Edit tour
Windows
Analysis Report
q1wLT3xKiY.exe
Overview
General Information
| Sample Name: | q1wLT3xKiY.exe |
| Analysis ID: | 688997 |
| MD5: | 45597a36ace0c0df1890299d8d82d938 |
| SHA1: | 285a4ee677b9f7675a0fffe9813488fcdeff7948 |
| SHA256: | dd0145067f81bf5aff9a7ee7eb56c11a98a5f69a9bdbc36744919ee49890de5a |
| Tags: | exeRecordBreaker |
| Infos: |  |
 | |
Detection
CryptOne, Raccoon Stealer v2, RedLine, Vidar
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Yara detected RedLine Stealer
Detected unpacking (overwrites its own PE header)
Yara detected CryptOne packer
Detected unpacking (changes PE section rights)
Antivirus detection for URL or domain
Antivirus detection for dropped file
Detected unpacking (creates a PE file in dynamic memory)
Snort IDS alert for network traffic
Yara detected Raccoon Stealer v2
Malicious sample detected (through community Yara rule)
Yara detected Vidar stealer
Yara detected MSILDownloaderGeneric
Multi AV Scanner detection for dropped file
Connects to many ports of the same IP (likely port scanning)
Encrypted powershell cmdline option found
Machine Learning detection for sample
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Found many strings related to Crypto-Wallets (likely being stolen)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Yara detected Generic Downloader
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Machine Learning detection for dropped file
Contains functionality to query locales information (e.g. system language)
May sleep (evasive loops) to hinder dynamic analysis
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to dynamically determine API calls
HTTP GET or POST without a user agent
Downloads executable code via HTTP
Contains long sleeps (>= 3 min)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
PE file contains strange resources
Drops PE files
Contains functionality to read the PEB
Found evasive API chain checking for process token information
Checks if the current process is being debugged
Binary contains a suspicious time stamp
PE file contains more sections than normal
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
PE file contains sections with non-standard names
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Yara detected Credential Stealer
Found dropped PE file which has not been started or loaded
PE file contains executable resources (Code or Archives)
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Is looking for software installed on the system
Queries information about the installed CPU (vendor, model number etc)
PE file contains an invalid checksum
Extensive use of GetProcAddress (often used to hide API calls)
Detected TCP or UDP traffic on non-standard ports
Uses taskkill to terminate processes
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Uses Microsoft's Enhanced Cryptographic Provider
Classification
- System is w10x64
q1wLT3xKiY.exe (PID: 1808 cmdline: "C:\Users\ user\Deskt op\q1wLT3x KiY.exe" MD5: 45597A36ACE0C0DF1890299D8D82D938) 
chrome.exe (PID: 5960 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --st art-maximi zed --sin gle-argume nt https:/ /iplogger. org/1ARmX4 MD5: 0FEC2748F363150DC54C1CAFFB1A9408) - chrome.exe (PID: 6336 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =1852 --fi eld-trial- handle=180 0,i,400235 4000526200 566,136831 7431597542 8069,13107 2 /prefetc h:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408) - chrome.exe (PID: 1576 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --st art-maximi zed --sin gle-argume nt https:/ /iplogger. org/1AAmX4 MD5: 0FEC2748F363150DC54C1CAFFB1A9408) - chrome.exe (PID: 6192 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =1948 --fi eld-trial- handle=167 2,i,220009 0392483505 353,132594 4868147342 1789,13107 2 /prefetc h:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408) - chrome.exe (PID: 7492 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= chrome.moj om.Process orMetrics --lang=en- US --servi ce-sandbox -type=none --mojo-pl atform-cha nnel-handl e=4528 --f ield-trial -handle=16 72,i,22000 9039248350 5353,13259 4486814734 21789,1310 72 /prefet ch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408) - chrome.exe (PID: 6092 