Edit tour

Windows Analysis Report
gC0jV08bP3.exe

Overview

General Information

Sample name:	gC0jV08bP3.exe renamed because original name is a hash value
Original sample name:	58ed282c74825b5b77132329d2a06868.exe
Analysis ID:	1571004
MD5:	58ed282c74825b5b77132329d2a06868
SHA1:	44e040cc9b0760d929a14e34ff2153fb17a51aa8
SHA256:	e1cf672f6bb955a21b742da64c3978241d639e9c2add415b63df73c52b4c1c8f
Tags:	exeRedLineStealeruser-abuse_ch
Infos:

Detection

Meduza Stealer, PureLog Stealer, RedLine, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Meduza Stealer

Yara detected PureLog Stealer

Yara detected RedLine Stealer

Yara detected zgRAT

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains very large array initializations

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

gC0jV08bP3.exe (PID: 3752 cmdline: "C:\Users\user\Desktop\gC0jV08bP3.exe" MD5: 58ED282C74825B5B77132329D2A06868)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: RedLine

{"C2 url": ["66.63.187.209:6677"]}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
gC0jV08bP3.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
gC0jV08bP3.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
gC0jV08bP3.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
gC0jV08bP3.exe	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x45c27:$s1: file:/// 0x45b5f:$s2: {11111-22222-10009-11112} 0x45bb7:$s3: {11111-22222-50001-00000} 0x423fa:$s4: get_Module 0x42864:$s5: Reverse 0x45226:$s6: BlockCopy 0x42c23:$s7: ReadByte 0x45c39:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1657718776.0000000000242000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000000.1657718776.0000000000242000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1873631303.000000000262D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: gC0jV08bP3.exe PID: 3752	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: gC0jV08bP3.exe PID: 3752	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: gC0jV08bP3.exe PID: 3752	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.gC0jV08bP3.exe.240000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.0.gC0jV08bP3.exe.240000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.0.gC0jV08bP3.exe.240000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.0.gC0jV08bP3.exe.240000.0.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x45c27:$s1: file:/// 0x45b5f:$s2: {11111-22222-10009-11112} 0x45bb7:$s3: {11111-22222-50001-00000} 0x423fa:$s4: get_Module 0x42864:$s5: Reverse 0x45226:$s6: BlockCopy 0x42c23:$s7: ReadByte 0x45c39:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T17:52:00.173804+0100	2046056	1	A Network Trojan was detected	66.63.187.209	6677	192.168.2.4	49730	TCP

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T17:51:58.717942+0100	2046045	1	A Network Trojan was detected	192.168.2.4	49730	66.63.187.209	6677	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: gC0jV08bP3.exe

Avira: detected

Found malware configuration

Source: 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": ["66.63.187.209:6677"]}

Multi AV Scanner detection for submitted file

Source: gC0jV08bP3.exe

ReversingLabs: Detection: 64%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: gC0jV08bP3.exe

Joe Sandbox ML: detected

Source: gC0jV08bP3.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: gC0jV08bP3.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.4:49730 -> 66.63.187.209:6677
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 66.63.187.209:6677 -> 192.168.2.4:49730

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 66.63.187.209:6677

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 66.63.187.209:6677

Source: Joe Sandbox View

ASN Name: ASN-QUADRANET-GLOBALUS ASN-QUADRANET-GLOBALUS

Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.209

Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 3IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: gC0jV08bP3.exe, 00000000.00000002.1882645412.000000001B5F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb$ equals www.youtube.com (Youtube)
Source: gC0jV08bP3.exe, 00000000.00000002.1882645412.000000001B5F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002C2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: qC:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002C2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: qC:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldbp equals www.youtube.com (Youtube)

Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.000000000275E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field1
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field1Response
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field2
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1873631303.000000000262D000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field2Response
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field3
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.000000000275E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field3Response
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.000000000287A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.o
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.000000000287A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.oh
Source: gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000126F2000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.0000000012699000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000127A4000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000125BF000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.000000001274B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000126F2000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.0000000012699000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000127A4000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000125BF000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.000000001274B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000126F2000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.0000000012699000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000127A4000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000125BF000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.000000001274B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000126F2000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.0000000012699000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000127A4000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000125BF000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.000000001274B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000126F2000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.0000000012699000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000127A4000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000125BF000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.000000001274B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000126F2000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.0000000012699000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000127A4000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000125BF000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.000000001274B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000126F2000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.0000000012699000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000127A4000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000125BF000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.000000001274B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000126F2000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.0000000012699000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000127A4000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000125BF000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.000000001274B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000126F2000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.0000000012699000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000127A4000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000125BF000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.000000001274B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Users\user\Desktop\gC0jV08bP3.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: gC0jV08bP3.exe, type: SAMPLE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.0.gC0jV08bP3.exe.240000.0.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen

.NET source code contains very large array initializations

Source: gC0jV08bP3.exe, Strings.cs

Large array initialization: Strings: array initializer size 6160

Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Code function: 0_2_00007FFD9B8CC45D	0_2_00007FFD9B8CC45D
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Code function: 0_2_00007FFD9B8C16B3	0_2_00007FFD9B8C16B3
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Code function: 0_2_00007FFD9BA2044D	0_2_00007FFD9BA2044D
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Code function: 0_2_00007FFD9BA1CBC9	0_2_00007FFD9BA1CBC9
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Code function: 0_2_00007FFD9BA21298	0_2_00007FFD9BA21298
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Code function: 0_2_00007FFD9BA18AC7	0_2_00007FFD9BA18AC7
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Code function: 0_2_00007FFD9BA298A9	0_2_00007FFD9BA298A9
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Code function: 0_2_00007FFD9BA2F7F8	0_2_00007FFD9BA2F7F8
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Code function: 0_2_00007FFD9BA16035	0_2_00007FFD9BA16035
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Code function: 0_2_00007FFD9BA26FA1	0_2_00007FFD9BA26FA1
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Code function: 0_2_00007FFD9BA1D535	0_2_00007FFD9BA1D535
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Code function: 0_2_00007FFD9BA2EBCD	0_2_00007FFD9BA2EBCD
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Code function: 0_2_00007FFD9BA27935	0_2_00007FFD9BA27935

Source: gC0jV08bP3.exe, 00000000.00000000.1657718776.00000000002CE000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameGristles.exe" vs gC0jV08bP3.exe
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.000000000262D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs gC0jV08bP3.exe
Source: gC0jV08bP3.exe	Binary or memory string: OriginalFilenameGristles.exe" vs gC0jV08bP3.exe

Source: gC0jV08bP3.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: gC0jV08bP3.exe, type: SAMPLE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.0.gC0jV08bP3.exe.240000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT

Source: gC0jV08bP3.exe, Strings.cs	Cryptographic APIs: 'CreateDecryptor'
Source: gC0jV08bP3.exe, Class4.cs	Cryptographic APIs: 'CreateDecryptor'
Source: gC0jV08bP3.exe, Class4.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/1@0/1

Source: C:\Users\user\Desktop\gC0jV08bP3.exe

File created: C:\Users\user\AppData\Local\Microsoft\Wind?ws

Jump to behavior

Source: C:\Users\user\Desktop\gC0jV08bP3.exe

Mutant created: NULL

Source: gC0jV08bP3.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: gC0jV08bP3.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\gC0jV08bP3.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\gC0jV08bP3.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: gC0jV08bP3.exe

ReversingLabs: Detection: 64%

Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\gC0jV08bP3.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: gC0jV08bP3.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: gC0jV08bP3.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: gC0jV08bP3.exe, Class4.cs

.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

Source: gC0jV08bP3.exe

Static PE information: 0xE3FEC0F4 [Mon Mar 19 06:19:32 2091 UTC]

Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Code function: 0_2_00007FFD9B7F63EE push ss; retf	0_2_00007FFD9B7F63EF
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Code function: 0_2_00007FFD9B7F5CB0 push edi; iretd	0_2_00007FFD9B7F5CB6
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Code function: 0_2_00007FFD9B7F00AD pushad ; iretd	0_2_00007FFD9B7F00C1
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Code function: 0_2_00007FFD9B8C2004 pushad ; retf	0_2_00007FFD9B8C2005
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Code function: 0_2_00007FFD9BA1C356 push esi; iretd	0_2_00007FFD9BA1C357
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Code function: 0_2_00007FFD9BA2BE04 push eax; ret	0_2_00007FFD9BA2BE21

Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\gC0jV08bP3.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\gC0jV08bP3.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: \QEMU-GA.EXE

Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Memory allocated: A20000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Memory allocated: 1A580000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\gC0jV08bP3.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Window / User API: threadDelayed 7967			Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Window / User API: threadDelayed 1866			Jump to behavior

Source: C:\Users\user\Desktop\gC0jV08bP3.exe TID: 2476

Thread sleep time: -28592453314249787s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\gC0jV08bP3.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\gC0jV08bP3.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: gC0jV08bP3.exe, 00000000.00000002.1882720265.000000001B60F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllVA
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe

Source: C:\Users\user\Desktop\gC0jV08bP3.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\gC0jV08bP3.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\gC0jV08bP3.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Queries volume information: C:\Users\user\Desktop\gC0jV08bP3.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\gC0jV08bP3.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: gC0jV08bP3.exe, 00000000.00000002.1882509200.000000001B5C2000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\gC0jV08bP3.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected Meduza Stealer

Source: Yara match

File source: Process Memory Space: gC0jV08bP3.exe PID: 3752, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: gC0jV08bP3.exe, type: SAMPLE
Source: Yara match	File source: 0.0.gC0jV08bP3.exe.240000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1657718776.0000000000242000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: gC0jV08bP3.exe, type: SAMPLE
Source: Yara match	File source: 0.0.gC0jV08bP3.exe.240000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1657718776.0000000000242000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gC0jV08bP3.exe PID: 3752, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: gC0jV08bP3.exe, type: SAMPLE
Source: Yara match	File source: 0.0.gC0jV08bP3.exe.240000.0.unpack, type: UNPACKEDPE

Found many strings related to Crypto-Wallets (likely being stolen)

Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.000000000262D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.000000000262D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ElectronCash
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.000000000262D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: com.liberty.jaxx
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.000000000262D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Exodus
Source: gC0jV08bP3.exe, 00000000.00000002.1873631303.000000000262D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: gC0jV08bP3.exe, 00000000.00000000.1657718776.0000000000242000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: set_UseMachineKeyStore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\gC0jV08bP3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\gC0jV08bP3.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\gC0jV08bP3.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior

Source: Yara match	File source: 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1873631303.000000000262D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gC0jV08bP3.exe PID: 3752, type: MEMORYSTR

Remote Access Functionality

Yara detected Meduza Stealer

Source: Yara match

File source: Process Memory Space: gC0jV08bP3.exe PID: 3752, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: gC0jV08bP3.exe, type: SAMPLE
Source: Yara match	File source: 0.0.gC0jV08bP3.exe.240000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1657718776.0000000000242000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: gC0jV08bP3.exe, type: SAMPLE
Source: Yara match	File source: 0.0.gC0jV08bP3.exe.240000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1657718776.0000000000242000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gC0jV08bP3.exe PID: 3752, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: gC0jV08bP3.exe, type: SAMPLE
Source: Yara match	File source: 0.0.gC0jV08bP3.exe.240000.0.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Masquerading	1 OS Credential Dumping	331 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	3 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Clipboard Data	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	113 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
gC0jV08bP3.exe	65%	ReversingLabs	ByteCode-MSIL.Trojan.Jalapeno
gC0jV08bP3.exe	100%	Avira	HEUR/AGEN.1312138
gC0jV08bP3.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
66.63.187.209:6677	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
66.63.187.209:6677	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtab	gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000126F2000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.0000000012699000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000127A4000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000125BF000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.000000001274B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000126F2000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.0000000012699000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000127A4000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000125BF000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.000000001274B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false	high
https://discord.com/api/v9/users/	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/example/Field1Response	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	gC0jV08bP3.exe, 00000000.00000002.1873631303.000000000275E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.ip.sb/ip	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/sc	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000126F2000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.0000000012699000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000127A4000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000125BF000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.000000001274B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000126F2000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.0000000012699000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000127A4000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000125BF000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.000000001274B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.w3.oh	gC0jV08bP3.exe, 00000000.00000002.1873631303.000000000287A000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/08/addressing	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/trust	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/example/Field1	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/soap/envelope/	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/example/Field2	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/example/Field3	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000126F2000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.0000000012699000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000127A4000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000125BF000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.000000001274B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/06/addressingex	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wscoor	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/08/addressing/fault	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000126F2000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.0000000012699000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000127A4000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000125BF000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.000000001274B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.w3.o	gC0jV08bP3.exe, 00000000.00000002.1873631303.000000000287A000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/example/Field3Response	gC0jV08bP3.exe, 00000000.00000002.1873631303.000000000275E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000126F2000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.0000000012699000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000127A4000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.00000000125BF000.00000004.00000800.00020000.00000000.sdmp, gC0jV08bP3.exe, 00000000.00000002.1879232901.000000001274B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2002/12/policy	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/sc/dk	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit	gC0jV08bP3.exe, 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
66.63.187.209	unknown	United States		8100	ASN-QUADRANET-GLOBALUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1571004
Start date and time:	2024-12-08 17:51:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	gC0jV08bP3.exe renamed because original name is a hash value
Original Sample Name:	58ed282c74825b5b77132329d2a06868.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/1@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: gC0jV08bP3.exe

Simulations

Behavior and APIs

Time	Type	Description
11:52:02	API Interceptor	86x Sleep call for process: gC0jV08bP3.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
66.63.187.209	7xweUz2MYa.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASN-QUADRANET-GLOBALUS	7xweUz2MYa.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse	66.63.187.209
	.main.elf	Get hash	malicious	Xmrig	Browse	66.63.187.200
	jew.arm6.elf	Get hash	malicious	Unknown	Browse	173.205.82.66
	jew.mpsl.elf	Get hash	malicious	Unknown	Browse	154.205.102.60
	bcUcEm7AqP.exe	Get hash	malicious	AsyncRAT	Browse	69.174.100.131
	ET5.exe	Get hash	malicious	Unknown	Browse	45.61.165.224
	na.elf	Get hash	malicious	Unknown	Browse	194.146.117.28
	BQ_PO#385995.exe	Get hash	malicious	RedLine, Snake Keylogger, VIP Keylogger, XWorm	Browse	69.174.100.131
	Vwf30y6XRO.exe	Get hash	malicious	Crimson	Browse	104.223.106.8
	Vwf30y6XRO.exe	Get hash	malicious	Crimson	Browse	104.223.106.8

Process:	C:\Users\user\Desktop\gC0jV08bP3.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2611
Entropy (8bit):	5.363358188931451
Encrypted:	false
SSDEEP:	48:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhAHKKkafHKWA1eXrHKlT48BHK7HKmTHlHNW:iq+wmj0qCYqGSI6oPtzHeqKkGqhA7qZR
MD5:	CEA017D10C4D437981D19F21660A47FA
SHA1:	61AAFCECB5325DE172857CEF7C7E1F230F73AFFD
SHA-256:	60B099420455DECD1878FE84F217CFE478BA0BA5E6E574077150D08355A1DD96
SHA-512:	413384BF9D2EDC9BC2DF6D5175D09A33B91CCF9C53FE3CB21892CB57AF4FD8A9BE0608E9BCA57AF4A7F2709A4C110148719DA3210460DF433CFD77FA753B9CF8
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.180183125390317
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	gC0jV08bP3.exe
File size:	743'424 bytes
MD5:	58ed282c74825b5b77132329d2a06868
SHA1:	44e040cc9b0760d929a14e34ff2153fb17a51aa8
SHA256:	e1cf672f6bb955a21b742da64c3978241d639e9c2add415b63df73c52b4c1c8f
SHA512:	837aa4d7c25f904272372b1585c5934afc99aa1f1a208b288d4b85efce0e079b61dac96449c6dc2032cc9a76975b59a424dbd135e9474ee6930871e3566e058e
SSDEEP:	12288:xDKYDzqxpXBNt1BrivR0V4TBjgYxs1wl206gBawFV2ceSb0BQ/GfM/4QiAzojgJ0:xDKY3qxp1NDXw
TLSH:	52F4701C5BBC058CEC8CD531BE20C9326EA04E08919FCB49A569FA151EB6277B3F5BD1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ........@.. ....................................@................................

