFB4A0CBDAC Relevance: 1.5, Strings: 1, Instructions: 286COMMON

Download Yara Rule

Strings

~>_H, xrefs: 00007FFB4A0CBE64

Memory Dump Source

Source File: 00000004.00000002.1654496716.00007FFB4A0C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A0C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4a0c0000_ttgtggt.jbxd

Similarity

API ID:
String ID: ~>_H
API String ID: 0-3245688848
Opcode ID: 506fe10939369aeeb2bc9bd4a99db1a35e715bdca1c5ab52dd1569159d24a078
Instruction ID: 903c106f6c171a3550aab31819083642f974f6d3d71f4db3ef70710202f57744
Opcode Fuzzy Hash: 506fe10939369aeeb2bc9bd4a99db1a35e715bdca1c5ab52dd1569159d24a078
Instruction Fuzzy Hash: 0771F57170CA494FD798EF2CD465A657BE1EBAA710B1501EFE48AC73A3DD24DC028781

Function 00007FFB49FF15AE Relevance: 1.5, Strings: 1, Instructions: 262COMMON

Download Yara Rule

Strings

XeI, xrefs: 00007FFB49FF176E

Memory Dump Source

Source File: 00000004.00000002.1653586020.00007FFB49FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb49ff0000_ttgtggt.jbxd

Similarity

API ID:
String ID: XeI
API String ID: 0-515379846
Opcode ID: 0d277a8bc58d8e5caf270dd84c738741ad9061d8c8a2a183572abe2a4a6c22bb
Instruction ID: e6a2a2226ebc44c0038e1f62eda7ced21898f82d9f9d8a00a39149f6e6d18366
Opcode Fuzzy Hash: 0d277a8bc58d8e5caf270dd84c738741ad9061d8c8a2a183572abe2a4a6c22bb
Instruction Fuzzy Hash: 4DB17571A09A198FDBA9EF58C895BA8B7B5FF59300F5001E9D40DE7295CB34AE81CF40

Function 00007FFB4A0CD968 Relevance: 1.5, Strings: 1, Instructions: 252COMMON

Download Yara Rule

Strings

, xrefs: 00007FFB4A0CDAE2

Memory Dump Source

Source File: 00000004.00000002.1654496716.00007FFB4A0C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A0C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4a0c0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 4a46e408d9b78f18db95726ea78d5bc36a58401ab2285667102b4a380bd4ccb8
Instruction ID: 6ddd05456750b1e61c5ccb8ddf3bed0ef8cd5a149424c35b4dfe2d858fed4891
Opcode Fuzzy Hash: 4a46e408d9b78f18db95726ea78d5bc36a58401ab2285667102b4a380bd4ccb8
Instruction Fuzzy Hash: 3A61E1B170CA4A4FEB98EF2CD455A6577D2EB99710B1501BFE08AC33A2DD24EC428781

Function 00007FFB49FF1F71 Relevance: 1.5, Strings: 1, Instructions: 218COMMON

Download Yara Rule

Strings

XeI, xrefs: 00007FFB49FF176E

Memory Dump Source

Source File: 00000004.00000002.1653586020.00007FFB49FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb49ff0000_ttgtggt.jbxd

Similarity

API ID:
String ID: XeI
API String ID: 0-515379846
Opcode ID: 62a870f64de752f5c0a051179c5f6222a0c804e5fd56f2487153f733f9381c56
Instruction ID: 4c61eef31960f18108f27bccf29a40ac44a24cb0fd595050c5870a00f3f2cb60
Opcode Fuzzy Hash: 62a870f64de752f5c0a051179c5f6222a0c804e5fd56f2487153f733f9381c56
Instruction Fuzzy Hash: 67917770A09A198FDBA9EF18C894BA8B7B5FB59301F1001E9D00DE7255CB74AE81CF40

Function 00007FFB49FF1E4F Relevance: 1.5, Strings: 1, Instructions: 206COMMON

Download Yara Rule

Strings

XeI, xrefs: 00007FFB49FF176E

Memory Dump Source

Source File: 00000004.00000002.1653586020.00007FFB49FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb49ff0000_ttgtggt.jbxd