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= quarantine .mojom.Qua rantine -- lang=en-US --service -sandbox-t ype=none - -mojo-plat form-chann el-handle= 8304 --fie ld-trial-h andle=1672 ,i,2200090 3924835053 53,1325944 8681473421 789,131072 /prefetch :8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408) - chrome.exe (PID: 4728 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= quarantine .mojom.Qua rantine -- lang=en-US --service -sandbox-t ype=none - -mojo-plat form-chann el-handle= 7704 --fie ld-trial-h andle=1672 ,i,2200090 3924835053 53,1325944 8681473421 789,131072 /prefetch :8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408) - chrome.exe (PID: 8140 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= quarantine .mojom.Qua rantine -- lang=en-US --service -sandbox-t ype=none - -mojo-plat form-chann el-handle= 7968 --fie ld-trial-h andle=1672 ,i,2200090 3924835053 53,1325944 8681473421 789,131072 /prefetch :8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408) - chrome.exe (PID: 4504 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= quarantine .mojom.Qua rantine -- lang=en-US --service -sandbox-t ype=none - -mojo-plat form-chann el-handle= 4528 --fie ld-trial-h andle=1672 ,i,2200090 3924835053 53,1325944 8681473421 789,131072 /prefetch :8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408) - chrome.exe (PID: 5384 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --st art-maximi zed --sin gle-argume nt https:/ /iplogger. org/1AFmX4 MD5: 0FEC2748F363150DC54C1CAFFB1A9408) - chrome.exe (PID: 6640 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =1968 --fi eld-trial- handle=178 0,i,224367 2671988617 880,544517 7111515229 420,131072 /prefetch :8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408) - chrome.exe (PID: 6152 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --st art-maximi zed --sin gle-argume nt https:/ /iplogger. org/1AGmX4 MD5: 0FEC2748F363150DC54C1CAFFB1A9408) - chrome.exe (PID: 8052 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =1968 --fi eld-trial- handle=182 8,i,677049 9846379427 692,113010 9458173179 2919,13107 2 /prefetc h:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408) - chrome.exe (PID: 6384 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --st art-maximi zed --sin gle-argume nt https:/ /iplogger. org/1AJmX4 MD5: 0FEC2748F363150DC54C1CAFFB1A9408) - chrome.exe (PID: 6444 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =1960 --fi eld-trial- handle=180 8,i,145611 2389325328 9643,10129 3959241638 4631,13107 2 /prefetc h:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408) - chrome.exe (PID: 6756 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --st art-maximi zed --sin gle-argume nt https:/ /iplogger. org/1AKmX4 MD5: 0FEC2748F363150DC54C1CAFFB1A9408) - chrome.exe (PID: 5156 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =1972 --fi eld-trial- handle=171 2,i,172761 1492112889 3629,13810 0064386600 92211,1310 72 /prefet ch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408) - chrome.exe (PID: 7136 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --st art-maximi zed --sin gle-argume nt https:/ /iplogger. org/1AZmX4 MD5: 0FEC2748F363150DC54C1CAFFB1A9408) - chrome.exe (PID: 7448 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =1940 --fi eld-trial- handle=173 2,i,114245 5803347213 5501,32085 2702566612 0732,13107 2 /prefetc h:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408) - chrome.exe (PID: 7664 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --st art-maximi zed --sin gle-argume nt https:/ /iplogger. org/1AVmX4 MD5: 0FEC2748F363150DC54C1CAFFB1A9408) - chrome.exe (PID: 4776 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =1964 --fi eld-trial- handle=181 6,i,499886 4990956341 523,321811 7260479075 57,131072 /prefetch: 8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408) 
F0geI.exe (PID: 7840 cmdline: "C:\Progra m Files (x 86)\Compan y\NewProdu ct\F0geI.e xe" MD5: 501E0F6FA90340E3D7FF26F276CD582E) 
kukurzka9000.exe (PID: 7956 cmdline: "C:\Progra m Files (x 86)\Compan y\NewProdu ct\kukurzk a9000.exe" MD5: 3EC059BD19D6655BA83AE1E644B80510) 
namdoitntn.exe (PID: 4940 cmdline: "C:\Progra m Files (x 86)\Compan y\NewProdu ct\namdoit ntn.exe" MD5: BBD8EA73B7626E0CA5B91D355DF39B7F) - real.exe (PID: 5308 cmdline:
