Edit tour

Windows Analysis Report
KBDFW9FTsq.exe

Overview

General Information

Sample name:	KBDFW9FTsq.exe renamed because original name is a hash value
Original sample name:	01995be1c953e0f7640f17b5c2247bc2.exe
Analysis ID:	1519314
MD5:	01995be1c953e0f7640f17b5c2247bc2
SHA1:	02abc4ef1134362ded897ebe2806d121522dbf65
SHA256:	732c3a097337212ea87c31a6df3e78790963f330c7c0318a5ddeec8576f83123
Tags:	exeRedLineStealeruser-abuse_ch
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected RedLine Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Installs new ROOT certificates

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops certificate files (DER)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

KBDFW9FTsq.exe (PID: 6504 cmdline: "C:\Users\user\Desktop\KBDFW9FTsq.exe" MD5: 01995BE1C953E0F7640F17B5C2247BC2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["95.179.250.45:26212"], "Bot Id": "LiveTraffic", "Message": "Error! Disable antivirus and try again!", "Authorization Header": "143feb5082f9936e624c1e27545e7d19"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
KBDFW9FTsq.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.2027577444.0000000000382000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2170557700.0000000002982000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: KBDFW9FTsq.exe PID: 6504	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: KBDFW9FTsq.exe PID: 6504	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.KBDFW9FTsq.exe.380000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Suricata Signatures

ET MALWARE Redline Stealer TCP CnC - Id1Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T11:02:05.920449+0200	2043234	1	A Network Trojan was detected	95.179.250.45	26212	192.168.2.5	49704	TCP

ET MALWARE Redline Stealer TCP CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T11:02:05.734121+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:11.027784+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:11.460853+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:11.649970+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:11.907306+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:12.929754+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:13.123961+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:13.321752+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:13.511249+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:13.699830+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:13.939428+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:14.251621+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:14.440260+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:14.663232+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:14.851509+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:15.043432+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:15.234786+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:15.477292+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:15.495919+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:16.022049+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:16.288673+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:16.293967+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:17.102682+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:17.290994+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:17.507591+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	95.179.250.45	26212	TCP

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T11:02:11.465673+0200	2046056	1	A Network Trojan was detected	95.179.250.45	26212	192.168.2.5	49704	TCP

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T11:02:05.734121+0200	2046045	1	A Network Trojan was detected	192.168.2.5	49704	95.179.250.45	26212	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: KBDFW9FTsq.exe

Malware Configuration Extractor: RedLine {"C2 url": ["95.179.250.45:26212"], "Bot Id": "LiveTraffic", "Message": "Error! Disable antivirus and try again!", "Authorization Header": "143feb5082f9936e624c1e27545e7d19"}

Multi AV Scanner detection for submitted file

Source: KBDFW9FTsq.exe

ReversingLabs: Detection: 76%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: KBDFW9FTsq.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: KBDFW9FTsq.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Code function: 4x nop then jmp 06619F65h	0_2_06619C90
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Code function: 4x nop then jmp 0661DF20h	0_2_0661DA28
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Code function: 4x nop then jmp 0661A767h	0_2_0661A008
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Code function: 4x nop then inc dword ptr [ebp-20h]	0_2_06612E88
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Code function: 4x nop then jmp 06618BA7h	0_2_066187C9
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Code function: 4x nop then inc dword ptr [ebp-20h]	0_2_06613158

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2043231 - Severity 1 - ET MALWARE Redline Stealer TCP CnC Activity : 192.168.2.5:49704 -> 95.179.250.45:26212
Source: Network traffic	Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.5:49704 -> 95.179.250.45:26212
Source: Network traffic	Suricata IDS: 2043234 - Severity 1 - ET MALWARE Redline Stealer TCP CnC - Id1Response : 95.179.250.45:26212 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 95.179.250.45:26212 -> 192.168.2.5:49704

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 95.179.250.45:26212

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 95.179.250.45:26212

Source: Joe Sandbox View

IP Address: 95.179.250.45 95.179.250.45

Source: Joe Sandbox View

ASN Name: AS-CHOOPAUS AS-CHOOPAUS

Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45
Source: unknown	TCP traffic detected without corresponding DNS query: 95.179.250.45

Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9i
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.000000000285F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp, KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.00000000028EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.00000000028EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.00000000028EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002982000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.00000000028EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002982000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002982000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002982000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002B10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002982000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp, KBDFW9FTsq.exe, 00000000.00000002.2170557700.000000000285F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.000000000285F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp, KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp, KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002B10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.000000000285F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp, KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.000000000285F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp, KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.000000000296A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp, KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002857000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.00000000028EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp, KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002982000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002982000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.000000000285F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002D98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: KBDFW9FTsq.exe	String found in binary or memory: https://api.ip.sb/ip
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002D98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002D98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002D98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002D98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002D98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabS
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002D98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002D98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002D98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp397D.tmp			Jump to dropped file
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp396C.tmp			Jump to dropped file

Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Code function: 0_2_00D1DC74	0_2_00D1DC74
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Code function: 0_2_05FC67D8	0_2_05FC67D8
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Code function: 0_2_05FCA688	0_2_05FCA688
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Code function: 0_2_05FC6FF8	0_2_05FC6FF8
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Code function: 0_2_05FC6FE8	0_2_05FC6FE8
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Code function: 0_2_066176B0	0_2_066176B0
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Code function: 0_2_0661CD78	0_2_0661CD78
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Code function: 0_2_06618D2A	0_2_06618D2A
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Code function: 0_2_0661F538	0_2_0661F538
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Code function: 0_2_06616DE0	0_2_06616DE0
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Code function: 0_2_0661DA28	0_2_0661DA28
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Code function: 0_2_066113C0	0_2_066113C0
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Code function: 0_2_0661B3B3	0_2_0661B3B3
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Code function: 0_2_0661A008	0_2_0661A008
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Code function: 0_2_0661A920	0_2_0661A920
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Code function: 0_2_066187C9	0_2_066187C9
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Code function: 0_2_0661CD69	0_2_0661CD69
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Code function: 0_2_06616A98	0_2_06616A98
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Code function: 0_2_066113B0	0_2_066113B0

Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.000000000285F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs KBDFW9FTsq.exe
Source: KBDFW9FTsq.exe, 00000000.00000002.2169505027.0000000000A9E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs KBDFW9FTsq.exe
Source: KBDFW9FTsq.exe, 00000000.00000000.2027610714.00000000003C6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameHardens.exe8 vs KBDFW9FTsq.exe
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.00000000028EE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefirefox.exe0 vs KBDFW9FTsq.exe
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.00000000028EE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $sq,\\StringFileInfo\\000004B0\\OriginalFilename vs KBDFW9FTsq.exe
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.00000000028EE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamechrome.exe< vs KBDFW9FTsq.exe
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.00000000028EE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $sq,\\StringFileInfo\\040904B0\\OriginalFilename vs KBDFW9FTsq.exe
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.00000000028EE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIEXPLORE.EXE.MUID vs KBDFW9FTsq.exe
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.00000000028EE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIEXPLORE.EXED vs KBDFW9FTsq.exe
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.00000000028EE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $sq,\\StringFileInfo\\080904B0\\OriginalFilename vs KBDFW9FTsq.exe
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.00000000028EE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsedge.exe> vs KBDFW9FTsq.exe
Source: KBDFW9FTsq.exe	Binary or memory string: OriginalFilenameHardens.exe8 vs KBDFW9FTsq.exe

Source: KBDFW9FTsq.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/5@0/1

Source: C:\Users\user\Desktop\KBDFW9FTsq.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Jump to behavior

Source: C:\Users\user\Desktop\KBDFW9FTsq.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\KBDFW9FTsq.exe

File created: C:\Users\user\AppData\Local\Temp\Tmp396C.tmp

Jump to behavior

Source: KBDFW9FTsq.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: KBDFW9FTsq.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\KBDFW9FTsq.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\KBDFW9FTsq.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: KBDFW9FTsq.exe

ReversingLabs: Detection: 76%

Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: esdsip.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\KBDFW9FTsq.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32

Jump to behavior

Source: Google Chrome.lnk.0.dr

LNK file: ..\..\..\Program Files\Google\Chrome\Application\chrome.exe

Source: C:\Users\user\Desktop\KBDFW9FTsq.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: KBDFW9FTsq.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: KBDFW9FTsq.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: KBDFW9FTsq.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: KBDFW9FTsq.exe

Static PE information: 0xE5ABE3E9 [Thu Feb 7 18:31:05 2092 UTC]

Source: C:\Users\user\Desktop\KBDFW9FTsq.exe

Code function: 0_2_05FCEFB2 push eax; ret

0_2_05FCEFC1

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Users\user\Desktop\KBDFW9FTsq.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Jump to behavior

Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\KBDFW9FTsq.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\KBDFW9FTsq.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Memory allocated: CF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Memory allocated: 2760000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Memory allocated: 2540000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Window / User API: threadDelayed 2035			Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Window / User API: threadDelayed 7668			Jump to behavior

Source: C:\Users\user\Desktop\KBDFW9FTsq.exe TID: 2796	Thread sleep time: -29514790517935264s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe TID: 3856	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\KBDFW9FTsq.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.0000000003B5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.0000000003B5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.0000000003B5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.000000000389C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.000000000389C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.000000000389C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.000000000389C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.0000000003B5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.0000000003B5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.000000000389C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.0000000003B5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.0000000003B5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.000000000389C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.000000000389C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.000000000389C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.000000000389C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.0000000003B5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.000000000389C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.000000000389C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.0000000003B5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.0000000003B5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.000000000389C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.0000000003B5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.000000000389C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.000000000389C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.0000000003B5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.000000000389C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.0000000003B5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.0000000003B5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.000000000389C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.0000000003B5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.0000000003B5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.0000000003B5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.000000000389C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.000000000389C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.0000000003B5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.000000000389C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.000000000389C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.000000000389C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.000000000389C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.000000000389C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: KBDFW9FTsq.exe, 00000000.00000002.2176979605.000000000607A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.0000000003B5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.000000000389C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.000000000389C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.0000000003B5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.000000000389C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.000000000389C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.0000000003B5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.000000000389C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.0000000003B5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.000000000389C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.000000000389C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.0000000003B5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.0000000003B5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.0000000003B5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.0000000003B5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.0000000003B5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.0000000003B5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.0000000003B5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.0000000003B5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.000000000389C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: KBDFW9FTsq.exe, 00000000.00000002.2172746780.0000000003B5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x

Source: C:\Users\user\Desktop\KBDFW9FTsq.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\KBDFW9FTsq.exe

Code function: 0_2_06613E78 LdrInitializeThunk,

0_2_06613E78

Source: C:\Users\user\Desktop\KBDFW9FTsq.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\KBDFW9FTsq.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Queries volume information: C:\Users\user\Desktop\KBDFW9FTsq.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\KBDFW9FTsq.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: KBDFW9FTsq.exe, 00000000.00000002.2169806822.0000000000B3D000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: KBDFW9FTsq.exe, type: SAMPLE
Source: Yara match	File source: 0.0.KBDFW9FTsq.exe.380000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2027577444.0000000000382000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: KBDFW9FTsq.exe PID: 6504, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ElectrumE#
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002982000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $sq2C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: JaxxE#
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002982000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.walletLRsq
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002982000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLRsqlz
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ExodusE#
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002982000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $sq%appdata%`,sqdC:\Users\user\AppData\Roaming`,sqdC:\Users\user\AppData\Roaming\Binance
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: EthereumE#
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002982000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $sq&%localappdata%\Coinomi\Coinomi\walletsLRsq
Source: KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002982000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $sq6C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\KBDFW9FTsq.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2170557700.0000000002982000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: KBDFW9FTsq.exe PID: 6504, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: KBDFW9FTsq.exe, type: SAMPLE
Source: Yara match	File source: 0.0.KBDFW9FTsq.exe.380000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2027577444.0000000000382000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: KBDFW9FTsq.exe PID: 6504, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Masquerading	1 OS Credential Dumping	231 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	3 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Install Root Certificate	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
KBDFW9FTsq.exe	76%	ReversingLabs	ByteCode-MSIL.Ransomware.RedLine

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	0%	Avira URL Cloud	safe
http://tempuri.org/	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id4	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id7	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/sc	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id20	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/trust	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id18	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002D98000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id14ResponseD	KBDFW9FTsq.exe, 00000000.00000002.2170557700.00000000028EE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	KBDFW9FTsq.exe, 00000000.00000002.2170557700.000000000285F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12Response	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id2Response	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21Response	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id9	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp, KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002982000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6ResponseD	KBDFW9FTsq.exe, 00000000.00000002.2170557700.000000000296A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id4	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id7	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp, KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002857000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp, KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19Response	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id13ResponseD	KBDFW9FTsq.exe, 00000000.00000002.2170557700.00000000028EE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15Response	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5ResponseD	KBDFW9FTsq.exe, 00000000.00000002.2170557700.000000000285F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	KBDFW9FTsq.exe, 00000000.00000002.2170557700.000000000285F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6Response	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ip.sb/ip	KBDFW9FTsq.exe	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id1ResponseD	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id9Response	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002D98000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id20	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id22	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id24	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id24Response	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002D98000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1Response	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21ResponseD	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002982000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id11	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16Response	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id13	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id17	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id18	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5Response	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp, KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15ResponseD	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002982000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10Response	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp, KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id11ResponseD	KBDFW9FTsq.exe, 00000000.00000002.2170557700.00000000028EE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8Response	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id17ResponseD	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002982000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002761000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8ResponseD	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002982000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	KBDFW9FTsq.exe, 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
95.179.250.45	unknown	Netherlands		20473	AS-CHOOPAUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1519314
Start date and time:	2024-09-26 11:01:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	KBDFW9FTsq.exe renamed because original name is a hash value
Original Sample Name:	01995be1c953e0f7640f17b5c2247bc2.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 102 Number of non-executed functions: 19
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: KBDFW9FTsq.exe

Simulations

Behavior and APIs

Time	Type	Description
05:02:11	API Interceptor	47x Sleep call for process: KBDFW9FTsq.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
95.179.250.45	file.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, PureLog Stealer	Browse
	file.exe	Get hash	malicious	Amadey, CryptOne, PureLog Stealer, RedLine, Stealc, Vidar, Zhark RAT	Browse
	file.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, Stealc, zgRAT	Browse
	jD6b7MZOhT.exe	Get hash	malicious	Amadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, PureLog Stealer, RedLine	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.1325.25139.exe	Get hash	malicious	Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	RedLine	Browse
	VMRhiAFJtl.exe	Get hash	malicious	Amadey, Clipboard Hijacker, CryptOne, Cryptbot, PureLog Stealer, RedLine, Stealc	Browse
	file.exe	Get hash	malicious	RedLine	Browse
	XpCyBwDzEt.exe	Get hash	malicious	Amadey, Clipboard Hijacker, CryptOne, Cryptbot, DanaBot, PureLog Stealer, RedLine	Browse
	g082Q9DajU.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Clipboard Hijacker, CryptOne, Cryptbot, PureLog Stealer	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-CHOOPAUS	file.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, PureLog Stealer	Browse	95.179.250.45
	https://duroterra.com	Get hash	malicious	Unknown	Browse	207.148.0.16
	VwsPnLkxnp.exe	Get hash	malicious	Unknown	Browse	139.180.202.227
	t77rOVfEUc.exe	Get hash	malicious	Unknown	Browse	139.180.202.227
	JE2TjQlTkn.exe	Get hash	malicious	Quasar	Browse	139.180.202.227
	dxC31Z2rU3.exe	Get hash	malicious	Unknown	Browse	139.180.202.227
	4IOzVTrG6f.exe	Get hash	malicious	Unknown	Browse	139.180.202.227
	lf3HNjfUat.exe	Get hash	malicious	Unknown	Browse	139.180.202.227
	https://ms.email.streetcontxt.net/platform/al?a=9379139&ad=2080279888&h=mQ0byH1&sig=Fp6bSH7g2Q3qYFAsEOqnIZYZZNz&v=2&url=https://www.hpcwire.com/2024/09/23/ansys-fluent-adds-amd-instinct-mi200-and-mi300-acceleration-to-power-cfd-simulations/	Get hash	malicious	Unknown	Browse	207.148.0.16
	Document.xls	Get hash	malicious	Unknown	Browse	149.28.237.171