Similarity

API ID:
String ID: XeI
API String ID: 0-515379846
Opcode ID: be7d901e23e87a1c4ee193aa167127fad4584b573b12d219b745fca547b25449
Instruction ID: f1b6f8ea2c49386f70761e7b20148065938f2fd92973c7cde1e6e8a6af87862d
Opcode Fuzzy Hash: be7d901e23e87a1c4ee193aa167127fad4584b573b12d219b745fca547b25449
Instruction Fuzzy Hash: 4281A771A09A198FDBA9EF18C895BA8B7F5EF59301F1001E9D40DE7295DB34AE81CF40

Function 00007FFB49FF30DD Relevance: 1.4, Strings: 1, Instructions: 154COMMON

Download Yara Rule

Strings

HJ, xrefs: 00007FFB49FF31A1

Memory Dump Source

Source File: 00000004.00000002.1653586020.00007FFB49FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb49ff0000_ttgtggt.jbxd

Similarity

API ID:
String ID: HJ
API String ID: 0-303943369
Opcode ID: 00f867a61cce72071919b49870e735e8a03bf827501a338673b1a652d83ca5a8
Instruction ID: b6e223d1adfe2d1ab39bee3aa0c0d55001c393f08fa534c600a4329760c7d972
Opcode Fuzzy Hash: 00f867a61cce72071919b49870e735e8a03bf827501a338673b1a652d83ca5a8
Instruction Fuzzy Hash: B541EA62E0E6974BE752BFBCE8960E97BA0EF42365B0841B7D088C90D7DD582849C391

Function 00007FFB49FF2CDD Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

XgI, xrefs: 00007FFB49FF2CF9

Memory Dump Source

Source File: 00000004.00000002.1653586020.00007FFB49FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb49ff0000_ttgtggt.jbxd

Similarity

API ID:
String ID: XgI
API String ID: 0-1685602790
Opcode ID: 7dc0c576501b1541b65089624cd9e8ab3c3df1e3a53bca9cfd3d3677e9ef3915
Instruction ID: 519244e44e7834ee99d5db473349522f4e6a045502f63d3b91147626ac822ed1
Opcode Fuzzy Hash: 7dc0c576501b1541b65089624cd9e8ab3c3df1e3a53bca9cfd3d3677e9ef3915
Instruction Fuzzy Hash: 88319FB180DA8E9FEB56EFB8C9991EDBFA0FF55300F4400EAD448C71D6DA25A944C741

Function 00007FFB49FF3299 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1653586020.00007FFB49FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb49ff0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7197aba86f8d1f37119216e5289fb5015d1f37160f8189dccf4c35f1ba5c6a10
Instruction ID: a7d52773e5d9f20f0f7ff8f515d5bc6304385a597c26df947603c96bd99cd247
Opcode Fuzzy Hash: 7197aba86f8d1f37119216e5289fb5015d1f37160f8189dccf4c35f1ba5c6a10
Instruction Fuzzy Hash: 0CC13CB1D0C65A8FEB99EF68C8557A8B7B1FF58300F5441BAD00DE3286DE746985CB40

Function 00007FFB4A0CBFFD Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1654496716.00007FFB4A0C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A0C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4a0c0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 293db029c0ffc10f1a000e30e95b5d8fcf150ed6ac2d828aec3826b6c60bd1b5
Instruction ID: f7d24029c681db4174d7c171fc7655d30a76bc01f45e66db8fee2b75796c2f44
Opcode Fuzzy Hash: 293db029c0ffc10f1a000e30e95b5d8fcf150ed6ac2d828aec3826b6c60bd1b5
Instruction Fuzzy Hash: 3291E5A2A0DBC60FE39AAF3CC8955647BE5EF66210B1901FFD489C72A3D9189C45C352

Function 00007FFB4A0C22EB Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1654496716.00007FFB4A0C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A0C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4a0c0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6efbe4dd5e8cbb9f683e4af7ef0c25a86c7335c5023fdfde9df7a7dc2c34be4
Instruction ID: b6531f425b31a334bfe4e0d21657456462e2f80958fc293eaefe3ccbdf48fc24
Opcode Fuzzy Hash: f6efbe4dd5e8cbb9f683e4af7ef0c25a86c7335c5023fdfde9df7a7dc2c34be4
Instruction Fuzzy Hash: 6981E4A0A0DA4A4FE799EE2CD8556753BD5EB9A310F1401FBD44DCB6E3DD28AC428381