"C:\Progra m Files (x 86)\Compan y\NewProdu ct\real.ex e" MD5: E0C8728412F5F7E97698C72DA925C5E6) 
cmd.exe (PID: 4432 cmdline: "C:\Window s\System32 \cmd.exe" /c taskkil l /im real .exe /f & timeout /t 6 & del / f /q "C:\P rogram Fil es (x86)\C ompany\New Product\re al.exe" & del C:\Pro graData\*. dll & exit MD5: F3BDBE3BB6F734E357235F4D5898582D) - conhost.exe (PID: 5692 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) - taskkill.exe (PID: 3536 cmdline:
taskkill / im real.ex e /f MD5: 15E2E0ACD891510C6268CB8899F2A1A1) - timeout.exe (PID: 8164 cmdline:
timeout /t 6 MD5: 121A4EDAE60A7AF6F5DFA82F7BB95659) - safert44.exe (PID: 5840 cmdline:
"C:\Progra m Files (x 86)\Compan y\NewProdu ct\safert4 4.exe" MD5: 414FFD7094C0F50662FFA508CA43B7D0) - jshainx.exe (PID: 6160 cmdline:
"C:\Progra m Files (x 86)\Compan y\NewProdu ct\jshainx .exe" MD5: 2647A5BE31A41A39BF2497125018DBCE) - brokerius.exe (PID: 7612 cmdline:
"C:\Progra m Files (x 86)\Compan y\NewProdu ct\brokeri us.exe" MD5: F5D13E361F8B9ACA7103CB46B441034B) - cmd.exe (PID: 1804 cmdline:
"C:\Window s\System32 \cmd.exe" /c taskkil l /im brok erius.exe /f & timeo ut /t 6 & del /f /q "C:\Progra m Files (x 86)\Compan y\NewProdu ct\brokeri us.exe" & del C:\Pro graData\*. dll & exit MD5: F3BDBE3BB6F734E357235F4D5898582D) - conhost.exe (PID: 4632 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) - taskkill.exe (PID: 8152 cmdline:
taskkill / im brokeri us.exe /f MD5: 15E2E0ACD891510C6268CB8899F2A1A1) - timeout.exe (PID: 5896 cmdline:
timeout /t 6 MD5: 121A4EDAE60A7AF6F5DFA82F7BB95659) 
captain09876.exe (PID: 6696 cmdline: "C:\Progra m Files (x 86)\Compan y\NewProdu ct\captain 09876.exe" MD5: CE94CE7DE8279ECF9519B12F124543C3) - SETUP_~1.EXE (PID: 6132 cmdline:
C:\Users\u ser\AppDat a\Local\Te mp\IXP000. TMP\SETUP_ ~1.EXE MD5: CE25658AC9291C713590B834D96406BB) 
powershell.exe (PID: 6816 cmdline: "C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -enc UwB0A GEAcgB0AC0 AUwBsAGUAZ QBwACAALQB TAGUAYwBvA G4AZABzACA AMwA0AA== MD5: DBA3E6449E97D4E3DF64527EF7012A10) - conhost.exe (PID: 6732 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) 
ordo_sec666.exe (PID: 7048 cmdline: "C:\Progra m Files (x 86)\Compan y\NewProdu ct\ordo_se c666.exe" MD5: 63FD052610279F9EB9F1FEE8E262F2A4) - WW1.exe (PID: 7760 cmdline:
"C:\Progra m Files (x 86)\Compan y\NewProdu ct\WW1.exe " MD5: 86C2F03BBB61BDCAF1AE4BFB22CC2D31) - cmd.exe (PID: 488 cmdline:
"C:\Window s\System32 \cmd.exe" /c taskkil l /im WW1. exe /f & t imeout /t 6 & del /f /q "C:\Pr ogram File s (x86)\Co mpany\NewP roduct\WW1 .exe" & de l C:\Progr aData\*.dl l & exit MD5: F3BDBE3BB6F734E357235F4D5898582D) - conhost.exe (PID: 8188 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) - taskkill.exe (PID: 7004 cmdline:
taskkill / im WW1.exe /f MD5: 15E2E0ACD891510C6268CB8899F2A1A1) - timeout.exe (PID: 4864 cmdline:
timeout /t 6 MD5: 121A4EDAE60A7AF6F5DFA82F7BB95659)
rundll32.exe (PID: 8036 cmdline: C:\Windows \system32\ rundll32.e xe" C:\Win dows\syste m32\advpac k.dll,DelN odeRunDLL3 2 "C:\User s\user\App Data\Local \Temp\IXP0 00.TMP\ MD5: 73C519F050C20580F8A62C849D49215A)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_RedLine | Yara detected RedLine Stealer | Joe Security | ||
| JoeSecurity_GenericDownloader_1 | Yara detected Generic Downloader | Joe Security | ||
| MALWARE_Win_RedLine | Detects RedLine infostealer | ditekSHen |
| |
| Windows_Trojan_RedLineStealer_3d9371fd | unknown | unknown |
| |
| Windows_Trojan_Vidar_114258d5 | unknown | unknown |
| |
| Click to see the 4 entries | ||||
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_RaccoonV2 | Yara detected Raccoon Stealer v2 | Joe Security | ||
| Windows_Trojan_RedLineStealer_ed346e4c | unknown | unknown |
| |
| Windows_Trojan_Vidar_114258d5 | unknown | unknown |
| |
| JoeSecurity_Crypt | Yara detected CryptOne packer | Joe Security | ||
| JoeSecurity_RaccoonV2 | Yara detected Raccoon Stealer v2 | Joe Security | ||
| Click to see the 62 entries | ||||
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_RaccoonV2 | Yara detected Raccoon Stealer v2 | Joe Security | ||
| JoeSecurity_RaccoonV2 | Yara detected Raccoon Stealer v2 | Joe Security | ||