File Icon


Icon Hash:	0e9696961617e982

Static PE Info

General

Entrypoint:	0x44d0fe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xE3FEC0F4 [Mon Mar 19 06:19:32 2091 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4d0a8	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4e000	0x6a022	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xba000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x4b104	0x4b200	a0c40baccf59876662b4c242484f8f98	False	0.4180239964642263	data	6.528694546061667	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x4e000	0x6a022	0x6a200	65e4195d76e2641b30f5c060426a53b1	False	0.04090059997055359	data	3.4733020781588206	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xba000	0xc	0x200	fdd16811f82542ac94c2824c17d00617	False	0.041015625	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x4e2b0	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	0.019047548598988075
RT_ICON	0x902d8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	0.03903939429788241
RT_ICON	0xa0b00	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	0.0580460374185411
RT_ICON	0xa9fa8	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	0.08243992606284659
RT_ICON	0xaf430	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	0.0987836561171469
RT_ICON	0xb3658	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	0.14284232365145227
RT_ICON	0xb5c00	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	0.22537523452157598
RT_ICON	0xb6ca8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	0.30901639344262294
RT_ICON	0xb7630	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	0.4530141843971631
RT_GROUP_ICON	0xb7a98	0x84	data	0.7196969696969697
RT_VERSION	0xb7b1c	0x31c	data	0.4535175879396985
RT_MANIFEST	0xb7e38	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-08T17:51:58.717942+0100	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	1	192.168.2.4	49730	66.63.187.209	6677	TCP
2024-12-08T17:52:00.173804+0100	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	66.63.187.209	6677	192.168.2.4	49730	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 8, 2024 17:51:57.088028908 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:51:57.207429886 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:51:57.207731962 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:51:57.209409952 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:51:57.329912901 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:51:58.594779015 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:51:58.642209053 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:51:58.717941999 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:51:58.837397099 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:51:59.583051920 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:51:59.592497110 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:51:59.715166092 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:00.173691034 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:00.173715115 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:00.173727036 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:00.173791885 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:00.173803091 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:00.173804045 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:00.173820019 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:00.173832893 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:00.173844099 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:00.173844099 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:00.173866987 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:00.173883915 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:00.174052954 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:00.174098969 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:00.174112082 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:00.174123049 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:00.174154043 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:00.174169064 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:00.300024033 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:00.300040960 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:00.300091982 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:00.304162025 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:00.304356098 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:00.304413080 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:00.423245907 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:00.423261881 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:00.423340082 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:03.670028925 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:03.792073011 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:03.792097092 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:03.792115927 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:03.792125940 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:03.792138100 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:03.792184114 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:03.792191982 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:03.792196035 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:03.792220116 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:03.792233944 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:03.792262077 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:03.792319059 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:03.792327881 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:03.792371988 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:03.792375088 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:03.792396069 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:03.792429924 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:03.792443991 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:03.911931038 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:03.911947012 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:03.911955118 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:03.911968946 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:03.911988020 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:03.911997080 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:03.911997080 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:03.912005901 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:03.912040949 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:03.912065029 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:03.912090063 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:03.912142038 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:03.912182093 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:03.912230015 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:03.912286997 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:03.912374973 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:03.912386894 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:03.912435055 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:03.954452038 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:03.954546928 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.031507969 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.031522989 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.031620026 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.031622887 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.031665087 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.031681061 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.031711102 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.031778097 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.031804085 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.031846046 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.031869888 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.031902075 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.031944990 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.032006979 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.032058001 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.032075882 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.032102108 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.032134056 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.032159090 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.032174110 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.032227993 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.032263994 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.032274008 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.032280922 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.032377005 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.151416063 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.151429892 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.151474953 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.151508093 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.151520014 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.151534081 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.151585102 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.151596069 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.151607990 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.151628971 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.151638985 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.151643038 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.151654005 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.151683092 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.151693106 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.151702881 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.151740074 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.151748896 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.151760101 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.151782036 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.151793003 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.151793003 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.151830912 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.151833057 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.151842117 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.151851892 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.151884079 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.151887894 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.151911974 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.151942968 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.151968956 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.151976109 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.151983976 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.152008057 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.152035952 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.152055979 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.152055979 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.152093887 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.152106047 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.152121067 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.152157068 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.152164936 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.152173042 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.152184010 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.152221918 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.152261019 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.152270079 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.152307034 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.152307987 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.152355909 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.152380943 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.152391911 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.152400017 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.152410030 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.152477026 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.152487993 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.277586937 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.277604103 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.277614117 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.277617931 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.277621984 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.277654886 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.277713060 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.277769089 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.277831078 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.277879953 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.277916908 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.670433998 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.816766977 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.817066908 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.817076921 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.817277908 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.817286968 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.817315102 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.817568064 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.817620993 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.817759037 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.817831993 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.817991972 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.818131924 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.818142891 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.818154097 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.818178892 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.818264961 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.818274021 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.818335056 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.818380117 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.818411112 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.818490982 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.818501949 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.818510056 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.818521976 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.818598032 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.818608046 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.818648100 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.818696022 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.818778038 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.818803072 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.818839073 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.818850040 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.818890095 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.818932056 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.818942070 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.819061041 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.819070101 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.819078922 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.819109917 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.819119930 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.819128036 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.819257975 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.819267035 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.819276094 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.819286108 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.819359064 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.819367886 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.819376945 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.819449902 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.819459915 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.819468021 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.819482088 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.819603920 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.819613934 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.819622040 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.819631100 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.819641113 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.819648981 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.819705009 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.821084023 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.821173906 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.821173906 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.821202993 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.941422939 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.941440105 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.941477060 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.941488028 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.941498041 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.941513062 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.941518068 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.941538095 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.941546917 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.941546917 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.941576958 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.941596031 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.941596985 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.941605091 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.941620111 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.941628933 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.941634893 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.941660881 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.941674948 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.941675901 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.941684961 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.941728115 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.941750050 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.941760063 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.941797972 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.941801071 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.941824913 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.941873074 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:04.941878080 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.941888094 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.941945076 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.941955090 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.942027092 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:04.942038059 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.061230898 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.061249018 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.061347961 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.061357021 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.061454058 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.061464071 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.061497927 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.061507940 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.061629057 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.061639071 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.061743975 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.061753988 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.061791897 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.061801910 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.061903954 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.061916113 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.062122107 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.062131882 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.062140942 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.062150002 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.062258959 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.062268972 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.062277079 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.062285900 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.062376976 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.062386036 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.062393904 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.062403917 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.182991028 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.183012009 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.183022022 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.183032990 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.183067083 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.183077097 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.183087111 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.183100939 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.183125973 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.183255911 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.183265924 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.183265924 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:05.183274984 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.183300972 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.183356047 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:05.183372974 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.183412075 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.183464050 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.183500051 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.183643103 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.183660030 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.183729887 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.183747053 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.183757067 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.183767080 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.183804989 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.183841944 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.183857918 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.183906078 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.183967113 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.183976889 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.307697058 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.307712078 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.307730913 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.307740927 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.307749987 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.307766914 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.307776928 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.307806015 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.307854891 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.307948112 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.307960033 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.307990074 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.308008909 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.308186054 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.308195114 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.308243036 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.308288097 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.308403015 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.308548927 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.308624983 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.308654070 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.308670998 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.308727026 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.308820963 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.308830976 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.308919907 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.308933973 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.308968067 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.309036970 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.309046984 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.309111118 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.309184074 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:05.309271097 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:05.432549000 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.432565928 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.432579994 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.432589054 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.432596922 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.432624102 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.432634115 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.432641029 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.432749033 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.432760000 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.432769060 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.432777882 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.432909012 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.432919025 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.432926893 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.433134079 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.433145046 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.433182955 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.433192968 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.433201075 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.433211088 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.433219910 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.433289051 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.433298111 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.433306932 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.433336020 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.433345079 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.433353901 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.433367014 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.433419943 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.433429956 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.433459997 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.553026915 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.553045988 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.553057909 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.553081989 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.553181887 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.553193092 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.553273916 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.553350925 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.553360939 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.553456068 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.553466082 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.553482056 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.553531885 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.553550005 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.553670883 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.553680897 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.553770065 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.553778887 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.553786039 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.553869009 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.553877115 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.553949118 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.553993940 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:05.554069996 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:05.554100990 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.554138899 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.554188013 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.554333925 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.554342985 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.554410934 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.554419994 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.554461956 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.554513931 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.554564953 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.672409058 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.672421932 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.672456980 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.672498941 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.672566891 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.672627926 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.672755003 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.672770977 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.672811031 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.672856092 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.672943115 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.672950983 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.673032045 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.673049927 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.673130035 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.673140049 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.673216105 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.673224926 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.673311949 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.673358917 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.673367977 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.673378944 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.673465967 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.673475981 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.673549891 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.673559904 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.673604965 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.673614025 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.673670053 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.673679113 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.673752069 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.673760891 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.673873901 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.797410011 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.797421932 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.797434092 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.797493935 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.797627926 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.797637939 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.797642946 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.797782898 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.797818899 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.797916889 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:05.797960043 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.797996044 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:05.798047066 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.798135042 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.798166990 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.798264980 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.798345089 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.798422098 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.798433065 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.798563957 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.798573017 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.798625946 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.798686981 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.798738956 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.798796892 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.798907042 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.798955917 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.798994064 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.799011946 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.799102068 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.799148083 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.799268007 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.799277067 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.799343109 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.799354076 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.799391985 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.923697948 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.923712969 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.923737049 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.923746109 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.923800945 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.923810959 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.923862934 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.923871994 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.923959017 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.923968077 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.924007893 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.924057961 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.924115896 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.924175978 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.924185991 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.924196959 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.924330950 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.924374104 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.924385071 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.924617052 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.924626112 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.924721956 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.924731970 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.924825907 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.924834967 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.924884081 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.924892902 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.924909115 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.925028086 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.925038099 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.925117970 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.925127983 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:05.925172091 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.925209999 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:05.925262928 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.925271988 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:05.925302029 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.050158024 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.050172091 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.050180912 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.050189972 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.050201893 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.050209999 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.050236940 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.050246954 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.050357103 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.050367117 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.242832899 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.242846966 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.242855072 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.242863894 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.242883921 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.242893934 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.242919922 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.242933989 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.242944002 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.242981911 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.243033886 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.243043900 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.243102074 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.243117094 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.243128061 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.243151903 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.243205070 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.243257046 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.243266106 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.294723988 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.294734955 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.294745922 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.294847965 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.294857979 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.294943094 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.294956923 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.295067072 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.295170069 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.295231104 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.295239925 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.295331001 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.295340061 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.295368910 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.295377970 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.295452118 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.295466900 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.295475960 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.295485020 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.295494080 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.295502901 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.295511961 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.295528889 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.295545101 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.295614958 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.295624971 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.295676947 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.295686960 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.295759916 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.295768976 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.295798063 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.295846939 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.295887947 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.295957088 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.296024084 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:06.296041965 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.296051979 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.296060085 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.296084881 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.296092033 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:06.296093941 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.296128988 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.296138048 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.296243906 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.296268940 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.296343088 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.296351910 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.296432972 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.296442032 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.296468973 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.296477079 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.296545029 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.296554089 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.296665907 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.296681881 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.296734095 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.296773911 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.296886921 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.296896935 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.296952963 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.361871958 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.414222956 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.414331913 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.414402008 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.414482117 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.414573908 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.414583921 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.414683104 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.414781094 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.414824963 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.415590048 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.415601015 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.415610075 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.415688992 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.415766001 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.415779114 CET	49730	6677	192.168.2.4	66.63.187.209
Dec 8, 2024 17:52:06.415798903 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.415936947 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.415977001 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.416059971 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.416070938 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.416177034 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.416187048 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.416258097 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.416268110 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.416306973 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.416358948 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.481132030 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.533365965 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.533411980 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.533626080 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.533636093 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.533835888 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.533896923 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.533926010 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.533935070 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.533972979 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.534986019 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.534996033 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.535048008 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.535058975 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.535188913 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.535198927 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.535260916 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.535270929 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.535288095 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.535342932 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.535361052 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.535370111 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.535429001 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.535445929 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.535495996 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.535543919 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.602601051 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.652648926 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.652676105 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.652693033 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.652703047 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.652734995 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.652966022 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.652975082 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.653021097 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.653058052 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.654321909 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.654339075 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.654417038 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.654465914 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.654474974 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.654623985 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.654633045 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.654705048 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.654714108 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.654783010 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.654792070 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.654844999 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.654853106 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.654937029 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.654953957 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.654999971 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.655008078 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.655205965 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.655215979 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.655224085 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:06.722780943 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:12.918123007 CET	6677	49730	66.63.187.209	192.168.2.4
Dec 8, 2024 17:52:12.930363894 CET	49730	6677	192.168.2.4	66.63.187.209