Function 00007FFB4A0CD1F9 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1654496716.00007FFB4A0C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A0C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4a0c0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 280c0ed51cee7d8a80617facddb48c5d49d951e192065d33df833ac5384782c4
Instruction ID: 2e3010994985ca59c5f690558be32a4210a0e6bce9ea0de7ba87acb90a940206
Opcode Fuzzy Hash: 280c0ed51cee7d8a80617facddb48c5d49d951e192065d33df833ac5384782c4
Instruction Fuzzy Hash: 2D71D97170CA494FE799DF2CD8669647BE1EFA931071901EFE489C72A7DD14AC02C781

Function 00007FFB49FF2FF0 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1653586020.00007FFB49FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb49ff0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5439bcbe03d39f3b5ca43d63ea38b2991701c7c4d3b280f7d71015994de8e26c
Instruction ID: 074d37fcf3d43e632fcecdcc70fd2b5f437ad54a2ddafcd9897cc5ce408cd18d
Opcode Fuzzy Hash: 5439bcbe03d39f3b5ca43d63ea38b2991701c7c4d3b280f7d71015994de8e26c
Instruction Fuzzy Hash: 8991C3B2A0CA5A4FDB58DF68C9556BD7BE1EF98304F14027BD04DE32CAEE246901C751

Function 00007FFB49FF251D Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1653586020.00007FFB49FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb49ff0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b71bf3941252550fd60539f6e7fd9407b122333ec8d35c88e028db2b616df82
Instruction ID: 8efd1a35a25031e94928dbb59a80ae8edfdeaf1e973fd5cce72179332634e06a
Opcode Fuzzy Hash: 6b71bf3941252550fd60539f6e7fd9407b122333ec8d35c88e028db2b616df82
Instruction Fuzzy Hash: B681F9A290E6875AF762BFBCE8661E97F90EF41325B0841BBD48CC54D3DC193859C392

Function 00007FFB49FF2E90 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1653586020.00007FFB49FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb49ff0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cb5fb08c96b8379102e16d1ebd17c8f2559a6e6bd9ca617c76e737fbf7cf918
Instruction ID: 13cb4317bd63ca57d4f743e71f51f93946e1f53db286e74bc4b5f9fdab514618
Opcode Fuzzy Hash: 4cb5fb08c96b8379102e16d1ebd17c8f2559a6e6bd9ca617c76e737fbf7cf918
Instruction Fuzzy Hash: 9B91E570A1891E8FDB94EF68C495BAC77F1FF58301F5401AAD40DE7296DE35A881CB40

Function 00007FFB4A0CC2A0 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1654496716.00007FFB4A0C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A0C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4a0c0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 082d19d3bb1f6012ce2810b1a128def9d9507fcf1d6bd134c15395be8a8d456a
Instruction ID: 042dd55e6fe0c920328b6f86bf991c5defa993b4d17be965ff84d424a284f171
Opcode Fuzzy Hash: 082d19d3bb1f6012ce2810b1a128def9d9507fcf1d6bd134c15395be8a8d456a
Instruction Fuzzy Hash: A55106B170CE494FD798EF2CD855A757BD2EB99710B5401EFE48AC3292DD24EC028781

Function 00007FFB49FF2F0D Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1653586020.00007FFB49FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb49ff0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f06a2cf52e4310bebf317b1a678c526bf81c81b3e0372de5c27d9b50e867a9a
Instruction ID: bc7342921892919d1b6e38a483e4adc7329e3db3ae39da035fb5fcad59dd5bf3
Opcode Fuzzy Hash: 0f06a2cf52e4310bebf317b1a678c526bf81c81b3e0372de5c27d9b50e867a9a
Instruction Fuzzy Hash: 9B515B71918A5E8FDB85EF68C8456EEBBF0FF58315F0001BAE409D3292DA34A844CB81

Function 00007FFB4A0C031D Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1654496716.00007FFB4A0C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A0C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4a0c0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95a801cfed4f1cb3b608e8b982da4a49f34a2f6be4f0a2a34088898fe4b56182
Instruction ID: 96b5e699b0273651e9ad330606c113e903baa87b9a1cda479fc49690e3c3b7c3
Opcode Fuzzy Hash: 95a801cfed4f1cb3b608e8b982da4a49f34a2f6be4f0a2a34088898fe4b56182
Instruction Fuzzy Hash: DC41266160EA854FE75AAF2CDC695757FE5EF96320B1902FBD049C72E3C918AC06C381