Process:	C:\Users\user\Desktop\KBDFW9FTsq.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Wed Oct 4 13:16:56 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	3.449633847939307
Encrypted:	false
SSDEEP:	48:8Sh9l2dfTXdARYrnvPdAKRkdAGdAKRFdAKRE:8Sh9lO7
MD5:	071FE82829BF163D14CC85A60504C1E4
SHA1:	49C50EC05229C7935D1D549E5E2C04622EBC55C6
SHA-256:	EC5DF38097E0450EB917D3CFD6DE6638FCFDF9D7772FF98686BAD57BF7899C1D
SHA-512:	B5A24C118EEB4B2EF84E9CBFF2FD8067AB8B19152EAB60FFD7EFADC62B3C85A9FCBCD4290D9CE88F18A03B67B5457D8D95885C81D62C583BA229FEEF219E18EF
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ......,......!n.......q.... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IDW.r....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDWUl....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDWUl....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDWUl..........................."&.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.+ .chrome.exe..F......CW.VDW.r..........................,.6.c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.!.-.-.p.r.o.x.y.-.s.e.r.v.e.r

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\KBDFW9FTsq.exe.log

Download File

Process:	C:\Users\user\Desktop\KBDFW9FTsq.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3274
Entropy (8bit):	5.3318368586986695
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqc85VD:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlq0
MD5:	0C1110E9B7BBBCB651A0B7568D796468
SHA1:	7AEE00407EE27655FFF0ADFBC96CF7FAD9610AAA
SHA-256:	112E21404A85963FB5DF8388F97429D6A46E9D4663435CC86267C563C0951FA2
SHA-512:	46E37552764B4E61006AB99F8C542D55B2418668B097D3C6647D306604C3D7CA3FAF34F8B4121D94B0E7168295B2ABEB7C21C3B96F37208943537B887BC81590
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Temp\Tmp396C.tmp

Download File

Process:	C:\Users\user\Desktop\KBDFW9FTsq.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\Tmp397D.tmp

Download File

Process:	C:\Users\user\Desktop\KBDFW9FTsq.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Users\user\Desktop\KBDFW9FTsq.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0158FE9CEAD91D1B027B795984737614
SHA1:	B41A11F909A7BDF1115088790A5680AC4E23031B
SHA-256:	513257326E783A862909A2A0F0941D6FF899C403E104FBD1DBC10443C41D9F9A
SHA-512:	C48A55CC7A92CEFCEFE5FB2382CCD8EF651FC8E0885E88A256CD2F5D83B824B7D910F755180B29ECCB54D9361D6AF82F9CC741BD7E6752122949B657DA973676
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.083544131783037
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	KBDFW9FTsq.exe
File size:	311'296 bytes
MD5:	01995be1c953e0f7640f17b5c2247bc2
SHA1:	02abc4ef1134362ded897ebe2806d121522dbf65
SHA256:	732c3a097337212ea87c31a6df3e78790963f330c7c0318a5ddeec8576f83123
SHA512:	b9e92edafba6499a38c7c7b3ce1a315acf57e21d5f4ecf8a1d6e75c631088b070169cc9ada1d4ad3743f3259990a551e0bf4121da38fb642221bf53bddc38f7f
SSDEEP:	3072:5q6EgY6i1rUjphYowPel9o4TWLZTTAotA/iBMcZqf7D34leqiOLibBOZ:IqY6igwPWxKZTTA0AeMcZqf7DIvL
TLSH:	16646C1823EC8511E37F4B7994B1E67493B5EC16A852D31F4ED06CAB3E32741FA11AB2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.............f.... ... ....@.. ....................... ............@................................

File Icon


Icon Hash:	4d8ea38d85a38e6d

Static PE Info

General

Entrypoint:	0x42ba66
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xE5ABE3E9 [Thu Feb 7 18:31:05 2092 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
popad
add byte ptr [ebp+00h], dh
je 00007F14E1464192h
outsd
add byte ptr [esi+00h], ah
imul eax, dword ptr [eax], 006C006Ch
xor eax, 59007400h
add byte ptr [edi+00h], dl
push edx
add byte ptr [ecx+00h], dh
popad
add byte ptr [edi+00h], dl
push esi
add byte ptr [edi+00h], ch
popad
add byte ptr [ebp+00h], ch
push 61006800h
add byte ptr [ebp+00h], ch
dec edx
add byte ptr [eax], bh
add byte ptr [edi+00h], dl
push edi
add byte ptr [ecx], bh
add byte ptr [ecx+00h], bh
bound eax, dword ptr [eax]
xor al, byte ptr [eax]
insb
add byte ptr [eax+00h], bl
pop ecx
add byte ptr [edi+00h], dl
js 00007F14E1464192h
jnc 00007F14E1464192h
pop edx
add byte ptr [eax+00h], bl
push ecx
add byte ptr [ebx+00h], cl
popad
add byte ptr [edi+00h], dl
dec edx
add byte ptr [ebp+00h], dh
pop edx
add byte ptr [edi+00h], dl
jo 00007F14E1464192h
imul eax, dword ptr [eax], 5Ah
add byte ptr [ebp+00h], ch
jo 00007F14E1464192h
je 00007F14E1464192h
bound eax, dword ptr [eax]
push edi
add byte ptr [eax+eax+77h], dh
add byte ptr [ecx+00h], bl
xor al, byte ptr [eax]
xor eax, 63007300h
add byte ptr [edi+00h], al
push esi
add byte ptr [ecx+00h], ch
popad
add byte ptr [edx], dh
add byte ptr [eax+00h], bh
je 00007F14E1464192h
bound eax, dword ptr [eax]
insd
add byte ptr [eax+eax+76h], dh
add byte ptr [edx+00h], bl
push edi
add byte ptr [ecx], bh
add byte ptr [eax+00h], dh
popad
add byte ptr [edi+00h], al
cmp dword ptr [eax], eax
insd
add byte ptr [edx+00h], bl
push edi
add byte ptr [esi+00h], cl
cmp byte ptr [eax], al
push esi
add byte ptr [eax+00h], cl
dec edx
add byte ptr [esi+00h], dh
bound eax, dword ptr [eax]
insd
add byte ptr [eax+00h], bh
jo 00007F14E1464192h
bound eax, dword ptr [eax]
insd
add byte ptr [ebx+00h], dh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2ba14	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x32000	0x1c9c4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x50000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2b9f8	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x2ea4c	0x2ec00	4e873a61cb04c5b4fbaeca8779685e51	False	0.4701808990641711	data	6.207590918410276	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x32000	0x1c9c4	0x1cc00	402b4ad6ae5f8a52c5570702f6e95b4b	False	0.23721127717391305	data	2.605891841224002	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x50000	0xc	0x400	9a04cc8a2e6cf6b058d2bb33d40346aa	False	0.025390625	data	0.05585530805374581	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x321a0	0x3d04	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9934058898847631
RT_ICON	0x35eb4	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2835 x 2835 px/m	0.09013072282030049
RT_ICON	0x466ec	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2835 x 2835 px/m	0.13905290505432216
RT_ICON	0x4a924	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2835 x 2835 px/m	0.17033195020746889
RT_ICON	0x4cedc	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2835 x 2835 px/m	0.2045028142589118
RT_ICON	0x4df94	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2835 x 2835 px/m	0.24645390070921985
RT_GROUP_ICON	0x4e40c	0x5a	data	0.7666666666666667
RT_VERSION	0x4e478	0x34a	data	0.4418052256532066
RT_MANIFEST	0x4e7d4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-26T11:02:05.734121+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:05.734121+0200	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	1	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:05.920449+0200	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	1	95.179.250.45	26212	192.168.2.5	49704	TCP
2024-09-26T11:02:11.027784+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:11.460853+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:11.465673+0200	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	95.179.250.45	26212	192.168.2.5	49704	TCP
2024-09-26T11:02:11.649970+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:11.907306+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:12.929754+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:13.123961+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:13.321752+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:13.511249+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:13.699830+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:13.939428+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:14.251621+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:14.440260+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:14.663232+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:14.851509+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:15.043432+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:15.234786+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:15.477292+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:15.495919+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:16.022049+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:16.288673+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:16.293967+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:17.102682+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:17.290994+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	95.179.250.45	26212	TCP
2024-09-26T11:02:17.507591+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	95.179.250.45	26212	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 26, 2024 11:02:04.686393976 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:04.692092896 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:04.692198992 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:04.711059093 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:04.717153072 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:05.332655907 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:05.383594990 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:05.734121084 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:05.739084005 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:05.920449018 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:05.962117910 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:11.027784109 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:11.032759905 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:11.218163013 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:11.218188047 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:11.218199015 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:11.218209028 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:11.218223095 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:11.218276024 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:11.460853100 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:11.465672970 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:11.646776915 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:11.649970055 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:11.654887915 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:11.835510969 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:11.883531094 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:11.907305956 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:11.912288904 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:11.912352085 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:11.912379980 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:11.912385941 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:11.912408113 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:11.912434101 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:11.912435055 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:11.912434101 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:11.912482977 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:11.912532091 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:11.912595034 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:11.912621021 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:11.912693977 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:11.912719965 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:11.917567968 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:11.917594910 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:11.917624950 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:11.917773008 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:11.917799950 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:12.181648016 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:12.227299929 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:12.929754019 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:12.934806108 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:13.116383076 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:13.123960972 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:13.129195929 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:13.129239082 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:13.129265070 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:13.129292965 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:13.129342079 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:13.129368067 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:13.318708897 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:13.321752071 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:13.326721907 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:13.507217884 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:13.511249065 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:13.516110897 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:13.696342945 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:13.699830055 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:13.704705000 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:13.885162115 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:13.930406094 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:13.939428091 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:13.944437027 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:14.125622034 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:14.180424929 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:14.251621008 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:14.256589890 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:14.437906027 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:14.440259933 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:14.445131063 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:14.660336018 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:14.663232088 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:14.668076992 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:14.849772930 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:14.851509094 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:14.856484890 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:15.036981106 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:15.043431997 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:15.048270941 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:15.228637934 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:15.234786034 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:15.239639997 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:15.420456886 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:15.477292061 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:15.495918989 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:15.683157921 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:15.988676071 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.022048950 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.027091980 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.207691908 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.258529902 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.288672924 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.293901920 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.293941975 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.293967009 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.293970108 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.294003010 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.294012070 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.294023037 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.294032097 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.294059038 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.294060946 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.294085979 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.294087887 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.294101000 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.294112921 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.294131994 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.294140100 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.294154882 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.294190884 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.298460960 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.298491001 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.298531055 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.298554897 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.298566103 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.298593998 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.298610926 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.298624992 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.298651934 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.298651934 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.298672915 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.298679113 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.298700094 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.298718929 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.298726082 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.298753023 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.298787117 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.298799038 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.298808098 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.298825979 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.298852921 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.298862934 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.298871040 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.298897982 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.298913002 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.298945904 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.298945904 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.298973083 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.298990011 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.299036026 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.303196907 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.303226948 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.303260088 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.303277016 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.303287983 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.303304911 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.303329945 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.303330898 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.303342104 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.303359032 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.303379059 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.303405046 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.303422928 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.303450108 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.303476095 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.303483963 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.303502083 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.303528070 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.303535938 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.303556919 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.303574085 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.303605080 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.303631067 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.303657055 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.303683043 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.303708076 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.303734064 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.303778887 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.303806067 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.303847075 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.303899050 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.303926945 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.303939104 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.303983927 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.304011106 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.304037094 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.304063082 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.304112911 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.304127932 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.304141998 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.304168940 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.304188013 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.304194927 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.304218054 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.304250956 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.304261923 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.304280043 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.304302931 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.304307938 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.304328918 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.304347992 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.304354906 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.304382086 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.304400921 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.304408073 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.304438114 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.304454088 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.304481030 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.304526091 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.304552078 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.304579020 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.308777094 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.308806896 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.308849096 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.308882952 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.308911085 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.308938026 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.308964014 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.308990002 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.309015989 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.309041023 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.309067011 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.309092999 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.309982061 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.310009003 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.310034990 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.310060978 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.310087919 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.310115099 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.310142040 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.310201883 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.310229063 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.310255051 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.310281038 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.310307026 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.310332060 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.310378075 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.310404062 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.310431957 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.310456991 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.310514927 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.310542107 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.310566902 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.310591936 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.310617924 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.310642958 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.310689926 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.310715914 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.310741901 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.310767889 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.310794115 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.310817957 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.310839891 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.310868025 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.310893059 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.310893059 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.310924053 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.310949087 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.310975075 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.311001062 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.311049938 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.311077118 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.311101913 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.311127901 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.311155081 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.311181068 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.311229944 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.311255932 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.311284065 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.311310053 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.311335087 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.311362028 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.311428070 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.311455011 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.311480999 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.311506987 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.311532974 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.311594009 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.311620951 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.311646938 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.311671972 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.311697960 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.311753988 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.311779976 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.311805964 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.311831951 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.311857939 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.311882973 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.311908960 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.311934948 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.311980009 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.312006950 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.312032938 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.312058926 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.312086105 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.312112093 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.312160015 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.312186003 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.314008951 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.314181089 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.314261913 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.316072941 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.317044020 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.317071915 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.317118883 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.317207098 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.317253113 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.317279100 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.317308903 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.317394972 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.317421913 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.317509890 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.317537069 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.317599058 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.317625999 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.317724943 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.317751884 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.317796946 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.317825079 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.318355083 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.318382978 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.318409920 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.318434954 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.318461895 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.318487883 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.318514109 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.318540096 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.318588972 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.318615913 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.318643093 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.318669081 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.318702936 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.318723917 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.318736076 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.318747997 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.318758965 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.318769932 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.318782091 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.318794012 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.318804979 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.318816900 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.318828106 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.318839073 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.318861008 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.318871975 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.318882942 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.318893909 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.318905115 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.318916082 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.318927050 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.318938017 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.318958044 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.318969011 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.318979025 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.318989992 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.319118977 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.319132090 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.319228888 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.319297075 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.319327116 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.319340944 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.319353104 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.319364071 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.319375038 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.319392920 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.319405079 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.319416046 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.319437027 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.319447994 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.319458961 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.319470882 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.319482088 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.319502115 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.319513083 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.319525957 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.319536924 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.319576979 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.319588900 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.319745064 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.319757938 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.319768906 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.319780111 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.319799900 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.319813013 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.319823980 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.319834948 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.319854975 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.319866896 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.319914103 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.319945097 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.319981098 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.319993019 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.320050001 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.320070028 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.320090055 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.320101023 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.320113897 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.320188999 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.320202112 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.320228100 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.320240021 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.320250988 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.320265055 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.320285082 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.320372105 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.320384026 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.320405960 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.320416927 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.320430994 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.320441961 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.320743084 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.320930958 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.320997953 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.324101925 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.324281931 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.324321985 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.324415922 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.324429035 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.324460983 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.324474096 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.324486017 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.324497938 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.324517965 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.324531078 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.324552059 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.324563026 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.324584007 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.324595928 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.324666977 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.324680090 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.324774027 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.324784994 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.324836016 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.324847937 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.324860096 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.324882984 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.324893951 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.324904919 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.324927092 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.324939013 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.324949980 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.324960947 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.325004101 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.325016022 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.325037003 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.325047970 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.325139999 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.325187922 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.325198889 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.325222015 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.325233936 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.325254917 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.325265884 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.325333118 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.325344086 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.325357914 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.325368881 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.325400114 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.325449944 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.325462103 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.325474024 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.325496912 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.325509071 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.325520039 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.325531006 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.325566053 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.325577974 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.325758934 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.325824976 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.327259064 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.327272892 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.327301979 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.327312946 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.327347040 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.327359915 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.327379942 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.327402115 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.327471972 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.327483892 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.327495098 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.327507019 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.327531099 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.327543974 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.327563047 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.327574015 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.327584982 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.327596903 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.327658892 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.327671051 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.327682972 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.327693939 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.327713966 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.327724934 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.327737093 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.327748060 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.327768087 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.327780008 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.327800989 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.327812910 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.327827930 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.327840090 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.327908993 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.327920914 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.327934980 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.327955008 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.327966928 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.328007936 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.328020096 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.328032970 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.328052998 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.328063965 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.328084946 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.328097105 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.328135967 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.328147888 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.328172922 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.328183889 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.328222990 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.328233957 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.328270912 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.328283072 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.328373909 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.328386068 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.328572989 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.328639984 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.330640078 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.330651999 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.330673933 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.330686092 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.330697060 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.330709934 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.330729961 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.330777884 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.330851078 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.330863953 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.330874920 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.330885887 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.330907106 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.330919027 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.330929995 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.330944061 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.330990076 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.331002951 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.331013918 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.331024885 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.331044912 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.331058025 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.331078053 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.331089020 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.331157923 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.331170082 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.331211090 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.331222057 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.331259966 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.331270933 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.331305981 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.331373930 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.331396103 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.331407070 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.331428051 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.331439972 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.331492901 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.331505060 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.331535101 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.331546068 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.331585884 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.331597090 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.331727982 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.331739902 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.331778049 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.331891060 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.331912994 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.331924915 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.331954002 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.331998110 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.332036972 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.332050085 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.332129002 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.332140923 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.332367897 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.332434893 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.333585024 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.333597898 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.333628893 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.333641052 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.333683968 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.333695889 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.333740950 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.333751917 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.333780050 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.333812952 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.333869934 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.333890915 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.333931923 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.333971977 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.334012985 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.334024906 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.334068060 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.334079981 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.334147930 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.334160089 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.334182024 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.334193945 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.334233046 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.334244967 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.334269047 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.334280968 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.334340096 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.334352970 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.334388971 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.334402084 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.334446907 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.334459066 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.334508896 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.334521055 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.334556103 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.334568024 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.334639072 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.334650993 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.334671974 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.334685087 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.334726095 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.334737062 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.334760904 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.334825993 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.334837914 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.334850073 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.380165100 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:16.380418062 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:16.431997061 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:17.102112055 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:17.102682114 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:17.107506990 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:17.290026903 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:17.290993929 CEST	49704	26212	192.168.2.5	95.179.250.45
Sep 26, 2024 11:02:17.295892954 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:17.477485895 CEST	26212	49704	95.179.250.45	192.168.2.5
Sep 26, 2024 11:02:17.507591009 CEST	49704	26212	192.168.2.5	95.179.250.45