Target ID:	0
Start time:	11:51:55
Start date:	08/12/2024
Path:	C:\Users\user\Desktop\gC0jV08bP3.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\gC0jV08bP3.exe"
Imagebase:	0x240000
File size:	743'424 bytes
MD5 hash:	58ED282C74825B5B77132329D2A06868
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000000.1657718776.0000000000242000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000000.1657718776.0000000000242000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1873631303.0000000002614000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1873631303.000000000262D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	12.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	9
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9BA1D535 Relevance: 3.2, Strings: 1, Instructions: 1925
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

S, xrefs: 00007FFD9BA1DEF1

Memory Dump Source

Source File: 00000000.00000002.1885988453.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID: S
API String ID: 0-543223747
Opcode ID: 92ad5ba0841bd1554e510969d39e6bad59da3dfb5db27adbd091f9debb559227
Instruction ID: 21a5aecc5ce3749fd6b2d696959cbdcec3bf1e039ae75b3fd79671dba9207225
Opcode Fuzzy Hash: 92ad5ba0841bd1554e510969d39e6bad59da3dfb5db27adbd091f9debb559227
Instruction Fuzzy Hash: 4FF28770A1996D8FDFE8EF18C895BA9B7F1FB68305F1141EA900DE3251CA756A81CF40

Function 00007FFD9BA2F7F8 Relevance: 2.8, Strings: 1, Instructions: 1564
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_, xrefs: 00007FFD9BA2F939

Memory Dump Source

Source File: 00000000.00000002.1885988453.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID: _
API String ID: 0-701932520
Opcode ID: ef66a416bbb383409303adc63d9d65dcfb05905cf047bca6deac50140ea8a80f
Instruction ID: ce7d1bf6b7cd4ba67811d49560d80b4c4506336d007e063af2eb4d47f537ae67
Opcode Fuzzy Hash: ef66a416bbb383409303adc63d9d65dcfb05905cf047bca6deac50140ea8a80f
Instruction Fuzzy Hash: 07B23632B0DB8A4FE7A8DB6890A56E977D1EF94304F1540BAD08DC72E3DE35A9428741

Function 00007FFD9BA298A9 Relevance: 2.2, Strings: 1, Instructions: 958
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

H, xrefs: 00007FFD9BA2A18C

Memory Dump Source

Source File: 00000000.00000002.1885988453.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 7a5c7a9507a5a2d8b843c4be3c3a3774bed85247a568b9ea3464cab14cffb797
Instruction ID: 3c25536fbded09748da223bd0c14f72cebcffa12aa74438537538f9e81463f94
Opcode Fuzzy Hash: 7a5c7a9507a5a2d8b843c4be3c3a3774bed85247a568b9ea3464cab14cffb797
Instruction Fuzzy Hash: AC62D230A19B498FDBA8DB69C4A5AA5B3E1FF98300B15457DD08EC76A2DE34F846C740

Function 00007FFD9B8CC45D Relevance: 2.1, Strings: 1, Instructions: 823
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ZJ_H, xrefs: 00007FFD9B8CC9CF