Function 00007FFB49FF0A52 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1653586020.00007FFB49FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb49ff0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee7d513317190e4e48843d6f7c77127780959c4eda78b90accbf91c0f21936bf
Instruction ID: 6dca37487a48bea378d4f0d132786a87c964a028adb06316b7f6337ac57af873
Opcode Fuzzy Hash: ee7d513317190e4e48843d6f7c77127780959c4eda78b90accbf91c0f21936bf
Instruction Fuzzy Hash: 2741A1B0918A4D8FE789DF68C8AA3A87FE0FB99310F90016EC108D77D9DB752914CB50

Function 00007FFB49FF30D0 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1653586020.00007FFB49FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb49ff0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eb2ac123ab9277e0cabe682996d8b161d936ce4bb1886b5bd6b88dc815a1347
Instruction ID: 6fb6a0154cd86baf2d58cf8dca6ca513974dd9dd94a22abf1723fb03d1a5b9bd
Opcode Fuzzy Hash: 9eb2ac123ab9277e0cabe682996d8b161d936ce4bb1886b5bd6b88dc815a1347
Instruction Fuzzy Hash: 3021B1B2E08A5E8FDB54DF6CC9452AD7BE2EBD8300F14426BD40DE3289EA3469018791

Function 00007FFB49FF334B Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1653586020.00007FFB49FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb49ff0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e551b22b4a87cb315635cabe92d15ec7311356358a42a3f32d5b0670624ea9b2
Instruction ID: b0131d736908d1ab681b42fb0d2f4f064eb0f8e0500fe961444f5c97d6283458
Opcode Fuzzy Hash: e551b22b4a87cb315635cabe92d15ec7311356358a42a3f32d5b0670624ea9b2
Instruction Fuzzy Hash: E221F9B1D1D51E8EDBA8EE68D9557ECB7A1FB58340F4040BAD04DE22C5CE756984CF40

Function 00007FFB49FF275A Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1653586020.00007FFB49FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb49ff0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8731107d49b127aadedad8764996ae26f7ec8ee7495762c2e4bb5a968f4ba50e
Instruction ID: dee68519e5975ebf56d1353b22719742ff67170096c171684e71220a322d3ee3
Opcode Fuzzy Hash: 8731107d49b127aadedad8764996ae26f7ec8ee7495762c2e4bb5a968f4ba50e
Instruction Fuzzy Hash: 7321D3B190D68F8FEB84FF78C8666E9BB90FF54300F4405BAD409C21C7DD2468948741

Function 00007FFB4A0C06E0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1654496716.00007FFB4A0C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A0C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4a0c0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24fa099595f3297d2e2cb3ee19894705f243c72e2a54b5a46e76e0cae78a6847
Instruction ID: e68faf387c3416096be736202c8290e57f577be7387e1c6570c5de21d9d70f2d
Opcode Fuzzy Hash: 24fa099595f3297d2e2cb3ee19894705f243c72e2a54b5a46e76e0cae78a6847
Instruction Fuzzy Hash: 1911E4A2A1DA965BF799AE28C5951283BD1EF98710B2802FED08CC72E2CD299C01C701

Function 00007FFB4A0C04FD Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1654496716.00007FFB4A0C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A0C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4a0c0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 396f59d84b98c2e3a1ecb133b3b3d7b7e0d4afb3b35f6b3a66d391e28a2c10c5
Instruction ID: 41656f6abc779b7000dbdf37fe54746bfbe4da373aaa4772bab93d2701f4f46d
Opcode Fuzzy Hash: 396f59d84b98c2e3a1ecb133b3b3d7b7e0d4afb3b35f6b3a66d391e28a2c10c5
Instruction Fuzzy Hash: 8711DFA1A0DA865FE39AEF2C84A52257BD1EF99310B2801FED04DC73A2CD289C41C302

Function 00007FFB4A0C2119 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1654496716.00007FFB4A0C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A0C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4a0c0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c95d2182894a0633d0a567fc8295cdce572f14ad5b879a00eeb5ea34e749088
Instruction ID: 980f7ed79259f61260c592bd27ec80b5bdc05998c75fda18ac21292d8a9d8c3f
Opcode Fuzzy Hash: 9c95d2182894a0633d0a567fc8295cdce572f14ad5b879a00eeb5ea34e749088
Instruction Fuzzy Hash: B01175B190DA875FE399FE2C849553577D2EFA9310B1400BFD44DCB293DD295C418701