Target ID:	0
Start time:	05:02:02
Start date:	26/09/2024
Path:	C:\Users\user\Desktop\KBDFW9FTsq.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\KBDFW9FTsq.exe"
Imagebase:	0x380000
File size:	311'296 bytes
MD5 hash:	01995BE1C953E0F7640F17B5C2247BC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000000.2027577444.0000000000382000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2170557700.0000000002809000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2170557700.0000000002982000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	7.1%
Total number of Nodes:	113
Total number of Limit Nodes:	13

Executed Functions

Function 0661B3B3 Relevance: 13.4, APIs: 1, Strings: 6, Instructions: 1103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

3jRl^, xrefs: 0661BFE4, 0661BFE9
#jRl^, xrefs: 0661C05D, 0661C062
#>, xrefs: 0661BA42, 0661BA47
CjRl^, xrefs: 0661BF91, 0661BF96
cjRl^, xrefs: 0661BEC4, 0661BEC9
SjRl^, xrefs: 0661BF17, 0661BF1C

Memory Dump Source

Source File: 00000000.00000002.2177640499.0000000006610000.00000040.00000800.00020000.00000000.sdmp, Offset: 06610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6610000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID: #>$#jRl^$3jRl^$CjRl^$SjRl^$cjRl^
API String ID: 0-3258293859
Opcode ID: e97c801ee9906c54b9a5b8fa7d246c32a5888b3f872e9ba1a0e57e9ebeaa3941
Instruction ID: f658832e82c6949a835b52eb67a137c1b27740f16ca4967865048568eccb0ddc
Opcode Fuzzy Hash: e97c801ee9906c54b9a5b8fa7d246c32a5888b3f872e9ba1a0e57e9ebeaa3941
Instruction Fuzzy Hash: CAC2AE74A01229CFDBA4EF24D898B9DB7B2FB89301F1095E9D909A7354DB346E85CF40

Function 0661F538 Relevance: 6.7, Strings: 5, Instructions: 446
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hwq, xrefs: 0661F968
Hwq, xrefs: 0661F9CA
Hwq, xrefs: 0661FA58
Hwq, xrefs: 0661FA11
Hwq, xrefs: 0661F999

Memory Dump Source

Source File: 00000000.00000002.2177640499.0000000006610000.00000040.00000800.00020000.00000000.sdmp, Offset: 06610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6610000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID: Hwq$Hwq$Hwq$Hwq$Hwq
API String ID: 0-154242596
Opcode ID: c311e7e89a7b20754891c656a8bd694cbb503b669f426c31f7446f1aab83f868
Instruction ID: d20d85cf1422eddc930ebc9481334ba3312ca17ee512b1915b67285b9cbe60d5
Opcode Fuzzy Hash: c311e7e89a7b20754891c656a8bd694cbb503b669f426c31f7446f1aab83f868
Instruction Fuzzy Hash: DC02B031E04256CFCB55DF75C4502ADFBF2BF85300F28866AD446AF251EB74AA86CB90

Function 0661DA28 Relevance: 2.9, Strings: 2, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

., xrefs: 0661DCA8
1, xrefs: 0661DD2D

Memory Dump Source

Source File: 00000000.00000002.2177640499.0000000006610000.00000040.00000800.00020000.00000000.sdmp, Offset: 06610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6610000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID: .$1
API String ID: 0-1839485796
Opcode ID: 1a3fa669e7c24e302aa7ed9ea002bbe95a8d9b3b2c012bf09b9f732239c43d8f
Instruction ID: 7a9389a6f5e4231f14f5acde0c0e4d855b685310d4ab7aa6aa3a62dc3f5f0637
Opcode Fuzzy Hash: 1a3fa669e7c24e302aa7ed9ea002bbe95a8d9b3b2c012bf09b9f732239c43d8f
Instruction Fuzzy Hash: 88F1CF74E01229CFDB68DF65C984B9DBBB2FF8A301F1081A9D509AB250DB359E85CF50

Function 0661A920 Relevance: 2.7, Strings: 2, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$sq, xrefs: 0661AA72
$sq, xrefs: 0661AA82

Memory Dump Source

Source File: 00000000.00000002.2177640499.0000000006610000.00000040.00000800.00020000.00000000.sdmp, Offset: 06610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6610000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID: $sq$$sq
API String ID: 0-1184984226
Opcode ID: 73ad4e8fdfcd2be291a1efa6dddde35a0d4a6b42637382de153e0b2cb6549270
Instruction ID: b3be1b7b1f6b63c6549edd3de917b254a32bb578751c06abde4c0642c2364e56
Opcode Fuzzy Hash: 73ad4e8fdfcd2be291a1efa6dddde35a0d4a6b42637382de153e0b2cb6549270
Instruction Fuzzy Hash: 2E91E270E01218CFDB58DFA9D584A9DBBF2FF89301F208469E409AB355DB359986CF50

Function 06613E78 Relevance: 1.6, APIs: 1, Instructions: 60libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 06613EDD

Memory Dump Source

Source File: 00000000.00000002.2177640499.0000000006610000.00000040.00000800.00020000.00000000.sdmp, Offset: 06610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6610000_KBDFW9FTsq.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e89bc46300d88728c81e7e4480db3375c2a95b0e2d6ea2b2c2dc2e86b775881d
Instruction ID: d1e3032837bd32584b1579ca53818ea33ff4b0acc3ea4e06714749d25b030804
Opcode Fuzzy Hash: e89bc46300d88728c81e7e4480db3375c2a95b0e2d6ea2b2c2dc2e86b775881d
Instruction Fuzzy Hash: D121BF74E012589FCB48DFA9E484ADDBBB2FB89320F14902AE415B7360DB305881CF64

Function 05FCA688 Relevance: 1.6, Strings: 1, Instructions: 305COMMON

Download Yara Rule

Strings

fboieaf, xrefs: 05FCA836

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID: fboieaf
API String ID: 0-4216440741
Opcode ID: c08cbd94db3fe2f6a6d9014b224e6df3e0520cc724e200fa7982fdb8f3fff5cc
Instruction ID: bb6432875060ee96bfb1d36aa56a2ecc1c828909d22b7d5edbeede7122c56338
Opcode Fuzzy Hash: c08cbd94db3fe2f6a6d9014b224e6df3e0520cc724e200fa7982fdb8f3fff5cc
Instruction Fuzzy Hash: 88D1F570900318CFDB18EFB4D854A9DBBB2FF8A301F1095A9E54AAB395DB315989CF41

Function 06616DE0 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

\VOj, xrefs: 06617097

Memory Dump Source

Source File: 00000000.00000002.2177640499.0000000006610000.00000040.00000800.00020000.00000000.sdmp, Offset: 06610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6610000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID: \VOj
API String ID: 0-304670344
Opcode ID: 3a2c8731378e139bf2066c36729a97f64e116a6275ebdb5bc264545b2cb93d11
Instruction ID: ece8eafcb80d54b470e4dcf5016b373d0fea81a6154130e7d040462e3070aa3a
Opcode Fuzzy Hash: 3a2c8731378e139bf2066c36729a97f64e116a6275ebdb5bc264545b2cb93d11
Instruction Fuzzy Hash: 98B17D70E00209CFDB50CFA9D9857EEBBF2AF88314F188529E415EB394EB759845CB81

Function 06619C90 Relevance: 1.4, Strings: 1, Instructions: 196COMMON

Download Yara Rule

Strings

+E, xrefs: 06619E8E, 06619E93

Memory Dump Source

Source File: 00000000.00000002.2177640499.0000000006610000.00000040.00000800.00020000.00000000.sdmp, Offset: 06610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6610000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID: +E
API String ID: 0-2499271914
Opcode ID: 36d0c0a48e7758447c66a63a9e1d75e12c8d714d4c434864a95f82fd4412dc75
Instruction ID: 8d5dc65f8d24e7511432db99bcd0010d402e44819c7491d723d741bbb93e94b8
Opcode Fuzzy Hash: 36d0c0a48e7758447c66a63a9e1d75e12c8d714d4c434864a95f82fd4412dc75
Instruction Fuzzy Hash: 34910374D01219CFDB64DFA9C994B9DBBB2FF89300F1091A9E909AB351DB705A89CF40

Function 0661A008 Relevance: .4, Instructions: 426COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177640499.0000000006610000.00000040.00000800.00020000.00000000.sdmp, Offset: 06610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6610000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46fb9aa8e2eaa1ad72cf7730a88a3d0e60843d01a2614ebc7754f0393c58424d
Instruction ID: 206a4ec463471129a210bacd08e1a815ecc52a61eaec3e692a64f545f3fc6c7e
Opcode Fuzzy Hash: 46fb9aa8e2eaa1ad72cf7730a88a3d0e60843d01a2614ebc7754f0393c58424d
Instruction Fuzzy Hash: DF227E74D01229CFDBA5DF65C854BD9B7B2BF89300F1085EAD509AB250EB31AE85CF50

Function 05FC67D8 Relevance: .4, Instructions: 411COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e2971a7a9b19474f3bf8dd1b06623b2be3cfbb2e03091a7b430d8727069a2bd
Instruction ID: 729e87e98e61829b9f33c69ff544ca6904a6bac961933bb83aec53b3e524532a
Opcode Fuzzy Hash: 5e2971a7a9b19474f3bf8dd1b06623b2be3cfbb2e03091a7b430d8727069a2bd
Instruction Fuzzy Hash: 31F1B271A0420A9FCB05DF69D984B9EBBF2FF84300F1485A9E505EB2A1DB35ED45CB90

Function 06618D2A Relevance: .4, Instructions: 408COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177640499.0000000006610000.00000040.00000800.00020000.00000000.sdmp, Offset: 06610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6610000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6ca66a6ce0f455e238a3564f54f77544c30fc5f2c4d99f1892eb054e6c78a65
Instruction ID: 65d79bd5a2db6c7c5ff3d6517b2c27ce1020d458089dc46264675d2a305c43e0
Opcode Fuzzy Hash: a6ca66a6ce0f455e238a3564f54f77544c30fc5f2c4d99f1892eb054e6c78a65
Instruction Fuzzy Hash: BE224CB4E012288FDB64DF69C994BDDBBB2BB49300F1081EAD509AB350DB319E85DF50

Function 066113B0 Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177640499.0000000006610000.00000040.00000800.00020000.00000000.sdmp, Offset: 06610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6610000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca2fde0c5399f52fbd8a991e37ed3ade0a57ecda4aa7296b0183d353edafbb6f
Instruction ID: 89e2ddb92815f0efdeca473a3884eb818584d1784e03e43c9dbd0e7042dd5916
Opcode Fuzzy Hash: ca2fde0c5399f52fbd8a991e37ed3ade0a57ecda4aa7296b0183d353edafbb6f
Instruction Fuzzy Hash: 1BE11E74E002199FDF88DBF5C895AAEBBB6EF88300F105019A60ABB355DF306D85DB54

Function 066113C0 Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177640499.0000000006610000.00000040.00000800.00020000.00000000.sdmp, Offset: 06610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6610000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57236f9d02b61f8546f56e506a4e950f3c92548ef749aa7b69d270af7bfdffa5
Instruction ID: 36fc9887c279c7e272eb1a938b68c313e9e8b5f254938cd7509aa0b007536cef
Opcode Fuzzy Hash: 57236f9d02b61f8546f56e506a4e950f3c92548ef749aa7b69d270af7bfdffa5
Instruction Fuzzy Hash: 4DE11E74E002199FDF88DBF5C895AAEBBB6EF88300F105019A60ABB355CF316D85DB54