| JoeSecurity_RaccoonV2 | Yara detected Raccoon Stealer v2 | Joe Security | ||
| JoeSecurity_RaccoonV2 | Yara detected Raccoon Stealer v2 | Joe Security | ||
| MALWARE_Win_RedLine | Detects RedLine infostealer | ditekSHen |
| |
| Click to see the 22 entries | ||||
⊘No Sigma rule has matched
| Timestamp: | 192.168.2.645.95.11.15849800802038485 08/23/22-18:26:09.300558 |
| SID: | 2038485 |
| Source Port: | 49800 |
| Destination Port: | 80 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
| Timestamp: | 192.168.2.645.95.11.15849800802038486 08/23/22-18:26:30.932075 |
| SID: | 2038486 |
| Source Port: | 49800 |
| Destination Port: | 80 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
| Timestamp: | 192.168.2.645.95.11.15849800802038487 08/23/22-18:26:30.932075 |
| SID: | 2038487 |
| Source Port: | 49800 |
| Destination Port: | 80 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
| Timestamp: | 192.168.2.645.95.11.15849800802036934 08/23/22-18:26:09.300558 |
| SID: | 2036934 |
| Source Port: | 49800 |
| Destination Port: | 80 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
| Timestamp: | 45.95.11.158192.168.2.680498002036955 08/23/22-18:26:09.606665 |
| SID: | 2036955 |
| Source Port: | 80 |
| Destination Port: | 49800 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Metadefender: | Perma Link | ||
| Source: | ReversingLabs: | |||
| Source: | ReversingLabs: | |||
| Source: | Metadefender: | Perma Link | ||
| Source: | ReversingLabs: | |||
| Source: | Metadefender: | Perma Link | ||
| Source: | ReversingLabs: | |||
| Source: | ReversingLabs: | |||
| Source: | ReversingLabs: | |||
| Source: | Metadefender: | Perma Link | ||
| Source: | ReversingLabs: | |||
| Source: | ReversingLabs: | |||
| Source: | Joe Sandbox ML: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Code function: | 14_2_00403236 | |
| Source: | Code function: | 14_2_004027B8 | |
| Source: | Code function: | 14_2_00402CB8 | |
| Source: | Code function: | 14_2_00406468 | |
| Source: | Code function: | 14_2_004017FA | |
| Source: | Code function: | 14_2_0040177F | |
| Source: | Code function: | 16_2_00406468 | |
| Source: | Code function: | 16_2_004017FA | |
| Source: | Code function: | 16_2_0040177F | |
| Source: | Code function: | 16_2_00403236 | |
| Source: | Code function: | 16_2_004027B8 | |
| Source: | Code function: | 16_2_00402CB8 | |
Compliance | |
|---|
| Source: | Unpacked PE file: | ||
| Source: | Unpacked PE file: | ||
| Source: | Unpacked PE file: | ||
| Source: | Unpacked PE file: | ||
| Source: | Unpacked PE file: | ||
| Source: | Static PE information: | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Directory created: | Jump to behavior | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Code function: | 14_2_0040ABD8 | |
| Source: | File opened: | ||
| Source: | File opened: | ||
| Source: | File opened: | ||
| Source: | File opened: | ||
| Source: | File opened: | ||
| Source: | File opened: | ||
| Source: | Code function: | 14_2_004052DA | |
| Source: | Code function: | 14_2_00405B5B | |
| Source: | Code function: | 14_2_0040196E | |
| Source: | Code function: | 14_2_0040B177 | |
| Source: | Code function: | 14_2_00401B05 | |
| Source: | Code function: | 14_2_0040AE06 | |
| Source: | Code function: | 14_2_00403C8F | |
| Source: | Code function: | 14_2_00401E18 | |
| Source: | Code function: | 14_2_0040633E | |
| Source: | Code function: | 14_2_004039D7 | |
| Source: | Code function: | 14_2_00406725 | |
| Source: | Code function: | 16_2_004039D7 | |
| Source: | Code function: | 16_2_004052DA | |
| Source: | Code function: | 16_2_00405B5B | |
| Source: | Code function: | 16_2_0040196E | |
| Source: | Code function: | 16_2_0040B177 | |
| Source: | Code function: | 16_2_00401B05 | |
| Source: | Code function: | 16_2_0040AE06 | |
| Source: | Code function: | 16_2_00403C8F | |
| Source: | Code function: | 16_2_00401E18 | |
| Source: | Code function: | 16_2_00406725 | |
| Source: | Code function: | 16_2_0040633E | |
Networking | |
|---|
| Source: | Snort IDS: | ||
| Source: | Snort IDS: | ||
| Source: | Snort IDS: | ||
| Source: | Snort IDS: | ||
| Source: | Snort IDS: | ||
| Source: | File source: | ||
| Source: | TCP traffic: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||