Function 00007FFB49FF0D01 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1653586020.00007FFB49FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb49ff0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d1f94519352ea7f597dbe071bddf13a0a0bafe45838a46fbb2587832e861a5b
Instruction ID: 8c1da71ce9826e68004f4bb507ea4792ca8d42e024b3ca177ff106df6e848a4e
Opcode Fuzzy Hash: 4d1f94519352ea7f597dbe071bddf13a0a0bafe45838a46fbb2587832e861a5b
Instruction Fuzzy Hash: CA0184E2C1D54AAFE796BF74C9562BCBB91EF54700F4401FBDA08C64D3DD2839448641

Function 00007FFB4A0C07CE Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1654496716.00007FFB4A0C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A0C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4a0c0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1596233037f1b2ab43387293bb6a4cdd70e479dd2a8e5412d705fac4d60e86eb
Instruction ID: 73bc599ee87bcd58a1a7feb59f5087cdf00bfab5ba4f76e3420570cd02d4c85c
Opcode Fuzzy Hash: 1596233037f1b2ab43387293bb6a4cdd70e479dd2a8e5412d705fac4d60e86eb
Instruction Fuzzy Hash: 2811A57060D9868FEBA9EF2CC994A247BE5EF55300B6841EEE04DC72D2CE18AC45C781

Function 00007FFB49FF0850 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1653586020.00007FFB49FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb49ff0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79b5140dd8d70393af6ad2e704315a7de48eacf67fab5dabca08a76996672805
Instruction ID: ee3c6ab88e7535e9ea077244d077bdef57c406f1f7238750f5e5f6254efe2316
Opcode Fuzzy Hash: 79b5140dd8d70393af6ad2e704315a7de48eacf67fab5dabca08a76996672805
Instruction Fuzzy Hash: B301869390E59786EB227FBCE9521F53B90EF83224F4D01B3E988890C7DC197426C296

Function 00007FFB49FF3775 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1653586020.00007FFB49FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb49ff0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 785d70bde60b62ec3499a2160dd3e4e43bb966662ade20bc4e7dc9726f26a519
Instruction ID: 9a071a664ec0f745c5636f857e3a3a86ffb9a88a2fa042f5d9ff4b92c8ed1c86
Opcode Fuzzy Hash: 785d70bde60b62ec3499a2160dd3e4e43bb966662ade20bc4e7dc9726f26a519
Instruction Fuzzy Hash: 1D014C71808A4D8FDF84EF68C858AAA7BF0FF68300F0005AAD418C72A1D7709554CB81

Function 00007FFB49FF2EE0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1653586020.00007FFB49FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb49ff0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a282cb300ef9c510a0636cfbb927f4403b320ec4be0518f4767b22cacfe260ed
Instruction ID: 702ea39d87c370afaede5e09761c2fdcb82ead011913126864c87f05c593fc9f
Opcode Fuzzy Hash: a282cb300ef9c510a0636cfbb927f4403b320ec4be0518f4767b22cacfe260ed
Instruction Fuzzy Hash: 4101DA70918A0D9FDF84EF68C849AEE7BF0FB68305F10056AE81DD3250DB71A590CB80

Function 00007FFB49FF2FA8 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1653586020.00007FFB49FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb49ff0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea80365ab8b79c856716bf70937de0ae504b3973363983c7700fb99ba564c7a3
Instruction ID: dd9c5820b605b2ebaf857e8b1567fb3dc627994f7454d9b732ed464bc301045f
Opcode Fuzzy Hash: ea80365ab8b79c856716bf70937de0ae504b3973363983c7700fb99ba564c7a3
Instruction Fuzzy Hash: D8018870958A4E9FDF84EF68C849AEA7BF0FB68305F10056AA81DD3254DB34A594CB81