Function 0661CD78 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177640499.0000000006610000.00000040.00000800.00020000.00000000.sdmp, Offset: 06610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6610000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b6942bc41f3d4084b5416e8822d15e3d3a25d029cbe56fd20bc4fd5a40cd61f
Instruction ID: 78a8eb4de8692917f4ba2b9e1788e46b1a4534206fe9d7fb84d2bdff7035cb35
Opcode Fuzzy Hash: 6b6942bc41f3d4084b5416e8822d15e3d3a25d029cbe56fd20bc4fd5a40cd61f
Instruction Fuzzy Hash: 49C1B3B0D01229CFDB68DF65C850BDEBBB2BF89300F5481AAD509AB250DB755A85CF90

Function 066176B0 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177640499.0000000006610000.00000040.00000800.00020000.00000000.sdmp, Offset: 06610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6610000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c681982f2846c6f632edd08d7890c53ec6d3a08c5d43f73ce12524b64a46279
Instruction ID: 17e5002f699d00756f9a145031f2d26fe36dea09ef01188e297efbe5cf263771
Opcode Fuzzy Hash: 0c681982f2846c6f632edd08d7890c53ec6d3a08c5d43f73ce12524b64a46279
Instruction Fuzzy Hash: D8B15C70E0020A9FDB90CFA9D99579DBFF2EF88314F188529E415EB394EB749845CB81

Function 05FB0D80 Relevance: 20.6, Strings: 16, Instructions: 622
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$sq, xrefs: 05FB137B
$sq, xrefs: 05FB13EB
$sq, xrefs: 05FB0E78
$sq, xrefs: 05FB1461
$sq, xrefs: 05FB0FB8
$sq, xrefs: 05FB0F36
$sq, xrefs: 05FB0E02
$sq, xrefs: 05FB1455
$sq, xrefs: 05FB0FAC
$sq, xrefs: 05FB13AC
$sq, xrefs: 05FB1336
$sq, xrefs: 05FB0F86
$sq, xrefs: 05FB13A0
$sq, xrefs: 05FB0E52
$sq, xrefs: 05FB1430
$sq, xrefs: 05FB0E84

Memory Dump Source

Source File: 00000000.00000002.2176592365.0000000005FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fb0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID: $sq$$sq$$sq$$sq$$sq$$sq$$sq$$sq$$sq$$sq$$sq$$sq$$sq$$sq$$sq$$sq
API String ID: 0-2105939943
Opcode ID: bbf0f70f7968050f8e15cd8e7cfc9528173d1c77b4cbaf25a9e63db96642b24c
Instruction ID: af562ce8f74e4758c5c2eb1d40e68d83f4d2b69768e88c0e04b18288850ad2ad
Opcode Fuzzy Hash: bbf0f70f7968050f8e15cd8e7cfc9528173d1c77b4cbaf25a9e63db96642b24c
Instruction Fuzzy Hash: 54227F30B04145DFEB149B6AC858ABEBBEAFF88200F158469E506C7392DF78DC45CB51

Function 05FB1582 Relevance: 7.8, Strings: 6, Instructions: 339
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$sq, xrefs: 05FB182E
$sq, xrefs: 05FB1A7C
$sq, xrefs: 05FB1A57
$sq, xrefs: 05FB1A88
$sq, xrefs: 05FB18E3
$sq, xrefs: 05FB1A12

Memory Dump Source

Source File: 00000000.00000002.2176592365.0000000005FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fb0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID: $sq$$sq$$sq$$sq$$sq$$sq
API String ID: 0-3087168343
Opcode ID: 301843d694e1d93533398e2a323c9143be290e20514cb93f2625be5406fb6751
Instruction ID: a4a4cbc8a45a0093830869e8330f0c01d72e29f4ada40d36b893fad646c04e53
Opcode Fuzzy Hash: 301843d694e1d93533398e2a323c9143be290e20514cb93f2625be5406fb6751
Instruction Fuzzy Hash: ADC1B174B042449FEB149BA9C8A8E6F77EBBB85300F108429E602CB392DFB8DC05C751

Function 00D1D0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00D1D136
GetCurrentThread.KERNEL32 ref: 00D1D173
GetCurrentProcess.KERNEL32 ref: 00D1D1B0
GetCurrentThreadId.KERNEL32 ref: 00D1D209

Memory Dump Source

Source File: 00000000.00000002.2170168733.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d10000_KBDFW9FTsq.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: f2cfeadfd3dfa4ffaf4fe0b18d39e6ffadc436f38812255ceeb6c467eda9260b
Instruction ID: 301c6e016f12611bdc665d33722f7da3c4d0748b03a7d5f76b30773038923fde
Opcode Fuzzy Hash: f2cfeadfd3dfa4ffaf4fe0b18d39e6ffadc436f38812255ceeb6c467eda9260b
Instruction Fuzzy Hash: B4517AB0900349DFDB14DFA9D948BDEBBF2EF48314F24845AE419A7350CB74A984CB65

Function 00D1D0A8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00D1D136
GetCurrentThread.KERNEL32 ref: 00D1D173
GetCurrentProcess.KERNEL32 ref: 00D1D1B0
GetCurrentThreadId.KERNEL32 ref: 00D1D209

Memory Dump Source

Source File: 00000000.00000002.2170168733.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d10000_KBDFW9FTsq.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: c7389599ac5688bad673aafd93f74f60ad4f5cdc56adbebec231f63dd9418983
Instruction ID: 56889a800074e73fc624afd3c2ce552cbd541e4f4015dd08437f905312671ef4
Opcode Fuzzy Hash: c7389599ac5688bad673aafd93f74f60ad4f5cdc56adbebec231f63dd9418983
Instruction Fuzzy Hash: C25178B0900349DFDB14DFA9D948BDEBBF2EF88314F24805AE419A7360CB349984CB65

Function 05FC8C78 Relevance: 2.6, Strings: 2, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(wq, xrefs: 05FC8D00
(wq, xrefs: 05FC8D2C

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID: (wq$(wq
API String ID: 0-707371155
Opcode ID: 1c24207a5b8e8777f0a4dfa4e9bb65160e25606b679846ac77773f4da2ff715d
Instruction ID: 5323686945f6c46383715236bfb089933e178650e6e55bec939f676bbae6225c
Opcode Fuzzy Hash: 1c24207a5b8e8777f0a4dfa4e9bb65160e25606b679846ac77773f4da2ff715d
Instruction Fuzzy Hash: E53136327081582BEF486E689805B6F7A9BFFC5390F144029F909DB344CE399D0287E1

Function 00D1AE30 Relevance: 1.7, APIs: 1, Instructions: 197COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00D1B086

Memory Dump Source

Source File: 00000000.00000002.2170168733.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d10000_KBDFW9FTsq.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f3a2538507ca6177e60059c0e91e214c730134323717676522bfc5bc631e8831
Instruction ID: b939cd51b2e0e9dab71318e504d85f77e67f36b5140bfde1f0f24b6c650ab47c
Opcode Fuzzy Hash: f3a2538507ca6177e60059c0e91e214c730134323717676522bfc5bc631e8831
Instruction Fuzzy Hash: 51715BB0A01B059FDB24DF29D04179ABBF1FF88304F04892DE44AD7A51DB34E946CBA1

Function 05FC3F50 Relevance: 1.6, Strings: 1, Instructions: 396COMMON

Download Yara Rule

Strings

$sq, xrefs: 05FC41E4

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID: $sq
API String ID: 0-923501781
Opcode ID: e748a0fb1f6eb71c58043ac684da01375b5dfc7df8acf68fef2dbc7cb4e2fc86
Instruction ID: 12f7aa9a3583ea45acd42866eb404f7ee8a475c47bb7ddc6a4bc41c93c9c468c
Opcode Fuzzy Hash: e748a0fb1f6eb71c58043ac684da01375b5dfc7df8acf68fef2dbc7cb4e2fc86
Instruction Fuzzy Hash: 83E13F74B002068FCB14DF69C594AAEBBF6BF88601B1485A9E906EB365DF34DC01CB90

Function 06613C97 Relevance: 1.6, APIs: 1, Instructions: 129COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 06613DF0

Memory Dump Source

Source File: 00000000.00000002.2177640499.0000000006610000.00000040.00000800.00020000.00000000.sdmp, Offset: 06610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6610000_KBDFW9FTsq.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 77e53d88a4ea8fae111418d7c12d421247b280ba40059eae6f80613e69320d06
Instruction ID: 2c72c64c95f0579cee65e83e8e537a107592c9f33493e1127b42d59e3189d10f
Opcode Fuzzy Hash: 77e53d88a4ea8fae111418d7c12d421247b280ba40059eae6f80613e69320d06
Instruction Fuzzy Hash: ED51C2B4E012089FDB58DFA5E5546EEBBB2FF88300F24942AE416BB355DB349946CF40

Function 00D14248 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00D159F1

Memory Dump Source

Source File: 00000000.00000002.2170168733.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d10000_KBDFW9FTsq.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 4464ec6ca2ea914dea469e1560b7f9b7ef7a303c70d099d5092cc35c8504e682
Instruction ID: 87b241df17e702ae8be8fab56acb382a2a9ed94c5a5d7cfbc89a035e195b46bc
Opcode Fuzzy Hash: 4464ec6ca2ea914dea469e1560b7f9b7ef7a303c70d099d5092cc35c8504e682
Instruction Fuzzy Hash: 5A41D2B0D00619DBDB24CFA9D984BCDBBF5FF88304F20815AD408AB255DB75694ACF90

Function 00D15935 Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00D159F1

Memory Dump Source

Source File: 00000000.00000002.2170168733.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d10000_KBDFW9FTsq.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 3243c3c8e3a34b604cc153f2072e3e9c7dc55a3ba87c363927018e590ece8bdb
Instruction ID: 1fce2b7df5524f8ce32fff30a0dc8e79e54a5f4979d5c31b9145fd1fa0c6cfe1
Opcode Fuzzy Hash: 3243c3c8e3a34b604cc153f2072e3e9c7dc55a3ba87c363927018e590ece8bdb
Instruction Fuzzy Hash: 8A41E0B0C00619CADB24DFA9D984BCDBBF5FF88304F24815AD408AB255DB75698ACF90

Function 00D1D300 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00D1D387

Memory Dump Source

Source File: 00000000.00000002.2170168733.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d10000_KBDFW9FTsq.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 87ca4e9022964697c63cde121ca55ad231c966b9d3ba6041c64dfbdd43787ab7
Instruction ID: ce24828401e2e19a898c320689b24ceecb2dc5914b3911a2a0c5be6d3f925032
Opcode Fuzzy Hash: 87ca4e9022964697c63cde121ca55ad231c966b9d3ba6041c64dfbdd43787ab7
Instruction Fuzzy Hash: EA21E3B5900208AFDB10CF9AD984ADEBBF9EB48320F14801AE918A3310C374A944CFA1

Function 00D1D2F9 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00D1D387

Memory Dump Source

Source File: 00000000.00000002.2170168733.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d10000_KBDFW9FTsq.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e411e58e4cbe5b11ce3ec50a42bd7ea15fe6ca9e6945059bb5b27f93c85d6488
Instruction ID: 16b8050d0058f2e5c8808cdf1b03e427671b83a8abf013207150fc3371a9f5f8
Opcode Fuzzy Hash: e411e58e4cbe5b11ce3ec50a42bd7ea15fe6ca9e6945059bb5b27f93c85d6488
Instruction Fuzzy Hash: F121E3B5900209DFDB10CF99E584ADEBBF5FB48314F24801AE918A3310C378A954CF65

Function 06613ACB Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetKeyboardLayout.USER32(00000000), ref: 06613B36

Memory Dump Source

Source File: 00000000.00000002.2177640499.0000000006610000.00000040.00000800.00020000.00000000.sdmp, Offset: 06610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6610000_KBDFW9FTsq.jbxd

Similarity

API ID: KeyboardLayout
String ID:
API String ID: 194098044-0
Opcode ID: 01ab6e087fc277e4030aeb92cc07d4b87ea443a1f703d7995bd22ae2974aebf0
Instruction ID: e9a9200a168655ab369a56d99730617e02f479959c34eff15c7ac121b99600f7
Opcode Fuzzy Hash: 01ab6e087fc277e4030aeb92cc07d4b87ea443a1f703d7995bd22ae2974aebf0
Instruction Fuzzy Hash: 151123B19002489FCB60DFA9D849A9EBFF4EB48224F14845AD519AB340D635A944CFA5

Function 06613BCB Relevance: 1.5, APIs: 1, Instructions: 47comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06613C25

Memory Dump Source

Source File: 00000000.00000002.2177640499.0000000006610000.00000040.00000800.00020000.00000000.sdmp, Offset: 06610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6610000_KBDFW9FTsq.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 7c8fae0e403609ce2018959be230a1b861c4d3446565f1c203941b88fb537537
Instruction ID: 57ccdd578583587c9f6589ab7ad1b16cb9a181e662609f671e96dc87b6c967bd
Opcode Fuzzy Hash: 7c8fae0e403609ce2018959be230a1b861c4d3446565f1c203941b88fb537537
Instruction Fuzzy Hash: 3511F2B59002488FCB20DF9AD985B8EBFF8EB48324F24841AD519A7300C378A544CFA5

Function 066108D9 Relevance: 1.5, APIs: 1, Instructions: 47comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06613C25

Memory Dump Source

Source File: 00000000.00000002.2177640499.0000000006610000.00000040.00000800.00020000.00000000.sdmp, Offset: 06610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6610000_KBDFW9FTsq.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 5264ea39fb5b109b465857130407da9a0c071034fd71ed0e5a1634f1329a2d17
Instruction ID: 50aa416771377bb45c22b3eb10b4779c5c73c18d4ab5b16cf8bd95f52b41823a
Opcode Fuzzy Hash: 5264ea39fb5b109b465857130407da9a0c071034fd71ed0e5a1634f1329a2d17
Instruction Fuzzy Hash: 871125B08047488FCB10DF9AD588B9ABFF8EB48324F249459D519A7301C374A544CBA5

Function 00D1B020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00D1B086

Memory Dump Source

Source File: 00000000.00000002.2170168733.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d10000_KBDFW9FTsq.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 828a203a9ca90f8e623dac142de4b4a0f31999138c276eaba67fe2a55b9c0ad5
Instruction ID: 18cf69a0e924a72f6dc43290187286403db0272b8deff1f8e2af5e016b0bcbf6
Opcode Fuzzy Hash: 828a203a9ca90f8e623dac142de4b4a0f31999138c276eaba67fe2a55b9c0ad5
Instruction Fuzzy Hash: 0311D2B5C007499FCB20DF9AD444ADEFBF4AB89324F14841AD429B7610C775A545CFA1

Function 066108DC Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06613C25

Memory Dump Source

Source File: 00000000.00000002.2177640499.0000000006610000.00000040.00000800.00020000.00000000.sdmp, Offset: 06610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6610000_KBDFW9FTsq.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 10fbf2050b7f08a1d82854319b81877262bff7ca67dcfa238f0c03df49492af6
Instruction ID: 9ba0c5aea9cd50bd11816d85e12fabda8ac8b3e6c5ce3b43e5b75e587e28db6b
Opcode Fuzzy Hash: 10fbf2050b7f08a1d82854319b81877262bff7ca67dcfa238f0c03df49492af6
Instruction Fuzzy Hash: EA1133B18006488FDB20DF9AD588B9EBBF8EB48324F248459D519B7300C378A944CFA4

Function 05FC59C8 Relevance: 1.5, Strings: 1, Instructions: 289COMMON

Download Yara Rule

Strings

d, xrefs: 05FC5C29

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: b9e577d24290f96a8f2f92d79ea3dccc7960071de0462d7a2a75496c1a1d4e17
Instruction ID: 4d682d113427372758c7f60efe24c9da426fc8d5777bf1d267ebf39d89f24ba7
Opcode Fuzzy Hash: b9e577d24290f96a8f2f92d79ea3dccc7960071de0462d7a2a75496c1a1d4e17
Instruction Fuzzy Hash: 1DC15B35600602CFCB24DF29C580D6ABBF2FF89314B55C9A9D45A9B765DB34F846CB80

Function 05FB1BA0 Relevance: 1.5, Instructions: 1461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176592365.0000000005FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fb0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52e0f6b0251e6f7e0053a9dacdac99f1eab18c75a140afa6a4f504d2c07b74f2
Instruction ID: 4ca79e32f1bec99a6244ba218fe1ad0c7778b161dee1e60264ba07976f895ea5
Opcode Fuzzy Hash: 52e0f6b0251e6f7e0053a9dacdac99f1eab18c75a140afa6a4f504d2c07b74f2
Instruction Fuzzy Hash: 2EC27D74B001189FDB54DF68C891AEDBBB2FF89700F108499E60AAB3A1DB71AD45CF51

Function 05FC3DE0 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

4'sq, xrefs: 05FC3F25

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID: 4'sq
API String ID: 0-1075809040
Opcode ID: 86cbea64b4822197fe7e88e997a72dff9e795ebbb7afa3e8b095f5b50ce97206
Instruction ID: 4b0b0f1c1d1c71e61e5efba5ea4ad06ed09758ed5c28b2b52ec73ba479633459
Opcode Fuzzy Hash: 86cbea64b4822197fe7e88e997a72dff9e795ebbb7afa3e8b095f5b50ce97206
Instruction Fuzzy Hash: 1131E4727002118BC719B738E45166E77E6DFC6354704487EE44ACB781DE39EC078790

Function 05FC84C8 Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

4'sq, xrefs: 05FC85B1

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID: 4'sq
API String ID: 0-1075809040
Opcode ID: 1b3a60b8696f8d5b0f182f7a649cce3b9e197fdf57349aa1f03eb49f6451c1a6
Instruction ID: 2a869bd6ba4d3397613c82eaf5aa2e6c69a580487be3d248e22b1d6fa77178b7
Opcode Fuzzy Hash: 1b3a60b8696f8d5b0f182f7a649cce3b9e197fdf57349aa1f03eb49f6451c1a6
Instruction Fuzzy Hash: B631CF717002048BCF09BB7894A55AEBBE3AFC8211B54443DD516DB385EF38DE068795

Function 05FC3EC8 Relevance: 1.3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

Strings

4'sq, xrefs: 05FC3F25

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID: 4'sq
API String ID: 0-1075809040
Opcode ID: cd71bf41cee707b1f1fe7ac79b7c72cec9c945a16fab8bf3fc8a6b73af567abe
Instruction ID: 5858a97ee8a704dea6cdcd2d7887c96c149dd0c1adca276980f0f10b0ef30666
Opcode Fuzzy Hash: cd71bf41cee707b1f1fe7ac79b7c72cec9c945a16fab8bf3fc8a6b73af567abe
Instruction Fuzzy Hash: 86F0B4313002058BC60DFB29E49596E77EBEFC9250350592DE04A8B715EF30ED4697E1

Function 05FCB628 Relevance: 1.3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

Strings

4'sq, xrefs: 05FCB669

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID: 4'sq
API String ID: 0-1075809040
Opcode ID: 50c516582f8f57cc41152a3af3d9a91c4e97a6d215c24af2a5ab3c949936aff7
Instruction ID: 0b2f6b61d5c1fffdb54f95e19180e6f4f9d5624e2f5797929aaf6ebdc470f2f0
Opcode Fuzzy Hash: 50c516582f8f57cc41152a3af3d9a91c4e97a6d215c24af2a5ab3c949936aff7
Instruction Fuzzy Hash: FA01FC709083869FCB0AEFB8E49889C7F71FB82210B1815DDE062AB293CA341E40DB01

Function 05FCB638 Relevance: 1.3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

Strings

4'sq, xrefs: 05FCB669

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID: 4'sq
API String ID: 0-1075809040
Opcode ID: 4dae3e6093e97471b9807552debedd10cd4b4287e52890422df6faf29b1ba808
Instruction ID: 5a3496724cff62e3d395bff3cf99e59474b84a78d6108a4334e1f16b119239e8
Opcode Fuzzy Hash: 4dae3e6093e97471b9807552debedd10cd4b4287e52890422df6faf29b1ba808
Instruction Fuzzy Hash: 01F08C70E01209EFCF09EFB8E49995CBBB5FB85200B2055ACE406E7341DB341E44DB41

Function 05FB00D8 Relevance: .7, Instructions: 676COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176592365.0000000005FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fb0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7312cfb5602a51ee0705b70c5f7387c81bc11ec4adb316b92b92bb2eba293f2b
Instruction ID: 1eb27585101ae23b1141f90d52d290713535a0d0990b848790c8561bc432ab2e
Opcode Fuzzy Hash: 7312cfb5602a51ee0705b70c5f7387c81bc11ec4adb316b92b92bb2eba293f2b
Instruction Fuzzy Hash: B94269747406288FCB28EB78C49466EB7B2FBC5704B50591CD503AB392CF7AED058B86

Function 05FB3838 Relevance: .6, Instructions: 634COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176592365.0000000005FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fb0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68c53a9c21f1b83cef01e03330fc9f43e3b2ee945086dbe018613eee84febb2d
Instruction ID: 8e692147718bcd3468e13d6990d72214450f67c49dd8453049d3b582f7a19020
Opcode Fuzzy Hash: 68c53a9c21f1b83cef01e03330fc9f43e3b2ee945086dbe018613eee84febb2d
Instruction Fuzzy Hash: E8422534B40214DFDB44DF69C994EAEBBF6BF88700F118499E606DB3A1DA71ED448B50

Function 05FC48A8 Relevance: .5, Instructions: 501COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bc13bcd8893c0b42742027dc25893e68f44f4afc171022dd9071ec833b72f30
Instruction ID: 98883d5184b51d35bd740b3725764a23c5a8ca4baa23e91ff748d916682cf946
Opcode Fuzzy Hash: 9bc13bcd8893c0b42742027dc25893e68f44f4afc171022dd9071ec833b72f30
Instruction Fuzzy Hash: BC123775B006068FCB14DF29C598A6ABBF2FF89305B1584ACE546DB3A2DB34EC45CB50

Function 05FB00B8 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176592365.0000000005FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fb0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8ebe35f10f9333c0d4af61a8e0057d69f9a7064b7ea90116a1cc71aa348e127
Instruction ID: 5c3aabbf77c7c152a171016318ffd3857cff9ce1e01fb298eca75b279a77707d
Opcode Fuzzy Hash: b8ebe35f10f9333c0d4af61a8e0057d69f9a7064b7ea90116a1cc71aa348e127
Instruction Fuzzy Hash: 00C15074B05204DFEB049B65C859B7A7BABFF89700F108065E6029B3A2CFB9DD45CB51

Function 05FC7D58 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 428b5b8647cd6b0d24a819da38264fcdd5421363de3771c3293da7e91a61ee1e
Instruction ID: 7bc75e92049cebc9ab60e09fe2d2cdfa9d6d1a5df4b904e30e43ed4330a801c0
Opcode Fuzzy Hash: 428b5b8647cd6b0d24a819da38264fcdd5421363de3771c3293da7e91a61ee1e
Instruction Fuzzy Hash: 69512671E012199BDB18DFA9D985B9EBFF6FF48300F14806DE415A7244DB78A846CF90

Function 05FB34D8 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176592365.0000000005FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fb0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a5ee3c63425b87b9c8aedccaa7c70c788db8d73aba53c034424ff586f127883
Instruction ID: 634ed511f19f3a6d6a7bbf951076a2a50eabdce8e02a71ba022a851c3cf56b61
Opcode Fuzzy Hash: 4a5ee3c63425b87b9c8aedccaa7c70c788db8d73aba53c034424ff586f127883
Instruction Fuzzy Hash: 33513735B405199FDB44DF69C884DAEBBB2FF89310B118469E906EB3A1EB70ED05CB50

Function 05FC7D4C Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ca14db09d109ba328bb295ecf984c4d01acb0db26942f8b5ac5b002918a9988
Instruction ID: ef9e28c6f75b96f082e038aeab453e03bbc1a0b4757bc901e460e5cb135c399e
Opcode Fuzzy Hash: 6ca14db09d109ba328bb295ecf984c4d01acb0db26942f8b5ac5b002918a9988
Instruction Fuzzy Hash: B25126B1D012199BDB18DFA9CA85B9DBBF6FF48304F14852EE405A7244DB789846CF90

Function 05FC5579 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb513e07da7c3859a57aa068ddd2413d12391df418bb653591754f748dfff260
Instruction ID: 90da927cb2eb3e85e16f546a9ef8eb58fe53eabd7946e8a44a275718342ec8eb
Opcode Fuzzy Hash: bb513e07da7c3859a57aa068ddd2413d12391df418bb653591754f748dfff260
Instruction Fuzzy Hash: 3A313275B012119FCB05DF39D884A6EBFB2BF89204B5084A9E906CB3A5DF31ED05DB90

Function 05FC5588 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94cd61548747c0c02a6775152197ae52224ea04c2d9f1274a1cf0431b10ffee9
Instruction ID: 5027a7b5107f5db3ce72f520c3d04024c2cffb12352221ea085ed63a57711a51
Opcode Fuzzy Hash: 94cd61548747c0c02a6775152197ae52224ea04c2d9f1274a1cf0431b10ffee9
Instruction Fuzzy Hash: 8E313575B012119FCB15DF39D88496EBFB2BF89204B5084A9E906CB355DF31ED05CB90

Function 05FC87A0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0334c4a89035128193f76997fd23703c79a285016fea5157f02f21ff8ade383e
Instruction ID: 140db3a3094f059a3a9e3a54b882d636be5b08f8e87e34073020768cc1bea8e3
Opcode Fuzzy Hash: 0334c4a89035128193f76997fd23703c79a285016fea5157f02f21ff8ade383e
Instruction Fuzzy Hash: 4F41F2B1D012499FDB14DFAAD984ADEFFF6AF88310F14806AE415B7290DB34A945CF90

Function 05FCFEE0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63df046a6bda8b9e8d271f95ac81f8b1ee688ec17e0e0d160d2367cd75160813
Instruction ID: bcbd40affde64e99ad9cc7ef978f2b39fb3f2bd1829f501d7418b212947166d9
Opcode Fuzzy Hash: 63df046a6bda8b9e8d271f95ac81f8b1ee688ec17e0e0d160d2367cd75160813
Instruction Fuzzy Hash: 0A2135307093885FCB159B78A81466A7FAAEF82314F1445BEF849CB392CE36CC42C791

Function 05FC8795 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 216f1aa03afc0c535364679494388d373c1d024432e4232aac33dc7137e4a401
Instruction ID: 1bda6db8ee73409f0a7621ab10bc52b0c2aea31b5e73c6c3af7ac2a363b79880
Opcode Fuzzy Hash: 216f1aa03afc0c535364679494388d373c1d024432e4232aac33dc7137e4a401
Instruction Fuzzy Hash: 4D3103B1D012499FDB14DFA9DA85ADEBFF6AF88300F14802AE405B7290DB349945CF50

Function 05FC8A98 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9038001b4ae703dd88985a4a82ea0e7a19639d1dd9c9b2755b6a9613e74de0eb
Instruction ID: e20030103a06ceedffe442a3b122b60934ad09f4418dbe0f625e663489cbae7e
Opcode Fuzzy Hash: 9038001b4ae703dd88985a4a82ea0e7a19639d1dd9c9b2755b6a9613e74de0eb
Instruction Fuzzy Hash: F43116B1D01219DFCB14CFA9D980ADEBFF9BF48350F14806AE405B7240CB75A846CB90

Function 00C9D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2169983653.0000000000C9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c9d000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d111e3fc49f0009ed21ba86580fff11909995fbbbaf02bcbcbae718cdf7fae09
Instruction ID: 708d5cca189617ac28a65bc88a53ef63498fdce5b86795ed6639afe32dc05900
Opcode Fuzzy Hash: d111e3fc49f0009ed21ba86580fff11909995fbbbaf02bcbcbae718cdf7fae09
Instruction Fuzzy Hash: 4D2145B1104200DFDF04DF04C9C8B26BF65FB98324F20C569E90B2B256C33AE856CBA2

Function 05FB1069 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176592365.0000000005FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fb0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c83fe32572f9184be88476d2f96cefa9fcfd53007e69308c3411954528b257a
Instruction ID: 4591e6d6736240ba9ce340b4cd1ff2e99efc633e5b562407ed89a162e0db6717
Opcode Fuzzy Hash: 4c83fe32572f9184be88476d2f96cefa9fcfd53007e69308c3411954528b257a
Instruction Fuzzy Hash: 2221FD30B00104EFEB04DBAAD954DAEB7EBFFC8210B118129E616D72A2DB70CC14C7A1

Function 00CAD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170010335.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cad000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7446497b7e5c19201c1e4ef8e2d2b02624bbf9a720ce258bfb594470a4aa573
Instruction ID: e94f02b1f8308aa6257b2853e6e8291ee81c3a7b18e30f7b3d7fe5f12c4edf42
Opcode Fuzzy Hash: d7446497b7e5c19201c1e4ef8e2d2b02624bbf9a720ce258bfb594470a4aa573
Instruction Fuzzy Hash: 2C2134B1604201DFCB14DF24D9C0B26BB65FB89318F20C96DE80B4B696C33AD807CB61

Function 05FC8A8C Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4054ae0092555eea186f5b83bf37c424d77f58b6a9920e42c5da400436f85e01
Instruction ID: 2d6143088f7ebfa1560cebd322006f17486f568bc4659d8d6176f7558daeed7c
Opcode Fuzzy Hash: 4054ae0092555eea186f5b83bf37c424d77f58b6a9920e42c5da400436f85e01
Instruction Fuzzy Hash: D921F4B1D00249DFDB14CFA9C995B9EBFF9AF48350F24846EE405B7240DB789946CB60

Function 00CAD005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170010335.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cad000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f738e9ff55c9d2e1624c08cfaf082c16e2f006023cabad5168483882c48081d0
Instruction ID: ca89f8a13a34ee52edcc6fec37031b0272b2d024a8c6ca420053335142350625
Opcode Fuzzy Hash: f738e9ff55c9d2e1624c08cfaf082c16e2f006023cabad5168483882c48081d0
Instruction Fuzzy Hash: D12183755093808FCB12CF24D590715BF71EB46318F28C5DAD84A8F6A7C33A990ACB62

Function 05FC8E70 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08afd877f2039edeac3e6d195939b0c7d4451a1c948252820c8476edd1c9a261
Instruction ID: 629084d0e17682f33c6bbe371144ade7889758dcb329367f35638ab42326dac5
Opcode Fuzzy Hash: 08afd877f2039edeac3e6d195939b0c7d4451a1c948252820c8476edd1c9a261
Instruction Fuzzy Hash: 7E21D675E05218DBCB08DFA9E9846DDBBB6FF89310F10902AE405B3360D7741945CB54

Function 00C9D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2169983653.0000000000C9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c9d000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction ID: b7fe0ad99eef7313e078547ecec313a82cedd514391fd9d6c073f322c85f4657
Opcode Fuzzy Hash: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction Fuzzy Hash: B4112672404240CFCF12CF00D5C4B16BF72FB94324F24C2A9D80A1B656C33AE95ACBA1

Function 05FCBF2F Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a274a159bb9a331e9e1c1f07ab19796039bb5e4bd59b52ad18995ce1792ae83
Instruction ID: 26f3f1a08a37b297540685b07844c04974a6d55d6a7f1da66826c4d1a26b53a0
Opcode Fuzzy Hash: 7a274a159bb9a331e9e1c1f07ab19796039bb5e4bd59b52ad18995ce1792ae83
Instruction Fuzzy Hash: 76014E312006415FCB45AF38E85956E3BABEFC1351305281CF1868BA81DE747D4B97E3

Function 05FC8F28 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ec8ca154586fb048d5c28d690b40788d96f86c2d03774041cb79f491555166d
Instruction ID: 0891c15d8c27cdbcaf9b90745c480fd4e893a070252816df959314f598e3bbc7
Opcode Fuzzy Hash: 1ec8ca154586fb048d5c28d690b40788d96f86c2d03774041cb79f491555166d
Instruction Fuzzy Hash: 80111571D002098BCB08CFA9D904AEEBBB6FF89305F108069D414B3260DB365941CBA0

Function 05FC8350 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5cfa1c2009352ac5d15091511dfeaad89d8050b86917dc2f485cde5cd9855d5
Instruction ID: 1f89e01617e49cef3eb8112fb7b0962b5b4b03ca0523b2c49b437ea8ba17ce81
Opcode Fuzzy Hash: a5cfa1c2009352ac5d15091511dfeaad89d8050b86917dc2f485cde5cd9855d5
Instruction Fuzzy Hash: 2901B131B002099BDF10DAA9AC45ABFBBBAFBC4351F14403AE604D3240EB31991587A0

Function 05FCBF40 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c77fbc07e0ed338248c595538e1db8c3a5e63519feaf86c0e32fd72813431526
Instruction ID: 46b4959ddebd23ae1d724f8a74105b8e0fd9271d5b5553a30c75ff800234d49e
Opcode Fuzzy Hash: c77fbc07e0ed338248c595538e1db8c3a5e63519feaf86c0e32fd72813431526
Instruction Fuzzy Hash: A501D4312009019FCF49AB78E49952E3BABEFC1351356682CE0868BA81DE347D4697E2

Function 05FCC769 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1c8948e13dbaff23b2a3e1be905d68bbd364fd29725e159514aae584b85f999
Instruction ID: e8df2da0dd1ec0180335dacb6709d791f3a27fcc63ce09cc7b9e5560d089e82c
Opcode Fuzzy Hash: f1c8948e13dbaff23b2a3e1be905d68bbd364fd29725e159514aae584b85f999
Instruction Fuzzy Hash: 4111E5302043418FD315EF38D15825A7BE2EF86311B158A6ED08A8B796CF74AC0ADB92

Function 00C9D885 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2169983653.0000000000C9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c9d000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f59b9a34a3c5ec79b8c060cbbbbeed2480ef66dced614aa28678df7200a10a3b
Instruction ID: bf9d90f4285a50ba2e5503d91e067deac698a429f498bea17a1a58afccfc4d9a
Opcode Fuzzy Hash: f59b9a34a3c5ec79b8c060cbbbbeed2480ef66dced614aa28678df7200a10a3b
Instruction Fuzzy Hash: 5A01F7715083409AEB105E2ACDC8726BFECDF51324F18C45AED1A6A1C3C6789840DAF5

Function 05FC54F8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5078fe90c52fcd7c589d01c92116a50620fbdadc540f0d48fd1f61cf1c6f7ab
Instruction ID: 82e4c92a99f77b54dab4d3b9298bf7bcaa1b8c83c408dac97aba3c67531f564e
Opcode Fuzzy Hash: e5078fe90c52fcd7c589d01c92116a50620fbdadc540f0d48fd1f61cf1c6f7ab
Instruction Fuzzy Hash: 65019A35A157028FCB29CA75EA0473BBFB3BF80209B088CBCD04286655DE79E584CB80

Function 05FCC778 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3604c29a68f9299580cf98f99ec7b73e46740c0988a7105bddc577c9e86fafb4
Instruction ID: ed27c87cb19c584fed01a5a48282b8981544cdd727971de9b347562ad6dfc20f
Opcode Fuzzy Hash: 3604c29a68f9299580cf98f99ec7b73e46740c0988a7105bddc577c9e86fafb4
Instruction Fuzzy Hash: 4B01D4302002058FD324AF69E45865F7BE7EFC5315B118A2DE04B87B85CF78AC0A9BD1

Function 05FC8C10 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8641dd348367abb461e20ae118d775aa13d641b9412eb45a2efc3bb136a384db
Instruction ID: 0b1aeba3bd08d1a8b11f0026a0ec6df37620dcd81d56f76e074f02157dc550d5
Opcode Fuzzy Hash: 8641dd348367abb461e20ae118d775aa13d641b9412eb45a2efc3bb136a384db
Instruction Fuzzy Hash: 39F090B23002156FE714DE65DC85FABBBAEEBCC314F11452AE119D7391DAB1EC0187A0

Function 05FCEB70 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 874164a2169d356f27fdfda6a97daa87c1ef9133ce604a13bb1926bf10010aa9
Instruction ID: 243a717be1f4e281d602828e610dcc760fb2866f42bc032ad18f6b94ba0a92cf
Opcode Fuzzy Hash: 874164a2169d356f27fdfda6a97daa87c1ef9133ce604a13bb1926bf10010aa9
Instruction Fuzzy Hash: D501D6342083499FCB469F78D8548A93FBAEF4620071488EDE941CB762DA36DC05C791

Function 05FC6E90 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b00cee9af679ddf7ff5894f3202cadc760c3d0c7f93723bca7790b7635303425
Instruction ID: 777c652647146d496f261b6adbf4711f1edabd53224e82f6d4c730d0d30e0c66
Opcode Fuzzy Hash: b00cee9af679ddf7ff5894f3202cadc760c3d0c7f93723bca7790b7635303425
Instruction Fuzzy Hash: 45F090632041D83FCB514EAA9C12EFB3FEDDB8E161B084066FBD8C1241C529C911ABB0

Function 05FC9158 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 177e5b40822c399bd7c87b6aec4cb4b772d8a7b2163e053228c6c8c3c3d56352
Instruction ID: b41584ce429445da294a046e2e8ed2b7b51a8eee0ab63da942464e751a69409f
Opcode Fuzzy Hash: 177e5b40822c399bd7c87b6aec4cb4b772d8a7b2163e053228c6c8c3c3d56352
Instruction Fuzzy Hash: 6B0108B4D0520ADFCB04DFA4DA497AEBBB5FB09301F2084A99815A3350D3795A40DF90

Function 05FC9168 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 777d0407bbac65ba2d3c7b58f867faa7093b794e686575e8797633c857410604
Instruction ID: c78a9a1e661f09bd0fb96f57d02fc8f11f93520ad17aba8ef4f273186480a4e9
Opcode Fuzzy Hash: 777d0407bbac65ba2d3c7b58f867faa7093b794e686575e8797633c857410604
Instruction Fuzzy Hash: CB01C4B4D0520ADFCB04DFA9DA496AEBFF5BB49300F2085A99415A3350D7785A40CF90

Function 05FC8C20 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68c0f59f10973233744868ee3a5d192d5e72194a5086fd1a3ea34ae642c850b6
Instruction ID: ae8b9caf5b4a0141455f229862368a54fc2be0704bd6808cea34a3531c726f28
Opcode Fuzzy Hash: 68c0f59f10973233744868ee3a5d192d5e72194a5086fd1a3ea34ae642c850b6
Instruction Fuzzy Hash: 3DF05EB27002155FE714DE59EC84EABB7AEEBCC314F10452EE11AC7391DAB1EC0587A0

Function 00C9D884 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2169983653.0000000000C9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c9d000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a23e34df366e3c3730018a66ca56c1b259276c50e26c573c2e203eea394bc7fb
Instruction ID: 0017c29da115f862f1aaf95b2e0aa1a6e59d0bc875b53e0da309c70ecbce7cf8
Opcode Fuzzy Hash: a23e34df366e3c3730018a66ca56c1b259276c50e26c573c2e203eea394bc7fb
Instruction Fuzzy Hash: 0BF0C271404340AAEB109E09C8C8B62FFD8EB51724F18C05AED096E2C3C278AC44CAB1

Function 05FCB4B9 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2a5de989a60de170209084b0e0c0523bf470751d0b69991720c93a5ce047120
Instruction ID: bcd038b89067864b8bde56995c1ab56dc9b2cb0b3756655b45b5a33d16696cc0
Opcode Fuzzy Hash: c2a5de989a60de170209084b0e0c0523bf470751d0b69991720c93a5ce047120
Instruction Fuzzy Hash: DCF02E312082809FD7112B69A858B9E7FD9DFCB714F04446DF149C3383CA251C4587A2

Function 05FCC440 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 309ba3e1ae83ca3b2cea619e13799834f4f0155717797446272886d231d89913
Instruction ID: 425a3797b04773a3161b6da4f38825fa672bf4b7a576fbaef5d3c4aea2ba4285
Opcode Fuzzy Hash: 309ba3e1ae83ca3b2cea619e13799834f4f0155717797446272886d231d89913
Instruction Fuzzy Hash: 94012130504B829FD362DF25E418562BFF6FB8A310710865FD4CAC3A62CB30600ACF81

Function 05FCAF88 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a86caa8e3b2ed59a0e00055ce1292cf26597c447c5dd3380a0701ff3148d9595
Instruction ID: 99eae5e3259ca39553b18e5f0033462b57c3e4ffcbe8b725c1a4cb8120839fcc
Opcode Fuzzy Hash: a86caa8e3b2ed59a0e00055ce1292cf26597c447c5dd3380a0701ff3148d9595
Instruction Fuzzy Hash: C7F0E96230C2A55FD71717386C640BD3FA6DAC765134810DEE1C6CB393DA58590AD3E2

Function 05FC6EA0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12cbcc786395ee67ae7a89f9a18c61b53111e0e7a286fda97e93cfd69a33e999
Instruction ID: 5057ab2fdee6c9122444f21e854f82eab91415cc1617c788f04b193cf4fdbb4f
Opcode Fuzzy Hash: 12cbcc786395ee67ae7a89f9a18c61b53111e0e7a286fda97e93cfd69a33e999
Instruction Fuzzy Hash: 84F012662041E83F8B518EAA5C15CFB7FEDDACE1617084156FFD8D2141C529C921ABB0

Function 05FC67C8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9912a5cc08c76a7d1e92d22e6c0ce4f0211f717787dfe074cecc53ee64ae7506
Instruction ID: fc7a428a57b1532a1226c6e6090ab8556647f922ac41aa6d02f26dfed7f9ccd9
Opcode Fuzzy Hash: 9912a5cc08c76a7d1e92d22e6c0ce4f0211f717787dfe074cecc53ee64ae7506
Instruction Fuzzy Hash: B4F0B431B043059BC720DA28ED41F667FE5EF81715F1581BAF254CB1E2DAB5E805D740

Function 05FC91E8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ecbed83b75fd58657750307e661e7c57b75493f773b2170d1b4ac04ebca061d
Instruction ID: eaa3ef9dd2eabed22432e41b2e5d787bab11e4f4d8e5ea9eb4417ecae0a90abb
Opcode Fuzzy Hash: 1ecbed83b75fd58657750307e661e7c57b75493f773b2170d1b4ac04ebca061d
Instruction Fuzzy Hash: 26F082317042044B8754DBA9DA805A6FBEAEF89764318C8AED94EC7B40DA32FC028780

Function 05FCC3E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffb7121cd4b63a35a216286f8483d91302c77a1b81cd5526e5c42aca9718a8bc
Instruction ID: 7559930151abfdf8b0d47ca715ab99d64c1b47c7db00433ac1ceecca9f02d13f
Opcode Fuzzy Hash: ffb7121cd4b63a35a216286f8483d91302c77a1b81cd5526e5c42aca9718a8bc
Instruction Fuzzy Hash: 20F096301087D14FC7129B38E45939E7FE5DB82214B19195FE186CB683CA696845C762

Function 05FC8341 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d464afc64b58789b5fef7055758abfc56e73370ad007916c3520af64380b59c
Instruction ID: 88a75d64d64490578ae7e6dcfbe1f5b4b1b805f58c83937c659ee56acd6b23bb
Opcode Fuzzy Hash: 3d464afc64b58789b5fef7055758abfc56e73370ad007916c3520af64380b59c
Instruction Fuzzy Hash: 28F0A772F1011A5BDF11D969AC499BF7FB9EB95252B08007BE514D3240FB34980987A1

Function 05FC9294 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1427da91056b54dca405074ce4870c408f6428d613a3c107283e868ab4b29210
Instruction ID: b1fc19df09117b8d2361097ab8ab9d6e6c2faaac0f48b71316901921cc779229
Opcode Fuzzy Hash: 1427da91056b54dca405074ce4870c408f6428d613a3c107283e868ab4b29210
Instruction Fuzzy Hash: A4F0B471E092459FE705DFA4E9717AD7F70EB51300F0081DAD4428B3A5D77DA941DB80

Function 05FC5508 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad3953aad042ba3915f30cd1f1f03a3535f13ad4cd4ed0324b1e3c9f4119e691
Instruction ID: b83b189c4ebe4e02f8bff372639791d40e90edc2a9ded17b064250a88af00442
Opcode Fuzzy Hash: ad3953aad042ba3915f30cd1f1f03a3535f13ad4cd4ed0324b1e3c9f4119e691
Instruction Fuzzy Hash: 30F08C71A00702CFCB24CA26DA40973BBFBBF80218B149CBCE04242A15DAB9F485CB80

Function 05FCB4C8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ad11e261a3c79abd1c50152f860e9b20a9e78000a3ac07f24f1266ee7616cea
Instruction ID: d95d452cf7ad137a99957e618eab59a318e57894fedd948d0e03e6b596006e05
Opcode Fuzzy Hash: 1ad11e261a3c79abd1c50152f860e9b20a9e78000a3ac07f24f1266ee7616cea
Instruction Fuzzy Hash: 60E09231200210ABD7146B9AA449B9E7ADAEBC9351B10452CF60EC3382CE611C0547A2

Function 05FCC450 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5288c0879a184750b4542fd184d9b0c6bae2cc5bdd36017d8589e31b25d77d7
Instruction ID: cfb2ee695e0a9fb1a0c7ae9226c614cb39b26cb3efa6e769a5d3dedecbfc9cf1
Opcode Fuzzy Hash: d5288c0879a184750b4542fd184d9b0c6bae2cc5bdd36017d8589e31b25d77d7
Instruction Fuzzy Hash: 84F09070501B02DFD765DF26E548562BBFAFB88301711C62EE88B83B51DB74A40ACF84

Function 05FCAF40 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42e1e8d490282f5bdbc33fdfcbccd2a61b9b74caf7970201006f5012e6807763
Instruction ID: 7a51cc71e3a0d5eca13a3af725bb77fd5e4595c07f541a34e9ce479e60385415
Opcode Fuzzy Hash: 42e1e8d490282f5bdbc33fdfcbccd2a61b9b74caf7970201006f5012e6807763
Instruction Fuzzy Hash: DDE092713082955BDB172735A8285AD7FAADBC7611348149FE186CB383CE141D4A87D6

Function 05FCC3F0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0ab210f58e91a57f69b4acb379cc41815d7f90be0248e3c40bdcc36dc8835ac
Instruction ID: 13082a67a00ef8f716aad9d9fe68071abcd2de445adccc0d6c9fa5e05ff111b4
Opcode Fuzzy Hash: c0ab210f58e91a57f69b4acb379cc41815d7f90be0248e3c40bdcc36dc8835ac
Instruction Fuzzy Hash: 15E065302007514FC715EB2DE4497AE7BEADFC6315F05192DE186C7781CFA96D058791

Function 05FC9238 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22c2a986cef8874c1faf95f61416094694eb7f6482fa17fe3f3c2966c81dd643
Instruction ID: 3358e11c6e5cee41610e8a7f8fd0c8994866a2d4f9829f5cd3207b61cfb44ff4
Opcode Fuzzy Hash: 22c2a986cef8874c1faf95f61416094694eb7f6482fa17fe3f3c2966c81dd643
Instruction Fuzzy Hash: 21F085B4F00309AFD714EFA4E920BAD7BB1EB84300F1082A8D4119B3A4DBB99940CB80

Function 05FC5698 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41b1341fceeb5e86bead459991db9bbfeb6b5c8b0226f4604d7b3489c65f0d07
Instruction ID: fd5cb3c2dae8e43297196ef5619db9939ccbcfbfaf79d558e7c75a4bf9fed64b
Opcode Fuzzy Hash: 41b1341fceeb5e86bead459991db9bbfeb6b5c8b0226f4604d7b3489c65f0d07
Instruction Fuzzy Hash: 32E0D8B210C3019FD304DB60E8048967BE4EF95320F058CBEE481C7181EB76E841C799

Function 05FC9248 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d309c3c339bf09ff5bf5e77b0c96fec82dbccdbf208148e0c088882a0431ff55
Instruction ID: 9ef9cc72cedaad2456fa51b3dca93e572cbdc13943c958a2da0690278a7aeac1
Opcode Fuzzy Hash: d309c3c339bf09ff5bf5e77b0c96fec82dbccdbf208148e0c088882a0431ff55
Instruction Fuzzy Hash: 07F06D74E00308AFD744EFB4E961B9DBBB0BB44300F1082A8D805973A4D7786D44CF80

Function 05FCB7D0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3742024433ba070547b04ee766bb3c8ed83cd183545b3ef6a9c2d7bd1d1b29b
Instruction ID: 60e2726f9c8a3408d9289b296928f0ee444613960ae39759378265648c203ee2
Opcode Fuzzy Hash: f3742024433ba070547b04ee766bb3c8ed83cd183545b3ef6a9c2d7bd1d1b29b
Instruction Fuzzy Hash: D5F03935C0424AEFCB06CFB4DA488CDBF38EB02244B2182DAE8A1971D1DA351A46DB80

Function 05FCE540 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c19ff9202c00570a0b68f0c42827a4c11b94c9b15f2f22b1f2a9d59d1fc786a
Instruction ID: a4e7604e3f5e9d23e0543debe903a7f3c9f05d12b9c5b6583fc3caa0c408828f
Opcode Fuzzy Hash: 9c19ff9202c00570a0b68f0c42827a4c11b94c9b15f2f22b1f2a9d59d1fc786a
Instruction Fuzzy Hash: 36E0D8310083804BCB02EB38BCF60887F64FB476047029489DC9447297CB645D49D386

Function 05FCAF50 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a460b1cf284e39f4a91b5f95d4a3375c3ceb918df4bb1d1d5af1af846b4d8c7
Instruction ID: 80b45f1be83903875d5bd4e280830b6bcb6b2e5ee87ffc53299b6282c823b695
Opcode Fuzzy Hash: 8a460b1cf284e39f4a91b5f95d4a3375c3ceb918df4bb1d1d5af1af846b4d8c7
Instruction Fuzzy Hash: 90D05B3130011457DA052769B4585AE7B9BDBC9661304152DF607C7341CF651D0947D6

Function 05FCCF10 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f839b1f0cc91e71c14ef863654d31d62f146c9a5a358e55852a4050ea125376
Instruction ID: 66cff827fafe69fddc68171073fdbe614f9f57d9c89941e057c05b5f034a0f0d
Opcode Fuzzy Hash: 6f839b1f0cc91e71c14ef863654d31d62f146c9a5a358e55852a4050ea125376
Instruction Fuzzy Hash: F7E0D8311083818BCB06EF38F8A44987F60EB46210307559ED04587357C6241C59C7D1

Function 05FCE4BF Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6e93d944a9b2a3d577f0a2389a832c1742cddf2021279c04e9077b59a660a19
Instruction ID: 4447cb9cc09d62d041844eccd114a683e05acd37f9590b5f1e92362362611c4f
Opcode Fuzzy Hash: c6e93d944a9b2a3d577f0a2389a832c1742cddf2021279c04e9077b59a660a19
Instruction Fuzzy Hash: 7FE09270904348EFCB46DBB8EB555987B74EB82201B1115DED008EB292D6301E14D752

Function 05FCB7E0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a910a17b4fd44a488ae003d6c8f9c0cbdd5514569495e03219586ef47e4497d
Instruction ID: 444cdc45d642e65394e8e05222256c6e84fae7b7050f2c904e93f96f5a0cce99
Opcode Fuzzy Hash: 0a910a17b4fd44a488ae003d6c8f9c0cbdd5514569495e03219586ef47e4497d
Instruction Fuzzy Hash: DAE09275D0020DEFCB41DFE4E9448DDBBB9EB48200F2082AAD809A3240EB346B55DF80

Function 05FC91E2 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9fba302a3668f9d81a4410d365eb077b8afc77ee91d3e57e923fcab6d265173
Instruction ID: 223d36e1f7effdbf5fdc6efd9d29370d290ab3e90095f5d8d98d328c83150473
Opcode Fuzzy Hash: c9fba302a3668f9d81a4410d365eb077b8afc77ee91d3e57e923fcab6d265173
Instruction Fuzzy Hash: DED0A7713042045BA354E69DDE40592BFDEDF8A76431888BEED0EE7751DE62FC028790

Function 05FCE4D0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b8f8b61e9915e44bdf67c75aa5fdfdc1732a0bf55c18919f2a4580a571aa38f
Instruction ID: 29a9f4ae9796f5b925cdf37417d2469b760d25a1fb4806ffa3710c59cd14175e
Opcode Fuzzy Hash: 3b8f8b61e9915e44bdf67c75aa5fdfdc1732a0bf55c18919f2a4580a571aa38f
Instruction Fuzzy Hash: DDD01271A0020CFBCB00DFA8E95155D77B9DB85204B10559DD408E3341DA311F009B91

Function 05FCEBB8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 352d08221c0303ec0f8a38bdd8e4c0288c6ada1b0ad97e114164fb394a3e3219
Instruction ID: 79f68f3376300bb5c342213cba77d1bd94e3834c4a413e3083720d4e05b668e4
Opcode Fuzzy Hash: 352d08221c0303ec0f8a38bdd8e4c0288c6ada1b0ad97e114164fb394a3e3219
Instruction Fuzzy Hash: FEE012352583849FC7429F68D8108557F76AF5661074444CEE5C48B672C6269424DB51

Function 05FCFBAF Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 277d888d9635db4a62048acc0db7b84dda7989ae71db6be0ae55b1fbaf4bb705
Instruction ID: 553497450d39ce5104c70068f2c8b6e657e22370b4030e55dff5be885a354afd
Opcode Fuzzy Hash: 277d888d9635db4a62048acc0db7b84dda7989ae71db6be0ae55b1fbaf4bb705
Instruction Fuzzy Hash: 68C08C32300020130AA5256C780D8AE65DED7C9B63346002FF90BC3384CE608C4613F1

Function 05FC3721 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18c7ea395d5f214638352c3ff0cfc9d7207ade0d17682424ad801db513ecd292
Instruction ID: e0277401f48b8dffbbb07fff939fd115e06c29e37ff428440c59003f52ed519f
Opcode Fuzzy Hash: 18c7ea395d5f214638352c3ff0cfc9d7207ade0d17682424ad801db513ecd292
Instruction Fuzzy Hash: B7B092326601021BF7507261AC0BFD2389193E07A5F195020B752A528ADEDAD04086A9

Non-executed Functions

Function 06612E88 Relevance: 2.7, Strings: 2, Instructions: 202COMMON

Download Yara Rule

Strings

$sq, xrefs: 06612F7B
$sq, xrefs: 06613039

Memory Dump Source

Source File: 00000000.00000002.2177640499.0000000006610000.00000040.00000800.00020000.00000000.sdmp, Offset: 06610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6610000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID: $sq$$sq
API String ID: 0-1184984226
Opcode ID: 6bd9c0259adbbe9398f552e6634dc4a652517fcea002b41c2da05f46ab602ec5
Instruction ID: 877ef8ddba3668885730128216db5197d96490a8618e0d7ff07bdd3e42aff98d
Opcode Fuzzy Hash: 6bd9c0259adbbe9398f552e6634dc4a652517fcea002b41c2da05f46ab602ec5
Instruction Fuzzy Hash: B761AE74E00208DFDB44DFA9D884ADDBBB2FF89300F249029E415BB361DB35A986CB54

Function 06616A98 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

\VOj, xrefs: 06616CE3

Memory Dump Source

Source File: 00000000.00000002.2177640499.0000000006610000.00000040.00000800.00020000.00000000.sdmp, Offset: 06610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6610000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID: \VOj
API String ID: 0-304670344
Opcode ID: d6a6397e5697061fe39f48412378ec307d56aff4110d1352cf88999eaff4fbbc
Instruction ID: cced2b5af1a17fe1958a51e73a4d1f9a2e63d72c3274a0d47df6d9390b51b2db
Opcode Fuzzy Hash: d6a6397e5697061fe39f48412378ec307d56aff4110d1352cf88999eaff4fbbc
Instruction Fuzzy Hash: 5D916D74E002098FDF54CFA9C9857ADBBF2EF88314F288529E415EB394DB749846CB91

Function 05FC6FE8 Relevance: .8, Instructions: 784COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19a1a0240817a7b7d2b03171dd98738e698c37fda717b7b75ebe332627f30ed1
Instruction ID: 883978945623dcc8fd58ed3376c15ef88558708f0ba3463379477ee4a74c188f
Opcode Fuzzy Hash: 19a1a0240817a7b7d2b03171dd98738e698c37fda717b7b75ebe332627f30ed1
Instruction Fuzzy Hash: C2626EB06002009FDB48DF68C49971A7AE6EB84308F64D85CD1099F396CFBBDD4B9B95

Function 05FC6FF8 Relevance: .8, Instructions: 780COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf29a0de8165e803b9aa0011b0ded7b9bf3d5889c06be3bc69cf4fa61e9a5a74
Instruction ID: 9f1914ff7a81978ab4cee36d30d8d301b761661a3647f9e844ad0154c12d7ad8
Opcode Fuzzy Hash: cf29a0de8165e803b9aa0011b0ded7b9bf3d5889c06be3bc69cf4fa61e9a5a74
Instruction Fuzzy Hash: 05625EB06002009FDB48DF68C49971A7AE6EB84308F64D85CD1099F396CFBBDD4B9B95

Function 00D1DC74 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170168733.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d10000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc1dbf6c0c92eec09acecd87ecef8283527329d1acf9c1030bc257882ce88c69
Instruction ID: 7acdc2840923eda8d2d9cc8ed412e33b89284c313c441f85cd2864653cdcd727
Opcode Fuzzy Hash: dc1dbf6c0c92eec09acecd87ecef8283527329d1acf9c1030bc257882ce88c69
Instruction Fuzzy Hash: A4A14B32E002159FCF09DFA5E8405DEB7B2FF84300B15456AE805AB265DF71E995CBA0

Function 066187C9 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177640499.0000000006610000.00000040.00000800.00020000.00000000.sdmp, Offset: 06610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6610000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27382dd697795ec3f089113c956d7e363574e8a5b170e5480b8ef77a150c64fe
Instruction ID: 8620a5dcca7ea7428d8d84878b8faf716cd182391d9a135d50e856d869453e31
Opcode Fuzzy Hash: 27382dd697795ec3f089113c956d7e363574e8a5b170e5480b8ef77a150c64fe
Instruction Fuzzy Hash: 35C19074E01218CFDB58DFA9D854B9DBBB2BF89300F2084AAD419AB355DB349D86CF50

Function 0661CD69 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177640499.0000000006610000.00000040.00000800.00020000.00000000.sdmp, Offset: 06610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6610000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bfacf4c8e147960d2aede8f53c2ab6c870be6b2258011cd01d9cb183e311699
Instruction ID: 66fcd8e4955fe7cecd60eac797f7388c7c1c15cd1377fb8a7281aaa5198d0d91
Opcode Fuzzy Hash: 1bfacf4c8e147960d2aede8f53c2ab6c870be6b2258011cd01d9cb183e311699
Instruction Fuzzy Hash: 2691D6B0D012298BDB68DF65C851BDEBBB2BF88300F50C1EAD509AB250DB355E85DF90

Function 06613158 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177640499.0000000006610000.00000040.00000800.00020000.00000000.sdmp, Offset: 06610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6610000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b54d8409c46d8b93947e9e644a29e110c650614a2e7aa4e98da5eed7182b24e7
Instruction ID: 350718a6c4e91aa69ff23947218fe2a28171961adfcf6694a5b6be31fc5e9cd2
Opcode Fuzzy Hash: b54d8409c46d8b93947e9e644a29e110c650614a2e7aa4e98da5eed7182b24e7
Instruction Fuzzy Hash: FE01E434A40208DFCB14CF84E845AEDF7B5FB4A311F549159E94AAB361CB329D51CB90

Function 05FCE587 Relevance: 46.6, Strings: 37, Instructions: 387COMMON

Download Yara Rule

Strings

Dsj, xrefs: 05FCE9B8
Dsj, xrefs: 05FCE613
Dsj, xrefs: 05FCEB04
Dsj, xrefs: 05FCE5EE
Dsj, xrefs: 05FCE82B
Dsj, xrefs: 05FCE5A4
Dsj, xrefs: 05FCE9E0
Dsj, xrefs: 05FCE918
Dsj, xrefs: 05FCEA58
Dsj, xrefs: 05FCEAAE
Dsj, xrefs: 05FCE763
Dsj, xrefs: 05FCE803
Dsj, xrefs: 05FCE65D
Dsj, xrefs: 05FCE6F1
Dsj, xrefs: 05FCEA83
Dsj, xrefs: 05FCE78B
Dsj, xrefs: 05FCEA08
Dsj, xrefs: 05FCEAD9
Dsj, xrefs: 05FCE6A7
Dsj, xrefs: 05FCE940
Dsj, xrefs: 05FCEA30
Dsj, xrefs: 05FCE5C9
Dsj, xrefs: 05FCE638
Dsj, xrefs: 05FCE8C8
Dsj, xrefs: 05FCE7DB
Dsj, xrefs: 05FCE73B
Dsj, xrefs: 05FCE716
Dsj, xrefs: 05FCE8A3
Dsj, xrefs: 05FCE87B
Dsj, xrefs: 05FCE682
Dsj, xrefs: 05FCE7B3
Dsj, xrefs: 05FCEB2F
Dsj, xrefs: 05FCE6CC
Dsj, xrefs: 05FCE968
Dsj, xrefs: 05FCE990
Dsj, xrefs: 05FCE8F0
Dsj, xrefs: 05FCE853

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID: Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj
API String ID: 0-3332464785
Opcode ID: 83aeb025bb618f6de65c2148af469b297c54ae64671fa8564c04872b75618b73
Instruction ID: f27a42fa0f2a07d381b897b384c009e7ad0869b5d63bf75e3a4d7bc555a36ae6
Opcode Fuzzy Hash: 83aeb025bb618f6de65c2148af469b297c54ae64671fa8564c04872b75618b73
Instruction Fuzzy Hash: 02D1A0703006146BC70A7AA0DD9AABDA693FBC7300B918C38E1044F7A6DF756D1D6B97

Function 05FCE598 Relevance: 46.6, Strings: 37, Instructions: 383COMMON

Download Yara Rule

Strings

Dsj, xrefs: 05FCE9B8
Dsj, xrefs: 05FCE613
Dsj, xrefs: 05FCEB04
Dsj, xrefs: 05FCE5EE
Dsj, xrefs: 05FCE82B
Dsj, xrefs: 05FCE5A4
Dsj, xrefs: 05FCE9E0
Dsj, xrefs: 05FCE918
Dsj, xrefs: 05FCEA58
Dsj, xrefs: 05FCEAAE
Dsj, xrefs: 05FCE763
Dsj, xrefs: 05FCE803
Dsj, xrefs: 05FCE65D
Dsj, xrefs: 05FCE6F1
Dsj, xrefs: 05FCEA83
Dsj, xrefs: 05FCE78B
Dsj, xrefs: 05FCEA08
Dsj, xrefs: 05FCEAD9
Dsj, xrefs: 05FCE6A7
Dsj, xrefs: 05FCE940
Dsj, xrefs: 05FCEA30
Dsj, xrefs: 05FCE5C9
Dsj, xrefs: 05FCE638
Dsj, xrefs: 05FCE8C8
Dsj, xrefs: 05FCE7DB
Dsj, xrefs: 05FCE73B
Dsj, xrefs: 05FCE716
Dsj, xrefs: 05FCE8A3
Dsj, xrefs: 05FCE87B
Dsj, xrefs: 05FCE682
Dsj, xrefs: 05FCE7B3
Dsj, xrefs: 05FCEB2F
Dsj, xrefs: 05FCE6CC
Dsj, xrefs: 05FCE968
Dsj, xrefs: 05FCE990
Dsj, xrefs: 05FCE8F0
Dsj, xrefs: 05FCE853

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID: Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj
API String ID: 0-3332464785
Opcode ID: 961c7b9f39870469223c16861f3f6b3a8c715dba71fb70a6d46a710b9cc34beb
Instruction ID: 1cb4f5caa4d5dce3ba94257a0fc0630b45148b6c8d1bd5f4419e387412b32737
Opcode Fuzzy Hash: 961c7b9f39870469223c16861f3f6b3a8c715dba71fb70a6d46a710b9cc34beb
Instruction Fuzzy Hash: F0D1B2703006146BC60A7BA4DD9AABDA293FBC7300BA18C38E1044F796DF756D1D6B97

Function 05FCCF57 Relevance: 16.4, Strings: 13, Instructions: 146COMMON

Download Yara Rule

Strings

Dsj, xrefs: 05FCD052
Dsj, xrefs: 05FCD008
Dsj, xrefs: 05FCCF74
Dsj, xrefs: 05FCD10B
Dsj, xrefs: 05FCD09C
Dsj, xrefs: 05FCD0C1
Dsj, xrefs: 05FCD077
Dsj, xrefs: 05FCD0E6
Dsj, xrefs: 05FCD02D
Dsj, xrefs: 05FCCF99
Dsj, xrefs: 05FCCFE3
Dsj, xrefs: 05FCCFBE
Dsj, xrefs: 05FCD130

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID: Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj
API String ID: 0-2675541404
Opcode ID: c1c66c2e0b55baad4ab13d21a8873abc2a61f1b76a5a28aa0dc2f799dc0fde92
Instruction ID: 40747a3e0609e356234d7c227ad44ca35d27b670e0cc341fbd0580922b317701
Opcode Fuzzy Hash: c1c66c2e0b55baad4ab13d21a8873abc2a61f1b76a5a28aa0dc2f799dc0fde92
Instruction Fuzzy Hash: BC41D3703006106BC70A6BA4D99667DA693FBC7300B918C38E2084FB96CF7A6D4D5797

Function 05FCCF68 Relevance: 16.4, Strings: 13, Instructions: 143COMMON

Download Yara Rule

Strings

Dsj, xrefs: 05FCD052
Dsj, xrefs: 05FCD008
Dsj, xrefs: 05FCCF74
Dsj, xrefs: 05FCD10B
Dsj, xrefs: 05FCD09C
Dsj, xrefs: 05FCD0C1
Dsj, xrefs: 05FCD077
Dsj, xrefs: 05FCD0E6
Dsj, xrefs: 05FCD02D
Dsj, xrefs: 05FCCF99
Dsj, xrefs: 05FCCFE3
Dsj, xrefs: 05FCCFBE
Dsj, xrefs: 05FCD130

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID: Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj
API String ID: 0-2675541404
Opcode ID: d8981fdfcf596075511b53e321119c47af5ba36f9f19ee2c7b9f59d84c8923d5
Instruction ID: 9fc04df574036ca9d10b4fca4cfe59ecb0f1d3c19c12150656f0b58590e43d99
Opcode Fuzzy Hash: d8981fdfcf596075511b53e321119c47af5ba36f9f19ee2c7b9f59d84c8923d5
Instruction Fuzzy Hash: 2741A5703006146BD7067AA4D98667E6693FBC7300F918C38E2094FB86DF796D0D5797

Function 05FCD1A9 Relevance: 10.1, Strings: 8, Instructions: 98COMMON

Download Yara Rule

Strings

Dsj, xrefs: 05FCD233
Dsj, xrefs: 05FCD258
Dsj, xrefs: 05FCD2A2
Dsj, xrefs: 05FCD27D
Dsj, xrefs: 05FCD1C4
Dsj, xrefs: 05FCD2C7
Dsj, xrefs: 05FCD20E
Dsj, xrefs: 05FCD1E9

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID: Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj
API String ID: 0-975092858
Opcode ID: 72bfb2a429473f16e4fa8b8c9358b6713e19078f78174182e3d19095be4d0b1c
Instruction ID: c65141726e839473eee38853461f322cd7b799716708c7ff1b6b4bbeb13dcd30
Opcode Fuzzy Hash: 72bfb2a429473f16e4fa8b8c9358b6713e19078f78174182e3d19095be4d0b1c
Instruction Fuzzy Hash: 3231D3703002552BCB066BA4D986A7DAA93BBC7300F918938E2094F786CFB56D4D9796

Function 05FCD1B8 Relevance: 10.1, Strings: 8, Instructions: 93COMMON

Download Yara Rule

Strings

Dsj, xrefs: 05FCD233
Dsj, xrefs: 05FCD258
Dsj, xrefs: 05FCD2A2
Dsj, xrefs: 05FCD27D
Dsj, xrefs: 05FCD1C4
Dsj, xrefs: 05FCD2C7
Dsj, xrefs: 05FCD20E
Dsj, xrefs: 05FCD1E9

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID: Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj
API String ID: 0-975092858
Opcode ID: b1e22ffe64a89d59db3fca3304214cc9ca3310e666f234f6304789abd5c99955
Instruction ID: c629bc871d58da024d0e399dcb32a4e610e0e4dbff621df09ea7477bce550cda
Opcode Fuzzy Hash: b1e22ffe64a89d59db3fca3304214cc9ca3310e666f234f6304789abd5c99955
Instruction Fuzzy Hash: 8B21D2703002152BCB066AA4DD86A7EA693FBC7300FA18C38F2084F786CFB56D495796

Function 05FCCC40 Relevance: 8.8, Strings: 7, Instructions: 85COMMON

Download Yara Rule

Strings

Dsj, xrefs: 05FCCD00
Dsj, xrefs: 05FCCCAE
Dsj, xrefs: 05FCCC5C
Dsj, xrefs: 05FCCD29
Dsj, xrefs: 05FCCD52
Dsj, xrefs: 05FCCCD7
Dsj, xrefs: 05FCCC85

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID: Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj
API String ID: 0-3690536320
Opcode ID: 24e03d68b22fa0d538c91832380e4ba7bec2c20c2d104bca83c50f41e75d47ef
Instruction ID: b5d88e3a95e32bca0f9808c8bfd8aff5ecba0018aac4330571e71ebdb21a42ae
Opcode Fuzzy Hash: 24e03d68b22fa0d538c91832380e4ba7bec2c20c2d104bca83c50f41e75d47ef
Instruction Fuzzy Hash: 9231C5313002556FCB052FA1E8968AD7BA3FB863017515538E1058FB96CF741E8A9BC2

Function 05FCCC50 Relevance: 8.8, Strings: 7, Instructions: 83COMMON

Download Yara Rule

Strings

Dsj, xrefs: 05FCCD00
Dsj, xrefs: 05FCCCAE
Dsj, xrefs: 05FCCC5C
Dsj, xrefs: 05FCCD29
Dsj, xrefs: 05FCCD52
Dsj, xrefs: 05FCCCD7
Dsj, xrefs: 05FCCC85

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID: Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj
API String ID: 0-3690536320
Opcode ID: a7b814fbc4a83f3fabee6e255fe47c274bd47aa01f920f29f6d91c4726c92745
Instruction ID: 28dd9117ae2d679ef9f71270e2d7c603f4d8554963ce6337b8541cba8f1e685b
Opcode Fuzzy Hash: a7b814fbc4a83f3fabee6e255fe47c274bd47aa01f920f29f6d91c4726c92745
Instruction Fuzzy Hash: 2C21D331300256ABCB052FA5EC968AE77A3FBC63007519438F1058FB95CF745E8A9BC2

Function 05FCEFD0 Relevance: 7.9, Strings: 6, Instructions: 378COMMON

Download Yara Rule

Strings

(_sq, xrefs: 05FCF3B9
(_sq, xrefs: 05FCF1BA
(_sq, xrefs: 05FCF239
(_sq, xrefs: 05FCF33A
(_sq, xrefs: 05FCF0B9
(_sq, xrefs: 05FCF03A

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID: (_sq$(_sq$(_sq$(_sq$(_sq$(_sq
API String ID: 0-2477685147
Opcode ID: 43ac36dbcc43ee130bc7018aeda76e3ff59699a4f9ed9985ffbfdcffa5d0b07c
Instruction ID: d52a8525a9277b730fc66579f2edba7546eded26af6b283ca131e5c8e682fe34
Opcode Fuzzy Hash: 43ac36dbcc43ee130bc7018aeda76e3ff59699a4f9ed9985ffbfdcffa5d0b07c
Instruction Fuzzy Hash: 39D1A139B04244AFCB059F68C4545AEBFB6EFC5310B6580AEEC46DB382DA359D06CB91

Function 05FCD7F8 Relevance: 7.6, Strings: 6, Instructions: 79COMMON

Download Yara Rule

Strings

Dsj, xrefs: 05FCD85E
Dsj, xrefs: 05FCD814
Dsj, xrefs: 05FCD883
Dsj, xrefs: 05FCD8CD
Dsj, xrefs: 05FCD8A8
Dsj, xrefs: 05FCD839

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID: Dsj$Dsj$Dsj$Dsj$Dsj$Dsj
API String ID: 0-118940947
Opcode ID: 769e3b8e341a91878171590f0caeb35266db0701a80f230dd63bf0887949a32f
Instruction ID: 1f7489b50ebddb6c6c4e8a0a21237cc5acca3724c11128d213c2a33cbae58c07
Opcode Fuzzy Hash: 769e3b8e341a91878171590f0caeb35266db0701a80f230dd63bf0887949a32f
Instruction Fuzzy Hash: 4E2103303002902BC7066AA49896A6DBA93EBC7700F958938E1084F786CF766D5D9792

Function 05FCD808 Relevance: 7.6, Strings: 6, Instructions: 73COMMON

Download Yara Rule

Strings

Dsj, xrefs: 05FCD85E
Dsj, xrefs: 05FCD814
Dsj, xrefs: 05FCD883
Dsj, xrefs: 05FCD8CD
Dsj, xrefs: 05FCD8A8
Dsj, xrefs: 05FCD839

Memory Dump Source

Source File: 00000000.00000002.2176615843.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_KBDFW9FTsq.jbxd

Similarity

API ID:
String ID: Dsj$Dsj$Dsj$Dsj$Dsj$Dsj
API String ID: 0-118940947
Opcode ID: c4c8077448e4960b01f4360422fc919f68d1a7ca8c5d6856a61f0ff5ca582a4a
Instruction ID: 17165fee41efa80a334fdcbf96e82db696170b1d783c990da250e7de635827cc
Opcode Fuzzy Hash: c4c8077448e4960b01f4360422fc919f68d1a7ca8c5d6856a61f0ff5ca582a4a
Instruction Fuzzy Hash: B111D2303002542BC7066AA5D986A7EA693FBC7700F91893CE1084F786CF766D595792

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report KBDFW9FTsq.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Desktop\Google Chrome.lnk

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\KBDFW9FTsq.exe.log

C:\Users\user\AppData\Local\Temp\Tmp396C.tmp

C:\Users\user\AppData\Local\Temp\Tmp397D.tmp

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Windows Analysis Report
KBDFW9FTsq.exe

Function 0661B3B3 Relevance: 13.4, APIs: 1, Strings: 6, Instructions: 1103
COMMON

Function 0661F538 Relevance: 6.7, Strings: 5, Instructions: 446
COMMON

Function 0661DA28 Relevance: 2.9, Strings: 2, Instructions: 364
COMMON

Function 0661A920 Relevance: 2.7, Strings: 2, Instructions: 203
COMMON

Function 05FB0D80 Relevance: 20.6, Strings: 16, Instructions: 622
COMMON

Function 05FB1582 Relevance: 7.8, Strings: 6, Instructions: 339
COMMON

Function 00D1D0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 00D1D0A8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 05FC8C78 Relevance: 2.6, Strings: 2, Instructions: 112
COMMON