Memory Dump Source

Source File: 00000000.00000002.1885101776.00007FFD9B8C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8c0000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID: ZJ_H
API String ID: 0-3185422581
Opcode ID: 8cae4c0c71919c8dda3d3c681d248f50e5c040be3ecba3cba144324cb7edf822
Instruction ID: b931c1975e1cf8adf8f186bff4c8887555eb37817aa1782aacea7014dd7ce09c
Opcode Fuzzy Hash: 8cae4c0c71919c8dda3d3c681d248f50e5c040be3ecba3cba144324cb7edf822
Instruction Fuzzy Hash: A732C4B1B1EA494FD7A4EB2C84696787BE1FF59700B0501FED44EC71A7DE24AC418781

Function 00007FFD9BA16035 Relevance: 2.0, Strings: 1, Instructions: 779
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@B/, xrefs: 00007FFD9BA16101

Memory Dump Source

Source File: 00000000.00000002.1885988453.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID: @B/
API String ID: 0-3863299084
Opcode ID: 56c47284f45dad943086241025df3de8c1e83655c4c9ddf2c2c9ada1d865ee50
Instruction ID: c7a8dae2079dd8b170a7ffd356c2991095fdc86846827bff3f953e6c01593871
Opcode Fuzzy Hash: 56c47284f45dad943086241025df3de8c1e83655c4c9ddf2c2c9ada1d865ee50
Instruction Fuzzy Hash: 4562EA70E1991D8FDBA9EB58C8A5BA8B7B1FF58300F5141E9D01DE32A1DE756A80CF40

Function 00007FFD9BA26FA1 Relevance: 1.7, Instructions: 1744COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885988453.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6957da82a15b0c6b6cd58843571f70b2b3ec572c582cef5d357e0adea20baf9d
Instruction ID: 243f5df8cbffd38ac445e73d0f8214c456bf98742edcee49b3acfa1198717290
Opcode Fuzzy Hash: 6957da82a15b0c6b6cd58843571f70b2b3ec572c582cef5d357e0adea20baf9d
Instruction Fuzzy Hash: EEC21631B1EE4A4FD7A8EB2884615B577D1FF99310B0502BED44EC76E6DE25BE028780

Function 00007FFD9BA1CBC9 Relevance: 1.7, Strings: 1, Instructions: 492
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

P5_H, xrefs: 00007FFD9BA1D3CF

Memory Dump Source

Source File: 00000000.00000002.1885988453.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID: P5_H
API String ID: 0-2379055100
Opcode ID: aea826bf1cb3697f7389f729f1e5e2875352ed1e7fe4458cf05358eb896714c3
Instruction ID: 052e69024993fc8f8a3b5ce6fb95baae6bc473e2fc71ad78007a496ea3fd9506
Opcode Fuzzy Hash: aea826bf1cb3697f7389f729f1e5e2875352ed1e7fe4458cf05358eb896714c3
Instruction Fuzzy Hash: B602ED71A0995D8FDFE9DF1888A5BA877B1FB68304F1111EAD00DE32A1DA756A81CF40

Function 00007FFD9BA2044D Relevance: 1.0, Instructions: 1029COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885988453.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a9e980f1913ea7b1b4f9d259d145dba2ca191be3dd6cd7e894507b47db2e97a
Instruction ID: 001e6ae33d63943089428656fb19ac0156a7ee0926ee6c588e6daea9679c7bb8
Opcode Fuzzy Hash: 8a9e980f1913ea7b1b4f9d259d145dba2ca191be3dd6cd7e894507b47db2e97a
Instruction Fuzzy Hash: 9962B330B19E094FEB68EB6CD465A7973D2FF98700F5501B9E44EC72A2DE24EC428785

Function 00007FFD9B8C16B3 Relevance: 1.0, Instructions: 988COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885101776.00007FFD9B8C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8c0000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a312c373698f8773a7212c8d963c36078ab39ca2ccdfe1ef8e907055dc88cf8
Instruction ID: 5cb041df87bddda7308a47c542bcab211250364f33776efbaa41e1034a4b31c1
Opcode Fuzzy Hash: 5a312c373698f8773a7212c8d963c36078ab39ca2ccdfe1ef8e907055dc88cf8
Instruction Fuzzy Hash: 2652E560B0DA4D4FE7A9FB6C94A4A7477D1EF99310B0502BBD05EC72E7DD24AC428781

Function 00007FFD9BA18AC7 Relevance: .8, Instructions: 850COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885988453.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3e37e2060a7d9e171bceb67c096810c1f90ce06bcc8d19fa8c95c8aa54deb5c
Instruction ID: 8aead1006f017424552329cef264c87264980d5377be14b807046e9507f5cd20
Opcode Fuzzy Hash: f3e37e2060a7d9e171bceb67c096810c1f90ce06bcc8d19fa8c95c8aa54deb5c
Instruction Fuzzy Hash: CD72F770A1995D8FDBA4EF58C8A9BA8B7B1FF58300F5041E9D00DE32A5DE746A81CF41

Function 00007FFD9BA21298 Relevance: .7, Instructions: 678COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885988453.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a1c1d84ef339c616564165b59fa837ab9782025e600e31ce536734eabafa619
Instruction ID: fee0228cae3b66da69b5186c405ed2e86ebe6a23d055c13c1731e7d38829e785
Opcode Fuzzy Hash: 4a1c1d84ef339c616564165b59fa837ab9782025e600e31ce536734eabafa619
Instruction Fuzzy Hash: AA327670B19A4D8FEFA8DB58C4A5BA877E2FFA8300F1541B9D04DC7291DE75A981CB40

Function 00007FFD9BA19A65 Relevance: 1.8, APIs: 1, Instructions: 258
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00007FFD9BA19C2F

Memory Dump Source

Source File: 00000000.00000002.1885988453.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_gC0jV08bP3.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 33ac84db377406de438ff703dbce1ad698b3743e369cd37f248ab8dd21787a97
Instruction ID: 9598102ace602a219ea8193277d53ecdbb197da5ce9c793c8ff58091fe7aa2c7
Opcode Fuzzy Hash: 33ac84db377406de438ff703dbce1ad698b3743e369cd37f248ab8dd21787a97
Instruction Fuzzy Hash: 9C81C73061CB8C4FDB68EF68C8557E97BE0FF59310F15426AE84DC7252CA75A941CB82

Function 00007FFD9BA32BFA Relevance: 1.7, APIs: 1, Instructions: 223
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateCompatibleBitmap.GDI32 ref: 00007FFD9BA32D4A

Memory Dump Source

Source File: 00000000.00000002.1885988453.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_gC0jV08bP3.jbxd

Similarity

API ID: BitmapCompatibleCreate
String ID:
API String ID: 1901715728-0
Opcode ID: 7181136d52043eb6e901df4d0ba6c7fbf2e3af19fa1b61586042dac7f830f274
Instruction ID: 78f1d771c6e7dbbd8ea32d411152847bf18058e570495db14df166b02d1bfd0c
Opcode Fuzzy Hash: 7181136d52043eb6e901df4d0ba6c7fbf2e3af19fa1b61586042dac7f830f274
Instruction Fuzzy Hash: 41619D3148E3C51FC3068BA48C25AD67FF9DF8B22070942EBE085CB5A3C55E594BC7A1

Function 00007FFD9BA1A571 Relevance: 1.7, APIs: 1, Instructions: 166
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE ref: 00007FFD9BA1A67A

Memory Dump Source

Source File: 00000000.00000002.1885988453.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_gC0jV08bP3.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: b1b1d156cb43177e0b180e46548d08533db9689fcba5e641eda42aedf2851437
Instruction ID: 43b60bc009c1dfc4456a77451360dbb589faba2bbcdb40a07aba9c832898963c
Opcode Fuzzy Hash: b1b1d156cb43177e0b180e46548d08533db9689fcba5e641eda42aedf2851437
Instruction Fuzzy Hash: F441B271A08B1C4FDB98EF98D8456EDBBE1FB99310F00426AD04DD7296CA74A945CBC2

Function 00007FFD9B8CC001 Relevance: 1.5, Strings: 1, Instructions: 275
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

|?_H, xrefs: 00007FFD9B8CC05E

Memory Dump Source

Source File: 00000000.00000002.1885101776.00007FFD9B8C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8c0000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID: |?_H
API String ID: 0-1790896812
Opcode ID: 3bf892618654cdce11bc0f0122f1274f9d98dfa4a5e7d3cf0e49b393b73e6173
Instruction ID: 39eab01f693fddafe9f85f45c1959a1cdaa3ec7db6dfa31f71321bc1c537599f
Opcode Fuzzy Hash: 3bf892618654cdce11bc0f0122f1274f9d98dfa4a5e7d3cf0e49b393b73e6173
Instruction Fuzzy Hash: 4B810662B1EB890FE7A5EB6C88685747BE1EF5A310B0601FBD489C71E3D918AC45C781

Function 00007FFD9B8CD9CA Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD9B8CDA72

Memory Dump Source

Source File: 00000000.00000002.1885101776.00007FFD9B8C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8c0000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: d288869505e0b001f5d7b904875488701368bc612e6afa4493c164f2d5117b0f
Instruction ID: 5e4554ec10b080c1f083162a8639e50ea4621dedf2683193801ea0e1c2ad61d9
Opcode Fuzzy Hash: d288869505e0b001f5d7b904875488701368bc612e6afa4493c164f2d5117b0f
Instruction Fuzzy Hash: 26416F7171CE0D4FDBA8EB1CD465A7473D2FB98710B5142AAE04EC72B6DE25EC428781

Function 00007FFD9B7F7D58 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884754839.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7f0000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23b1a7ca5cd7a42afc9536dd41af56621ca1780d176e2df00bb6aa1e4b49d64f
Instruction ID: 68281ed0ac4222f49e07a2d34e30c6ad61e30dc257841aac2b590b78e995060f
Opcode Fuzzy Hash: 23b1a7ca5cd7a42afc9536dd41af56621ca1780d176e2df00bb6aa1e4b49d64f
Instruction Fuzzy Hash: E8D14171A1895D8FDBA8EF1888A5AE8B7E1FF64300F4541F9D01CD32A6DE346A818F41

Function 00007FFD9B7F3299 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884754839.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7f0000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e011de987020d4c1adbe9521c3e0c0d0d9bf4027f825fc084888c07e53ffeb8
Instruction ID: 191daf26274bb78b3d1220ce14409c93f29f11c2ea8be8660d12bb3d35c7f992
Opcode Fuzzy Hash: 4e011de987020d4c1adbe9521c3e0c0d0d9bf4027f825fc084888c07e53ffeb8
Instruction Fuzzy Hash: EDC15F71E0965D8FEBA8EB98C8657B8BBB1FF54300F5142BAD00DD32A1CE346981CB54

Function 00007FFD9B8C22EB Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885101776.00007FFD9B8C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8c0000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc000a9ee45a6a7447fd790defd1f9538e0b50daf36b11e999d56792031dab10
Instruction ID: a1887c3ade1a6d5636cf520c348199b8864e79a9166c5d6e56ba4954cc40b577
Opcode Fuzzy Hash: fc000a9ee45a6a7447fd790defd1f9538e0b50daf36b11e999d56792031dab10
Instruction Fuzzy Hash: 8C811360B0DA490FE7A9EB6C9865B7477D1EF9A320B0501BBD04EC72F7DD18AC428381

Function 00007FFD9B8CBD6C Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885101776.00007FFD9B8C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8c0000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f49b49af2a3a8f3a6821e611aeec934ff9554fb0de16e054e0f08ee7b314e8e
Instruction ID: 1fa8e0af5f1d568ced6a002482f24c41eaac45ea0fc7146054f50adb03c45baf
Opcode Fuzzy Hash: 6f49b49af2a3a8f3a6821e611aeec934ff9554fb0de16e054e0f08ee7b314e8e
Instruction Fuzzy Hash: AC71157171DE4C4FDB98EB1C9465A757BE2EF9D710B0641ABE48AC72B3DA20EC028741

Function 00007FFD9B7F2FF0 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884754839.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7f0000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 581396e333a21f9c0fbd24316d02c9265be345ad5027ea6e31bfeabf27a381d6
Instruction ID: 8d14c8707b1e88bdb8bc2568df465039865f56a1ae584e56baaca39cc7aab15d
Opcode Fuzzy Hash: 581396e333a21f9c0fbd24316d02c9265be345ad5027ea6e31bfeabf27a381d6
Instruction Fuzzy Hash: 2691D671F0DA4D4FDB58CFA888646BD7FE2EF98350F1502BAD04DE32A2DE2469018795

Function 00007FFD9B8CC268 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885101776.00007FFD9B8C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8c0000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fdaf93e358f37ba58330fd37d3868bcb7fbb3c41f8936d9601b6b5567213da1
Instruction ID: 04420ebe08773936915a484b642134e04c0021c01f523565fffd1bbe3917cca8
Opcode Fuzzy Hash: 6fdaf93e358f37ba58330fd37d3868bcb7fbb3c41f8936d9601b6b5567213da1
Instruction Fuzzy Hash: B371147171CA4D4FDBA8DB1C9468A3577E2EF99310B0501BFE44EC72A2DE25EC028781

Function 00007FFD9B7F2E90 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884754839.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7f0000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee315a0d1fdac44abd40a27ccc4dd6c4b369de74c6ba91f5cf676138cbde31cf
Instruction ID: 0d6d3709ef802b1594ed57007b273d7460604f8efc264d77a47f7a93154df1c5
Opcode Fuzzy Hash: ee315a0d1fdac44abd40a27ccc4dd6c4b369de74c6ba91f5cf676138cbde31cf
Instruction Fuzzy Hash: 6291EB30A19A1D8FDBA4EF58C4A5BAD7BF1FF58300F5101A9E00DD72A6DE35A981CB44

Function 00007FFD9B8CD189 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885101776.00007FFD9B8C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8c0000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e00478f95aa5ac9ebbe8dafde8effd6500732b2debd28742ae091dff3453c31
Instruction ID: 717c0fa9346a2bab5a467b9c60da0dfba60208450a28859e834bb3d50203b646
Opcode Fuzzy Hash: 3e00478f95aa5ac9ebbe8dafde8effd6500732b2debd28742ae091dff3453c31
Instruction Fuzzy Hash: 8861F571B0DB494FE798AB2C98655743BE2EF9A35070A01EFE499C72B3ED15AC028341

Function 00007FFD9B7F30DD Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884754839.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7f0000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33814b51f71d5b66e26bc98649bd661ae27a8094d131d37cfb1baf6acac5965c
Instruction ID: 62d5a575dcaf6ef45b6d0bab20166e9fad6154b6412ebf49385d28dec3be13b4
Opcode Fuzzy Hash: 33814b51f71d5b66e26bc98649bd661ae27a8094d131d37cfb1baf6acac5965c
Instruction Fuzzy Hash: 80411A27F0F6D90BD711F7AC78B44EC7BA0DF82229B4A42F7D0988A0E7DC1829458394

Function 00007FFD9B8C031D Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885101776.00007FFD9B8C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8c0000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 047cb6882aeab607cd4e3e819fd9f6a4c373b1ba145566e9abe393796850c17c
Instruction ID: de9bbc4ab571a5ef9c7815bf97379bd2ba472fcedc6d2fb1c8c3ab78b27a1862
Opcode Fuzzy Hash: 047cb6882aeab607cd4e3e819fd9f6a4c373b1ba145566e9abe393796850c17c
Instruction Fuzzy Hash: 7B41583170DB894FD76597289869A753FF1EF5A320B0902FBD449C72E3D918AC05C382

Function 00007FFD9B7F2CBD Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884754839.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7f0000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 756aa38d5b61be5c6e6f8a0f833198a42375449663d51213bb12c50edcd09649
Instruction ID: f17a34b675aa59017e19181ea634604a479c76052b3d3c8918e57db896f9baa5
Opcode Fuzzy Hash: 756aa38d5b61be5c6e6f8a0f833198a42375449663d51213bb12c50edcd09649
Instruction Fuzzy Hash: 46311831F0EBCD5FEB519BA888645A87FA0FF51304F8901FAE458C60F3DA24A949C741

Function 00007FFD9B7F0A52 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884754839.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7f0000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dda4ad7ffad8ec06bc9f100a9d0c3c7722c98762d7375dacfb42f0fda070019
Instruction ID: 9a5364f3e9d8aac71b63aab7b8ff14816c4bf31ee539735bcff222f854ad4b8b
Opcode Fuzzy Hash: 5dda4ad7ffad8ec06bc9f100a9d0c3c7722c98762d7375dacfb42f0fda070019
Instruction Fuzzy Hash: C4417171A08A4C8FE789DF58C8A87A97FE1FBA5704F5001AAD00CD77DADBB42805CB40

Function 00007FFD9B7F30D0 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884754839.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7f0000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b875fa21daa9220b75a6731b30fe625065ef21a190bd800f7a91f57ec8486887
Instruction ID: df8029c13a838f4d7c90c400983bdb24ba603a57a33bb6b25bfb5a5d238d250e
Opcode Fuzzy Hash: b875fa21daa9220b75a6731b30fe625065ef21a190bd800f7a91f57ec8486887
Instruction Fuzzy Hash: 1F21F172F09A4D4FEB94CEAC88646AD7BE2EFD8310F14426AD40DE3261DA3469018781

Function 00007FFD9B7F334C Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884754839.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7f0000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: becede404b2848f061e0bb37fda0db8d60f65cd7eecb48d0a90a5e50f1f91b11
Instruction ID: ebed46c0336fd4ba668f3781b7d754c26a7300d2031793d876eb01d3ff44c9b0
Opcode Fuzzy Hash: becede404b2848f061e0bb37fda0db8d60f65cd7eecb48d0a90a5e50f1f91b11
Instruction Fuzzy Hash: 94212C71F1D61D8EDBA8DA9894657FCBBA1FF58300F4141BAD00ED32A1CA346A80CF55

Function 00007FFD9B8C2119 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885101776.00007FFD9B8C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8c0000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0b8a37cc4ad4cdd78b790aaafed8fb0041b94ee9b28efed7fa691db8b81b8a9
Instruction ID: bc654843076a122d1ff1410ee90aaec4554626775a0c2ce895589b327c801280
Opcode Fuzzy Hash: b0b8a37cc4ad4cdd78b790aaafed8fb0041b94ee9b28efed7fa691db8b81b8a9
Instruction Fuzzy Hash: DB11D371B1EA890FE7A5EB6C84A463836D2EF98710B1511BFE04DC72F3DE25AC428301

Function 00007FFD9B7F275D Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884754839.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7f0000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 739e070bf49ea3d526bd06e8b4c1e4046b7f9cacdd67f9908ff50cb4fd8fad50
Instruction ID: 8ec3afc5755874cc5128976b3ed3bc4005e11054f12fc4195cbd6704946f70d0
Opcode Fuzzy Hash: 739e070bf49ea3d526bd06e8b4c1e4046b7f9cacdd67f9908ff50cb4fd8fad50
Instruction Fuzzy Hash: 6B21B271B1A68D4FFB98FFA888A56A8BA90FF44300F8105B9E41DC21E7CD3469508B91

Function 00007FFD9B8C04FD Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885101776.00007FFD9B8C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8c0000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2393ac65e6a784a48379637aa3569b36086896bf7949e1fceef9c4bcda25a5fd
Instruction ID: 21036d94ff6798fe0739ec85b6b65ff80e760395125e9341f324d74bc67349f7
Opcode Fuzzy Hash: 2393ac65e6a784a48379637aa3569b36086896bf7949e1fceef9c4bcda25a5fd
Instruction Fuzzy Hash: 5211D3A1B1EA890FE799AB5C44A463437D2EF9C750B1501BBE04DC33F2DE24EC418705

Function 00007FFD9B8C06E0 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885101776.00007FFD9B8C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8c0000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f23ca4e1e12439c2e0ef49f4145309bf9051b34d66ab5b6eb29d706ffabe401a
Instruction ID: 4b876cb35962565bf1dafb303bfdfa6030181bf60f6fe451ffaa2c4eaae3708c
Opcode Fuzzy Hash: f23ca4e1e12439c2e0ef49f4145309bf9051b34d66ab5b6eb29d706ffabe401a
Instruction Fuzzy Hash: 13113AA1B2E6894FD768AB5C846453437D1EF98B50B1A01BED05CC72F3CD2A9D028701

Function 00007FFD9B7F0D01 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884754839.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7f0000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c2783e04afc096c620487a885f5c044c2b827914076b362e5c5bc84e0d15731
Instruction ID: f062901827b1ad89fb4f42c4c920707a1b06c6f491e9d1fb48ff161f6328fbf5
Opcode Fuzzy Hash: 5c2783e04afc096c620487a885f5c044c2b827914076b362e5c5bc84e0d15731
Instruction Fuzzy Hash: 1901A172F1E68DAFE7A5AF6488666F87F91EF54600F4102BAD008C61F3DD2939508745

Function 00007FFD9B8C07CE Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885101776.00007FFD9B8C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8c0000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb1c053eb5839436cdd7e6fb67297cd53a3d9c705766e138d3e2a358106f4be4
Instruction ID: b19e95c5ad38b0c129ddcc75a937f71ab799a2e9c5137b78616c516b5d5c4ea4
Opcode Fuzzy Hash: fb1c053eb5839436cdd7e6fb67297cd53a3d9c705766e138d3e2a358106f4be4
Instruction Fuzzy Hash: 8211C67071EA898FDBA5E72C8464E247BE1FF59710B1941AEE04DC71E2CE28AC41C785

Function 00007FFD9B7F1F71 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884754839.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7f0000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2d48fcb3c434536cf8246788bf3f7c45f514edd84735e0863be328fcc4cdb1e
Instruction ID: fb894e5e7cacce784bf802890cff283e0ec71aec88176d2df99db02717862e10
Opcode Fuzzy Hash: c2d48fcb3c434536cf8246788bf3f7c45f514edd84735e0863be328fcc4cdb1e
Instruction Fuzzy Hash: 74119670A19A1D8FDBA9DB58C894AA877B6FF59301F1002E9D00DE7261CB71AE81CF44

Function 00007FFD9B7F0850 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884754839.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7f0000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcb1cad43d845828d2bbf77e0a200a9d448db89979b2ca19d999630c4251709d
Instruction ID: 6c3cd7e47c360ea646bb9b4cd76cdc1bbff80dfd8fe1375db5cb99eed003b839
Opcode Fuzzy Hash: bcb1cad43d845828d2bbf77e0a200a9d448db89979b2ca19d999630c4251709d
Instruction Fuzzy Hash: CE01A717F0F68D46D72267AC68750F93B60EF82529F0A03B2E098950F3DC0965168195

Function 00007FFD9B7F3775 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884754839.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7f0000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e901bfbb569a3f61e9eaeec62de08e1fab62dc77e1b5afe733a4eb46ef7c0da
Instruction ID: 4ce935c693cad675c869f1d7b7c97ecc5d6a603afe5ca009118db4f571a1dcf0
Opcode Fuzzy Hash: 2e901bfbb569a3f61e9eaeec62de08e1fab62dc77e1b5afe733a4eb46ef7c0da
Instruction Fuzzy Hash: BB014C70908A4D8FDF84EF58C898AAE7FF0FF68300F0105AAD418D72A1D7309554CB80

Function 00007FFD9B7F2EE0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884754839.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7f0000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf23ceb0855ef4bf928cf5d7ea7078f7fa2b3b76ffb53218ce513a5ce2d47097
Instruction ID: 746bdfee5fa245fb4b77cdac39866ccb47378d41300f9e37cbd0d83ee4764d90
Opcode Fuzzy Hash: cf23ceb0855ef4bf928cf5d7ea7078f7fa2b3b76ffb53218ce513a5ce2d47097
Instruction Fuzzy Hash: 0501DA30914A0D9FDF84EF58C849AFE7BF0FB68305F11056AA419D3260DB70A590CB80

Function 00007FFD9B7F2FA8 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884754839.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7f0000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d85e1137e12c91c6f4a4a0786c9e81e2375c3ac3c72eaf1af0bce854be6d5cac
Instruction ID: aa60853e1d3455dc55d2a893693433ebbc28d3193aa0d2ad23a3e68bf50d13e8
Opcode Fuzzy Hash: d85e1137e12c91c6f4a4a0786c9e81e2375c3ac3c72eaf1af0bce854be6d5cac
Instruction Fuzzy Hash: EE01C830914A4DDFDF84EF58C849AEE7BF0FB28305F10056AA419D3260DB30A690CB81

Function 00007FFD9B7F21F9 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884754839.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7f0000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a90b699bf2f8d189033f9087cc41712f499a45d306ec327c8766892c7de103
Instruction ID: 0b25db819b742795e68810fb97edf14af0cf07b0a84ab170ddf84ab7769a411e
Opcode Fuzzy Hash: b4a90b699bf2f8d189033f9087cc41712f499a45d306ec327c8766892c7de103
Instruction Fuzzy Hash: A801213091968D8FCB85DF58C854AA97BB0FF19300F4505EAD418C72A2D7349954CB01

Function 00007FFD9B7F2F08 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884754839.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7f0000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1f7aa2d58b022493238e5e250c3431a18f35bb60031a19f3bfe8dc3c39fd2af
Instruction ID: 771048043717e43525679407e721c59d2c373d31dd00e4d18f2bd36f8ef86353
Opcode Fuzzy Hash: a1f7aa2d58b022493238e5e250c3431a18f35bb60031a19f3bfe8dc3c39fd2af
Instruction Fuzzy Hash: A801BB70914A0D8FDF84EF58C858AAE7BF0FB68305F10456AA41DD3264DB30A690CB80

Function 00007FFD9B7F185F Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884754839.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7f0000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8bfffd92dc6f34159d0ae715c68a14ef95fc47c855e76e77e56f6bb9806984f
Instruction ID: 3072d57988c4db1bc4ce6e93ae2250d300dd8b921fef1b4f629229cdc532ec18
Opcode Fuzzy Hash: c8bfffd92dc6f34159d0ae715c68a14ef95fc47c855e76e77e56f6bb9806984f
Instruction Fuzzy Hash: D1015C70A19A1D8FDBA9DB58C894AA877B5FB55701F1011E9D00DE7261CB71AE80CF44

Function 00007FFD9B7F3790 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884754839.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7f0000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dbfee83474246972207ebef265887b5067b044547b592d02bb37c545ec936ef
Instruction ID: 17a8d3448a17244c64752212ab6f79e66e1acb2c8ae92f16d9cbcf7a414ba0f8
Opcode Fuzzy Hash: 5dbfee83474246972207ebef265887b5067b044547b592d02bb37c545ec936ef
Instruction Fuzzy Hash: E601797091491DCFDF84EF58C858AAE7BF0FB68305F10456AE419D3264DB71A694CB81

Function 00007FFD9B7F1E4F Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884754839.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7f0000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7cd80017c983a6c8cd2e9d04fea30f8121e0b746f3341fe064f7e295c7d8119
Instruction ID: 44a75a0f6870158948b19b1dd728d0594fc284dcc4c7442c3889e8e2ac7909d0
Opcode Fuzzy Hash: e7cd80017c983a6c8cd2e9d04fea30f8121e0b746f3341fe064f7e295c7d8119
Instruction Fuzzy Hash: E7F03130F0E71E8FDB799984886127976E6EF45301F110278E44D966B0DB396F52CAC5

Function 00007FFD9B7F0D99 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884754839.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7f0000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d87803803e3595a8d777037b22fcb551474b6d4c77a2f65b37f0ee5d75b7a2c
Instruction ID: 785f627ad0c1e2c176f72e2535fd13e9f491acc86d788fadb13e5b1d66c65e43
Opcode Fuzzy Hash: 0d87803803e3595a8d777037b22fcb551474b6d4c77a2f65b37f0ee5d75b7a2c
Instruction Fuzzy Hash: 04F0F672E0F78D8FE7629F6448691E87FB0EF55210F4A01E7D048C71F3EA2825948341

Function 00007FFD9B7F2D70 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884754839.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7f0000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 855c8cd5258e1069d5d2ea526701914d03d9a58e4def025295c1b836c1a4d995
Instruction ID: 317c55132b6887fcaa2bb727b255860f0252e10bfbdda20316ee05f23abc4237
Opcode Fuzzy Hash: 855c8cd5258e1069d5d2ea526701914d03d9a58e4def025295c1b836c1a4d995
Instruction Fuzzy Hash: 56F0F830914A4C9FDF84EFA8C458AA9BBB0FB68305F4041AAA41DD31A0DB31AA94CB40

Function 00007FFD9B7F0873 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884754839.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7f0000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26ee672d381010fe0415e49a4abc78df2372cdfdfcc3e600f4122d7bbe8dea66
Instruction ID: 65574d5dc84ee070271251f8630f2cd9cc3fd103caa23adf99ad892a18678aff
Opcode Fuzzy Hash: 26ee672d381010fe0415e49a4abc78df2372cdfdfcc3e600f4122d7bbe8dea66
Instruction Fuzzy Hash: 82F01261A1E7CD5ED76367F418651E47F70AF53204F4A01A3E058D60F3D9185A28C3A6

Non-executed Functions

Function 00007FFD9BA2EBCD Relevance: 1.6, Strings: 1, Instructions: 364COMMON

Download Yara Rule

Strings

8)_L, xrefs: 00007FFD9BA2ECEF

Memory Dump Source

Source File: 00000000.00000002.1885988453.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID: 8)_L
API String ID: 0-1628323357
Opcode ID: d412129468075b9bc30736573a6356dfdf45cdda88099e4a779cb818e9129905
Instruction ID: d0703a718ce675cb70dd6520d5b3c2ee4308f54a3036356ea2d3d9304f2c1b40
Opcode Fuzzy Hash: d412129468075b9bc30736573a6356dfdf45cdda88099e4a779cb818e9129905
Instruction Fuzzy Hash: A7B1D831B1DA4A4FDBA8EB688465A7577D1FF99300B1100BDD44EC76E2DE25ED42C780

Function 00007FFD9BA27935 Relevance: .5, Instructions: 493COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885988453.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_gC0jV08bP3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70166df7cf95fd9dc3e6eff8b3696d7f9fa778094ee196e8ff24ac3a96cafd10
Instruction ID: 3398d5aca54f6fd81608f71183f51bee26ca314e3f9be0828e3d9209de633f37
Opcode Fuzzy Hash: 70166df7cf95fd9dc3e6eff8b3696d7f9fa778094ee196e8ff24ac3a96cafd10
Instruction Fuzzy Hash: 4EF10631A1DE4A4FDBACEB2890619B5B7D1EF98310B1145BED05EC36E6DE25F902C740

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report gC0jV08bP3.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\gC0jV08bP3.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
gC0jV08bP3.exe

Function 00007FFD9BA1D535 Relevance: 3.2, Strings: 1, Instructions: 1925
COMMON

Function 00007FFD9BA2F7F8 Relevance: 2.8, Strings: 1, Instructions: 1564
COMMON

Function 00007FFD9BA298A9 Relevance: 2.2, Strings: 1, Instructions: 958
COMMON

Function 00007FFD9B8CC45D Relevance: 2.1, Strings: 1, Instructions: 823
COMMON

Function 00007FFD9BA16035 Relevance: 2.0, Strings: 1, Instructions: 779
COMMON

Function 00007FFD9BA1CBC9 Relevance: 1.7, Strings: 1, Instructions: 492
COMMON

Function 00007FFD9BA19A65 Relevance: 1.8, APIs: 1, Instructions: 258
fileCOMMON

Function 00007FFD9BA32BFA Relevance: 1.7, APIs: 1, Instructions: 223
windowCOMMON

Function 00007FFD9BA1A571 Relevance: 1.7, APIs: 1, Instructions: 166
fileCOMMON

Function 00007FFD9B8CC001 Relevance: 1.5, Strings: 1, Instructions: 275
COMMON