Function 00007FFB49FF2F08 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1653586020.00007FFB49FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb49ff0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89bd98ca30059461bd649aa8536588732d98728b136068c8739f43687654a152
Instruction ID: 7c6162509c0eefe695fc55c670754dcb2c6c5d0eb8935aa944b6b4e8a9a6063a
Opcode Fuzzy Hash: 89bd98ca30059461bd649aa8536588732d98728b136068c8739f43687654a152
Instruction Fuzzy Hash: 41016B7091491E9FDF85EF68C448AAE7BF0FB68305F10456AE41DD3294DB71A694CB80

Function 00007FFB49FF21F9 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1653586020.00007FFB49FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb49ff0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7342a59e936fb94370628a887c98109b7be79e66342b1033a3528898d62ca96b
Instruction ID: 010ab6ebc6c25e0a9ce8edb4dd45e740b279e8020a2dcbbce9d44975345362a0
Opcode Fuzzy Hash: 7342a59e936fb94370628a887c98109b7be79e66342b1033a3528898d62ca96b
Instruction Fuzzy Hash: FE01087090968D8FDB85EF68C8596A97BB0FF1A300F0505EAD418CB2A2DB75A944CB01

Function 00007FFB49FF0D99 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1653586020.00007FFB49FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb49ff0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b520d97aadfbdb5fc7395485a5730392cb726e33f9bce58c5a9f53520a647ea
Instruction ID: bd904ac20fdc87548597374a2a604b6edce0b567a0670a9b4188c61b6fadb98b
Opcode Fuzzy Hash: 8b520d97aadfbdb5fc7395485a5730392cb726e33f9bce58c5a9f53520a647ea
Instruction Fuzzy Hash: 14F0C2B290E78E5FE752AF74C8591E87FA0EF56210F4800FBD948C60D3EA2824488301

Function 00007FFB49FF2D70 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1653586020.00007FFB49FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb49ff0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 839ab63d8fbb0621e9cc3a76cf7e51656bb670f1730475eeef967260f32f3112
Instruction ID: 529ffb0cc1767c2cf89dd2dcd129750f01faf84e1a633488497b3b4d8ca6a5be
Opcode Fuzzy Hash: 839ab63d8fbb0621e9cc3a76cf7e51656bb670f1730475eeef967260f32f3112
Instruction Fuzzy Hash: EEF0F830914A4D9FDF84EFA8C488AE9BBB0FB68305F4041AAE40DC3190DB31A694CB40

Function 00007FFB49FFC740 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1653586020.00007FFB49FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb49ff0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa3cbff7554342d5645ca0644cce8977a2c566613b0452f05f7e48680dcc1f72
Instruction ID: 59a0c1f92ef2d0b3c6ba8b8b5bc972c169b1d88685bcc748eb434d76f886c597
Opcode Fuzzy Hash: aa3cbff7554342d5645ca0644cce8977a2c566613b0452f05f7e48680dcc1f72
Instruction Fuzzy Hash: 75E0687390CA4C8FDB40AF69D8006D57BA0EF85304F04006BE01CC22C1D2215844C381

Function 00007FFB49FF0873 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1653586020.00007FFB49FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb49ff0000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3379646263767f87ebfae71cdd8f707d48d0547aba864a799018cd42ad24b856
Instruction ID: 79f0616bc0b3f240f254b1c75f841828f2c0a0a7fe7dacb23637f3bd59482aaf
Opcode Fuzzy Hash: 3379646263767f87ebfae71cdd8f707d48d0547aba864a799018cd42ad24b856
Instruction Fuzzy Hash: 26F0A9A180E7CA4EDB137FB489151A4BF30AF43204F4D00FBE499CA0E3DD182928C362

Non-executed Functions

Function 00007FFB4A21DAF4 Relevance: 3.1, Strings: 2, Instructions: 569COMMON

Download Yara Rule

Strings

C J, xrefs: 00007FFB4A21DFA8
E4_H, xrefs: 00007FFB4A21DECE

Memory Dump Source

Source File: 00000004.00000002.1656406266.00007FFB4A210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4a210000_ttgtggt.jbxd

Similarity

API ID:
String ID: E4_H$C J
API String ID: 0-707621651
Opcode ID: 897b871ed006aaef67b9ccc32fe1a50d0f6dbeb1aebfbe890fa510cc7907bd62
Instruction ID: 09127eb0044b5f4c23bd399177b90aa26fe0fdf9dee3cd38a37a11d858baae0d
Opcode Fuzzy Hash: 897b871ed006aaef67b9ccc32fe1a50d0f6dbeb1aebfbe890fa510cc7907bd62
Instruction Fuzzy Hash: 86326571D1992D8FEBA8EF18C895BA9B7F1FB98301F1041EA800DE3651CA756E81DF41

Function 00007FFB4A227090 Relevance: 1.3, Instructions: 1293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1656406266.00007FFB4A210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4a210000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79d25aa9ba67a633042c7fdc31cf5bf530b6b2b4359b5dbd7a70253906e5a9fd
Instruction ID: ebfcb54cd7820936d98670d41ea21cb8680d224ab92025e2a94286732aca2d2f
Opcode Fuzzy Hash: 79d25aa9ba67a633042c7fdc31cf5bf530b6b2b4359b5dbd7a70253906e5a9fd
Instruction Fuzzy Hash: 6F92C2B1A1DA4A4BEBA9BE38C0615B577D1FF98310B2401BDD44EC76D2DE29F802D781

Function 00007FFB4A226579 Relevance: .8, Instructions: 761COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1656406266.00007FFB4A210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4a210000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60fd4bb71d51a3c1efd961adf3d80cf983af842fab5e1740f0759c49e59ecaad
Instruction ID: 170e3386c8cb80ddabf9bb75d91d492ef5b653e9a15dc87d6f3b6c01026dc621
Opcode Fuzzy Hash: 60fd4bb71d51a3c1efd961adf3d80cf983af842fab5e1740f0759c49e59ecaad
Instruction Fuzzy Hash: E33255B290DB464FD759BF38C4212B57BE1FF95310B1402BED48AC36D2DE29A906D782

Function 00007FFB4A2270D9 Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1656406266.00007FFB4A210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4a210000_ttgtggt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c00402f832503d4d0447e59d122e941b8300bdb0fca6137468018b3930739dc
Instruction ID: f9a1729ac66b1e332e33fdf8bab2156504029a6348fc2e03eac6aef6e49a5280
Opcode Fuzzy Hash: 2c00402f832503d4d0447e59d122e941b8300bdb0fca6137468018b3930739dc
Instruction Fuzzy Hash: C0C102B2A1DE4B4FE369AE39C46116577D1FF94310B2442BEC44AC39D2DE28F806E781

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report rHACNp6WFk.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ttgtggt.exe.log

C:\Users\user\AppData\Local\Programs\My Program\is-2T33C.tmp

C:\Users\user\AppData\Local\Programs\My Program\is-FGFQ0.tmp

C:\Users\user\AppData\Local\Programs\My Program\is-GUSOD.tmp

C:\Users\user\AppData\Local\Programs\My Program\python-3.13.0-amd64.exe (copy)

C:\Users\user\AppData\Local\Programs\My Program\ttgtggt.exe (copy)

C:\Users\user\AppData\Local\Programs\My Program\unins000.dat

C:\Users\user\AppData\Local\Programs\My Program\unins000.exe (copy)

C:\Users\user\AppData\Local\Temp\is-3O9NM.tmp\_isetup\_setup64.tmp

C:\Users\user\AppData\Local\Temp\is-U0C1K.tmp\rHACNp6WFk.tmp

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\My Program.lnk

Static File Info

General

Windows Analysis Report
rHACNp6WFk.exe

Function 00007FFB4A21BD39 Relevance: 12.0, Strings: 7, Instructions: 3217
COMMON

Function 00007FFB4A2118C9 Relevance: 4.7, Strings: 3, Instructions: 987
COMMON

Function 00007FFB4A21C499 Relevance: 3.4, Strings: 2, Instructions: 928
COMMON

Function 00007FFB4A0C9CE5 Relevance: 2.9, Instructions: 2918
COMMON

Function 00007FFB49FF0DF5 Relevance: 2.8, Strings: 2, Instructions: 313
COMMON

Function 00007FFB4A214977 Relevance: 1.7, APIs: 1, Instructions: 195
fileCOMMON

Function 00007FFB4A21575D Relevance: 1.7, APIs: 1, Instructions: 166
fileCOMMON

Function 00007FFB4A213113 Relevance: 1.7, APIs: 1, Instructions: 162
COMMON

Function 00007FFB4A213145 Relevance: 1.7, APIs: 1, Instructions: 157
windowCOMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre