Edit tour

Windows Analysis Report
kYpONUhAR5.exe

Overview

General Information

Sample name:	kYpONUhAR5.exe renamed because original name is a hash value
Original sample name:	58e8b2eb19704c5a59350d4ff92e5ab6.exe
Analysis ID:	1520626
MD5:	58e8b2eb19704c5a59350d4ff92e5ab6
SHA1:	171fc96dda05e7d275ec42840746258217d9caf0
SHA256:	07d4b7768e13d79ac5f05f81167b29bb6fbf97828a289d8d11eec38939846834
Tags:	exeRedLineStealeruser-abuse_ch
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected RedLine Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Connects to many ports of the same IP (likely port scanning)

Found many strings related to Crypto-Wallets (likely being stolen)

Installs new ROOT certificates

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops certificate files (DER)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

kYpONUhAR5.exe (PID: 4508 cmdline: "C:\Users\user\Desktop\kYpONUhAR5.exe" MD5: 58E8B2EB19704C5A59350D4FF92E5AB6)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["185.215.113.67:15206"], "Bot Id": "newbundle2", "Message": "", "Authorization Header": "3367ae7efa83bc64a8a6c00729e22b91"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
kYpONUhAR5.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.2140548501.0000000000E32000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.2320321106.00000000033D7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: kYpONUhAR5.exe PID: 4508	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: kYpONUhAR5.exe PID: 4508	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.kYpONUhAR5.exe.e30000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

ET MALWARE Redline Stealer TCP CnC - Id1Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T17:22:10.992909+0200	2043234	1	A Network Trojan was detected	185.215.113.67	15206	192.168.2.6	49710	TCP

ET MALWARE Redline Stealer TCP CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T17:22:10.765544+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:16.045665+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:17.464550+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:17.712642+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:18.015035+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:18.279185+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:18.507423+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:20.639665+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:21.236540+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:21.469573+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:21.703432+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:22.134212+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:22.402884+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:22.728365+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:22.960033+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:23.210740+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:23.558591+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:23.564561+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:24.791517+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:25.161436+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:25.420755+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:25.678762+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:25.923591+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:26.203907+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49710	185.215.113.67	15206	TCP

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T17:22:16.363786+0200	2046056	1	A Network Trojan was detected	185.215.113.67	15206	192.168.2.6	49710	TCP

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T17:22:10.765544+0200	2046045	1	A Network Trojan was detected	192.168.2.6	49710	185.215.113.67	15206	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: kYpONUhAR5.exe

Malware Configuration Extractor: RedLine {"C2 url": ["185.215.113.67:15206"], "Bot Id": "newbundle2", "Message": "", "Authorization Header": "3367ae7efa83bc64a8a6c00729e22b91"}

Multi AV Scanner detection for submitted file

Source: kYpONUhAR5.exe

ReversingLabs: Detection: 81%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: kYpONUhAR5.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: kYpONUhAR5.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2043231 - Severity 1 - ET MALWARE Redline Stealer TCP CnC Activity : 192.168.2.6:49710 -> 185.215.113.67:15206
Source: Network traffic	Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.6:49710 -> 185.215.113.67:15206
Source: Network traffic	Suricata IDS: 2043234 - Severity 1 - ET MALWARE Redline Stealer TCP CnC - Id1Response : 185.215.113.67:15206 -> 192.168.2.6:49710
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 185.215.113.67:15206 -> 192.168.2.6:49710

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 185.215.113.67:15206

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 185.215.113.67 ports 0,1,2,5,6,15206

Source: global traffic

TCP traffic: 192.168.2.6:49710 -> 185.215.113.67:15206

Source: Joe Sandbox View	IP Address: 185.215.113.67 185.215.113.67
Source: Joe Sandbox View	IP Address: 185.215.113.67 185.215.113.67

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67

Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp, kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000032DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000032DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.000000000337F000.00000004.00000800.00020000.00000000.sdmp, kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003269000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000033D7000.00000004.00000800.00020000.00000000.sdmp, kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000033D7000.00000004.00000800.00020000.00000000.sdmp, kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000033D7000.00000004.00000800.00020000.00000000.sdmp, kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000035A1000.00000004.00000800.00020000.00000000.sdmp, kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16V
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000035A1000.00000004.00000800.00020000.00000000.sdmp, kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp, kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000035A1000.00000004.00000800.00020000.00000000.sdmp, kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp, kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000032DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp, kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000032DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031D8000.00000004.00000800.00020000.00000000.sdmp, kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp, kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000032E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp, kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003597000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000033D7000.00000004.00000800.00020000.00000000.sdmp, kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003269000.00000004.00000800.00020000.00000000.sdmp, kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003269000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: kYpONUhAR5.exe	String found in binary or memory: https://api.ip.sb/ip

Source: C:\Users\user\Desktop\kYpONUhAR5.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp383F.tmp			Jump to dropped file
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp382E.tmp			Jump to dropped file

Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Code function: 0_2_017DDC74	0_2_017DDC74
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Code function: 0_2_06A767D8	0_2_06A767D8
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Code function: 0_2_06A7A3E8	0_2_06A7A3E8
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Code function: 0_2_06A7A3D8	0_2_06A7A3D8
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Code function: 0_2_06A76FE8	0_2_06A76FE8
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Code function: 0_2_06A76FF8	0_2_06A76FF8

Source: kYpONUhAR5.exe, 00000000.00000000.2140592254.0000000000E76000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameHooshes.exe8 vs kYpONUhAR5.exe
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000033D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefirefox.exe0 vs kYpONUhAR5.exe
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000033D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q,\\StringFileInfo\\000004B0\\OriginalFilename vs kYpONUhAR5.exe
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000033D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamechrome.exe< vs kYpONUhAR5.exe
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000033D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q,\\StringFileInfo\\040904B0\\OriginalFilename vs kYpONUhAR5.exe
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000033D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIEXPLORE.EXE.MUID vs kYpONUhAR5.exe
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000033D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIEXPLORE.EXED vs kYpONUhAR5.exe
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000033D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q,\\StringFileInfo\\080904B0\\OriginalFilename vs kYpONUhAR5.exe
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000033D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsedge.exe> vs kYpONUhAR5.exe
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs kYpONUhAR5.exe
Source: kYpONUhAR5.exe, 00000000.00000002.2319502479.000000000146E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs kYpONUhAR5.exe
Source: kYpONUhAR5.exe	Binary or memory string: OriginalFilenameHooshes.exe8 vs kYpONUhAR5.exe

Source: kYpONUhAR5.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/5@0/1

Source: C:\Users\user\Desktop\kYpONUhAR5.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Jump to behavior

Source: C:\Users\user\Desktop\kYpONUhAR5.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\kYpONUhAR5.exe

File created: C:\Users\user\AppData\Local\Temp\Tmp382E.tmp

Jump to behavior

Source: kYpONUhAR5.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: kYpONUhAR5.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\kYpONUhAR5.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\kYpONUhAR5.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\kYpONUhAR5.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: kYpONUhAR5.exe

ReversingLabs: Detection: 81%

Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Section loaded: esdsip.dll	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\kYpONUhAR5.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32

Jump to behavior

Source: Google Chrome.lnk.0.dr

LNK file: ..\..\..\Program Files\Google\Chrome\Application\chrome.exe

Source: C:\Users\user\Desktop\kYpONUhAR5.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: kYpONUhAR5.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: kYpONUhAR5.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: kYpONUhAR5.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: kYpONUhAR5.exe

Static PE information: 0xEAE6B680 [Fri Nov 19 07:02:24 2094 UTC]

Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Code function: 0_2_06A7C711 push es; ret	0_2_06A7C720
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Code function: 0_2_06A7D413 push es; ret	0_2_06A7D420
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Code function: 0_2_06A7ECF2 push eax; ret	0_2_06A7ED01

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Users\user\Desktop\kYpONUhAR5.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Jump to behavior

Source: C:\Users\user\Desktop\kYpONUhAR5.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT

Jump to behavior

Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\kYpONUhAR5.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\kYpONUhAR5.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Memory allocated: 17D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Memory allocated: 3130000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Memory allocated: 5130000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\kYpONUhAR5.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Window / User API: threadDelayed 1299			Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Window / User API: threadDelayed 8534			Jump to behavior

Source: C:\Users\user\Desktop\kYpONUhAR5.exe TID: 6516

Thread sleep time: -30437127721620741s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\kYpONUhAR5.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\kYpONUhAR5.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.000000000370A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.000000000370A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.000000000370A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.000000000370A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.000000000370A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.000000000370A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.000000000370A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.000000000370A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.000000000370A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.000000000370A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.000000000370A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.000000000370A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.000000000370A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.000000000370A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.000000000370A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.000000000370A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.000000000370A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.000000000370A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.000000000370A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: kYpONUhAR5.exe, 00000000.00000002.2324939882.0000000006E9F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllYY=
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.000000000370A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.000000000370A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.000000000370A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.000000000370A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.000000000370A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.000000000370A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.000000000370A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.000000000370A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.000000000370A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.000000000370A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.000000000370A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.000000000370A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552

Source: C:\Users\user\Desktop\kYpONUhAR5.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\kYpONUhAR5.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\kYpONUhAR5.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Queries volume information: C:\Users\user\Desktop\kYpONUhAR5.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\kYpONUhAR5.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\kYpONUhAR5.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: kYpONUhAR5.exe, type: SAMPLE
Source: Yara match	File source: 0.0.kYpONUhAR5.exe.e30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2140548501.0000000000E32000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: kYpONUhAR5.exe PID: 4508, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ElectrumE#
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000033D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q4C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: JaxxE#
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000033D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.walletLR
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000033D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLR
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000033D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.walletLR
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000033D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: qdC:\Users\user\AppData\Roaming\Binance
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: EthereumE#
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000033D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q&%localappdata%\Coinomi\Coinomi\walletsLR
Source: kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000033D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q8C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\kYpONUhAR5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\kYpONUhAR5.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\kYpONUhAR5.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2320321106.00000000033D7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: kYpONUhAR5.exe PID: 4508, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: kYpONUhAR5.exe, type: SAMPLE
Source: Yara match	File source: 0.0.kYpONUhAR5.exe.e30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2140548501.0000000000E32000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: kYpONUhAR5.exe PID: 4508, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Masquerading	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	221 Security Software Discovery	Remote Desktop Protocol	3 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	241 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Install Root Certificate	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	113 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
kYpONUhAR5.exe	82%	ReversingLabs	ByteCode-MSIL.Trojan.Whispergate

Source	Detection	Scanner	Label
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id14ResponseD	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000033D7000.00000004.00000800.00020000.00000000.sdmp, kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id23ResponseD	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000032E6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id12Response	kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/	kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id2Response	kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id21Response	kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id9	kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id8	kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id6ResponseD	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp, kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003597000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id5	kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id4	kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id7	kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id6	kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id19Response	kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id13ResponseD	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000033D7000.00000004.00000800.00020000.00000000.sdmp, kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id15Response	kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id5ResponseD	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9	kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id6Response	kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.ip.sb/ip	kYpONUhAR5.exe	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id1ResponseD	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id9Response	kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003269000.00000004.00000800.00020000.00000000.sdmp, kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id20	kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id21	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp, kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id22	kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id23	kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp, kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000032DD000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id24	kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id24Response	kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id1Response	kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id21ResponseD	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000035A1000.00000004.00000800.00020000.00000000.sdmp, kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/trust	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id10	kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id11	kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id10ResponseD	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000032DD000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id12	kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id16Response	kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id13	kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id14	kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id15	kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id16	kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id17	kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id18	kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id5Response	kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id19	kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id15ResponseD	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000033D7000.00000004.00000800.00020000.00000000.sdmp, kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id10Response	kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp, kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000032DD000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id11ResponseD	kYpONUhAR5.exe, 00000000.00000002.2320321106.000000000337F000.00000004.00000800.00020000.00000000.sdmp, kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id8Response	kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031D8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id17ResponseD	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/soap/envelope/	kYpONUhAR5.exe, 00000000.00000002.2320321106.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8ResponseD	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000033D7000.00000004.00000800.00020000.00000000.sdmp, kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust	kYpONUhAR5.exe, 00000000.00000002.2320321106.00000000031DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.67	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1520626
Start date and time:	2024-09-27 17:21:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	kYpONUhAR5.exe renamed because original name is a hash value
Original Sample Name:	58e8b2eb19704c5a59350d4ff92e5ab6.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 81 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: kYpONUhAR5.exe

Simulations

Behavior and APIs

Time	Type	Description
11:22:19	API Interceptor	57x Sleep call for process: kYpONUhAR5.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.67	oMHveSc3hh.exe	Get hash	malicious	Amadey Raccoon	Browse	185.215.113.67/4dcYcWsw3/index.php
	0KuDEDABFO.exe	Get hash	malicious	Amadey Raccoon	Browse	185.215.113.67/4dcYcWsw3/index.php
	miOnrvnXK0.exe	Get hash	malicious	Amadey Raccoon	Browse	185.215.113.67/4dcYcWsw3/index.php
	Rh74sODsWE.exe	Get hash	malicious	Amadey Raccoon	Browse	185.215.113.67/4dcYcWsw3/index.php
	dSQUdo6EjO.exe	Get hash	malicious	Amadey Raccoon	Browse	185.215.113.67/4dcYcWsw3/index.php
	usVhwck8lN.exe	Get hash	malicious	Amadey Raccoon	Browse	185.215.113.67/4dcYcWsw3/index.php
	SecuriteInfo.com.W32.AIDetect.malware1.20102.exe	Get hash	malicious	Amadey	Browse	185.215.113.67/4dcYcWsw3/index.php
	MR98F1zzeo.exe	Get hash	malicious	Amadey Raccoon Vidar	Browse	185.215.113.67/4dcYcWsw3/index.php
	8f5718a6042061b23a4e42ee5cd8112946c135dc9d0c2.exe	Get hash	malicious	Amadey	Browse	185.215.113.67/4dcYcWsw3/index.php
	fC4T1vVs24.exe	Get hash	malicious	Amadey	Browse	umbrelladownload.uno/gp6GbqVce/index.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Stealc	Browse	185.215.113.103
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

Process:	C:\Users\user\Desktop\kYpONUhAR5.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Thu Oct 5 05:47:19 2023, atime=Wed Sep 27 08:36:54 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	3.468213012568913
Encrypted:	false
SSDEEP:	48:8SMd5TvG90lRYrnvPdAKRkdAGdAKRFdAKR6P:8S2by7
MD5:	90F15C97129CA5CE8C9D7DA19D0825DF
SHA1:	0EE0A6B08DAB24ADEA377B9545A2269F2249CD8C
SHA-256:	2F62E45ECEE3517765881625966C8A2E3F147BCBEBD59516EA4A86922B1CCBD5
SHA-512:	8D0EEB09978E4959B9276FEA728C4CDF8463964C7B538D37A6DED5DC3C9D5154A8C8816D9524D510C5F3BF23E7B43F6511D73952C3ABB0993088D051EBFA89C6
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ......,....R.k.W....X.&&... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....EW.3..PROGRA~1..t......O.IEW.5....B...............J.......j.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VEW@2....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.2..Chrome..>......CW.VEW.2....M.....................7...C.h.r.o.m.e.....`.1.....EW.2..APPLIC~1..H......CW.VEW.2..........................7...A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.L .chrome.exe..F......CW.VEW.5.........................l...c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.!.-.-.p.r.o.x.y.-.s.e.r.v.e.r

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\kYpONUhAR5.exe.log

Download File

Process:	C:\Users\user\Desktop\kYpONUhAR5.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3274
Entropy (8bit):	5.3318368586986695
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlqY
MD5:	0B2E58EF6402AD69025B36C36D16B67F
SHA1:	5ECC642327EF5E6A54B7918A4BD7B46A512BF926
SHA-256:	4B0FB8EECEAD6C835CED9E06F47D9021C2BCDB196F2D60A96FEE09391752C2D7
SHA-512:	1464106CEC5E264F8CEA7B7FF03C887DA5192A976FBC9369FC60A480A7B9DB0ED1956EFCE6FFAD2E40A790BD51FD27BB037256964BC7B4B2DA6D4D5C6B267FA1
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Temp\Tmp382E.tmp

Download File

Process:	C:\Users\user\Desktop\kYpONUhAR5.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\Tmp383F.tmp

Download File

Process:	C:\Users\user\Desktop\kYpONUhAR5.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Users\user\Desktop\kYpONUhAR5.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0158FE9CEAD91D1B027B795984737614
SHA1:	B41A11F909A7BDF1115088790A5680AC4E23031B
SHA-256:	513257326E783A862909A2A0F0941D6FF899C403E104FBD1DBC10443C41D9F9A
SHA-512:	C48A55CC7A92CEFCEFE5FB2382CCD8EF651FC8E0885E88A256CD2F5D83B824B7D910F755180B29ECCB54D9361D6AF82F9CC741BD7E6752122949B657DA973676
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.082545442352462
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	kYpONUhAR5.exe
File size:	311'296 bytes
MD5:	58e8b2eb19704c5a59350d4ff92e5ab6
SHA1:	171fc96dda05e7d275ec42840746258217d9caf0
SHA256:	07d4b7768e13d79ac5f05f81167b29bb6fbf97828a289d8d11eec38939846834
SHA512:	e7655762c5f2d10ec246d11f82d437a2717ad05be847b5e0fd055e3241caaca85430f424055b343e3a44c90d76a0ba07a6913c2208f374f59b61f8aa4477889f
SSDEEP:	3072:Eq6EgY6iArUjOvWUJwPYT8QADFKoRJTA+tJSiK1cZqf7D34leqiOLibBOT:vqY6iULwP/xnRJTAKJ81cZqf7DIvL
TLSH:	14646D1823EC9511E37F4B7998B1E6749375EC16A852D31F4EC06CAB3E32741FA11AB2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ... ....@.. ....................... ............@................................

File Icon


Icon Hash:	4d8ea38d85a38e6d

Static PE Info

General

Entrypoint:	0x42b9d6
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xEAE6B680 [Fri Nov 19 07:02:24 2094 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
popad
add byte ptr [ebp+00h], dh
je 00007F7FB0B2D4A2h
outsd
add byte ptr [esi+00h], ah
imul eax, dword ptr [eax], 006C006Ch
xor eax, 59007400h
add byte ptr [edi+00h], dl
push edx
add byte ptr [ecx+00h], dh
popad
add byte ptr [edi+00h], dl
push esi
add byte ptr [edi+00h], ch
popad
add byte ptr [ebp+00h], ch
push 61006800h
add byte ptr [ebp+00h], ch
dec edx
add byte ptr [eax], bh
add byte ptr [edi+00h], dl
push edi
add byte ptr [ecx], bh
add byte ptr [ecx+00h], bh
bound eax, dword ptr [eax]
xor al, byte ptr [eax]
insb
add byte ptr [eax+00h], bl
pop ecx
add byte ptr [edi+00h], dl
js 00007F7FB0B2D4A2h
jnc 00007F7FB0B2D4A2h
pop edx
add byte ptr [eax+00h], bl
push ecx
add byte ptr [ebx+00h], cl
popad
add byte ptr [edi+00h], dl
dec edx
add byte ptr [ebp+00h], dh
pop edx
add byte ptr [edi+00h], dl
jo 00007F7FB0B2D4A2h
imul eax, dword ptr [eax], 5Ah
add byte ptr [ebp+00h], ch
jo 00007F7FB0B2D4A2h
je 00007F7FB0B2D4A2h
bound eax, dword ptr [eax]
push edi
add byte ptr [eax+eax+77h], dh
add byte ptr [ecx+00h], bl
xor al, byte ptr [eax]
xor eax, 63007300h
add byte ptr [edi+00h], al
push esi
add byte ptr [ecx+00h], ch
popad
add byte ptr [edx], dh
add byte ptr [eax+00h], bh
je 00007F7FB0B2D4A2h
bound eax, dword ptr [eax]
insd
add byte ptr [eax+eax+76h], dh
add byte ptr [edx+00h], bl
push edi
add byte ptr [ecx], bh
add byte ptr [eax+00h], dh
popad
add byte ptr [edi+00h], al
cmp dword ptr [eax], eax
insd
add byte ptr [edx+00h], bl
push edi
add byte ptr [esi+00h], cl
cmp byte ptr [eax], al
push esi
add byte ptr [eax+00h], cl
dec edx
add byte ptr [esi+00h], dh
bound eax, dword ptr [eax]
insd
add byte ptr [eax+00h], bh
jo 00007F7FB0B2D4A2h
bound eax, dword ptr [eax]
insd
add byte ptr [ebx+00h], dh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2b984	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x32000	0x1c9c4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x50000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2b968	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x2e9bc	0x2ec00	2412a20105aa703440ecc0ae6d36587c	False	0.46979967413101603	COM executable for DOS	6.205690802522852	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x32000	0x1c9c4	0x1cc00	d90c4c9df4f9c47bd32c68a9274242f2	False	0.23721127717391305	data	2.6058927068025572	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x50000	0xc	0x400	a8f475633df7505c506f361251753bd4	False	0.025390625	data	0.05585530805374581	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x321a0	0x3d04	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9934058898847631
RT_ICON	0x35eb4	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2835 x 2835 px/m	0.09013072282030049
RT_ICON	0x466ec	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2835 x 2835 px/m	0.13905290505432216
RT_ICON	0x4a924	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2835 x 2835 px/m	0.17033195020746889
RT_ICON	0x4cedc	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2835 x 2835 px/m	0.2045028142589118
RT_ICON	0x4df94	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2835 x 2835 px/m	0.24645390070921985
RT_GROUP_ICON	0x4e40c	0x5a	data	0.7666666666666667
RT_VERSION	0x4e478	0x34a	data	0.44061757719714967
RT_MANIFEST	0x4e7d4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-27T17:22:10.765544+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:10.765544+0200	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	1	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:10.992909+0200	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	1	185.215.113.67	15206	192.168.2.6	49710	TCP
2024-09-27T17:22:16.045665+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:16.363786+0200	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	185.215.113.67	15206	192.168.2.6	49710	TCP
2024-09-27T17:22:17.464550+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:17.712642+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:18.015035+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:18.279185+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:18.507423+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:20.639665+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:21.236540+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:21.469573+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:21.703432+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:22.134212+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:22.402884+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:22.728365+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:22.960033+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:23.210740+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:23.558591+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:23.564561+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:24.791517+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:25.161436+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:25.420755+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:25.678762+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:25.923591+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49710	185.215.113.67	15206	TCP
2024-09-27T17:22:26.203907+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49710	185.215.113.67	15206	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 17:22:09.653358936 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:09.658332109 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:09.658407927 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:09.673302889 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:09.678118944 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:10.374437094 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:10.415029049 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:10.765543938 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:10.771645069 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:10.992908955 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:11.040067911 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:16.045665026 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:16.050609112 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:16.275441885 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:16.275465965 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:16.275479078 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:16.275491953 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:16.275506973 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:16.275572062 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:16.275619984 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:16.363785982 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:16.363984108 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:16.364166021 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:16.452626944 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:16.493215084 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:17.464550018 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:17.470041990 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:17.692811012 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:17.712641954 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:17.717555046 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:17.942931890 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:17.993227005 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:18.015034914 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:18.019968987 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:18.243762970 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:18.279185057 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:18.284122944 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:18.506437063 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:18.507422924 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:18.512886047 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:18.734891891 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:18.780147076 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:20.639664888 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:20.887236118 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:21.109503031 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:21.165080070 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:21.236540079 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:21.241411924 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:21.464098930 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:21.469573021 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:21.474709988 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:21.697844982 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:21.703432083 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:21.708435059 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:21.708560944 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:21.708595991 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:21.708697081 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:21.708724976 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:21.708751917 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:22.129966021 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:22.134212017 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:22.141948938 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:22.363979101 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:22.402884007 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:22.408107996 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:22.654216051 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:22.696337938 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:22.728364944 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:22.733494997 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:22.957946062 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:22.960032940 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:22.966412067 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.207706928 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.210740089 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.237148046 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.465574980 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.508840084 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.558590889 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.564136028 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.564203978 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.564481020 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.564510107 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.564537048 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.564560890 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.564567089 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.564593077 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.564615011 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.564661026 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.564773083 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.564865112 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.564963102 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.564992905 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.565045118 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.565046072 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.565071106 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.565098047 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.565124035 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.565149069 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.565184116 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.566998959 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.567027092 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.567054033 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.567090034 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.567147017 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.569207907 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.569263935 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.569585085 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.569650888 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.569771051 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.569834948 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.569926977 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.569953918 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.569978952 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.569982052 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.570003033 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.570034027 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.570135117 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.570195913 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.570379972 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.570437908 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.570822001 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.570893049 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.571316004 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.571372032 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.572793961 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.572845936 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.574562073 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.574589968 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.574613094 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.574615955 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.574636936 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.574651003 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.574667931 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.574676991 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.574692011 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.574703932 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.574744940 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.574794054 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.574820995 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.574847937 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.574876070 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.574906111 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.574909925 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.574928999 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.574949026 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.574954033 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.575002909 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.575443029 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.575470924 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.575498104 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.575508118 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.575524092 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.575547934 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.575558901 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.575572014 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.575598955 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.575614929 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.575624943 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.575640917 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.575650930 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.575666904 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.575676918 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.575692892 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.575702906 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.575725079 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.575728893 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.575746059 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.575756073 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.575772047 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.575781107 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.575797081 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.575826883 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.575828075 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.575856924 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.575872898 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.575885057 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.575901031 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.575911045 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.575927973 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.575937986 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.575959921 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.575963974 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.575990915 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.576016903 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.576044083 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.576070070 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.576097012 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.576122999 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.576153994 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.576179981 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.576206923 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.576436996 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.576463938 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.576491117 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.576536894 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.576564074 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.576590061 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.576617002 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.576643944 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.576673985 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.577930927 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.577959061 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.577985048 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.578754902 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.580054045 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.580081940 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.580107927 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.580275059 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.580302000 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.580328941 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.580374002 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.580400944 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.580427885 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.580459118 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.580495119 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.580562115 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.580585003 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.580796957 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.580826044 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.580889940 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.580920935 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.581377029 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.581404924 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.581433058 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.581460953 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.581487894 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.581513882 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.581557035 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.581583977 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.581610918 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.581638098 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.581665039 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.582820892 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.582957029 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.582984924 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.583108902 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.583136082 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.583163023 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.583189011 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.583215952 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.583241940 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.583271027 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.583297968 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.583517075 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.583544016 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.583570957 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.584075928 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.584103107 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.584130049 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.584157944 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.584203959 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.584229946 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.584256887 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.584283113 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.584310055 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.584336042 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.584382057 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.584408045 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.584435940 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.584462881 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.584489107 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.584515095 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.584541082 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.584568024 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.584594011 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.584620953 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.584650993 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.584840059 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.584909916 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.587976933 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.588079929 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.588108063 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.588463068 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.588490963 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.588517904 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.588545084 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.588572025 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.588618994 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.588650942 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.588676929 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.588702917 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.588730097 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.588754892 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.589109898 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.589137077 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.589163065 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.589303017 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.589330912 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.589359045 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.589385986 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.589411974 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.589438915 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.589464903 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.589492083 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.589518070 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.589544058 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.589570999 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.589596987 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.589622974 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.589648962 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.589675903 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.589701891 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.589728117 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.589776039 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.589854956 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.589884043 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.589911938 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.589939117 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.589966059 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.589992046 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.590018034 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.590044022 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.590070009 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.590118885 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.590146065 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.590172052 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.590198040 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.590224028 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.590590954 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.590619087 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.590946913 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.590974092 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.591372967 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.591622114 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.591691017 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.591944933 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.592211008 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.592258930 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.592284918 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.592312098 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.592474937 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.592597961 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.592626095 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.592652082 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.592679024 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.592705011 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.592730999 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.592756987 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.592782974 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.592808962 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.592834949 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.592864037 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.592916012 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.592943907 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.592971087 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.592997074 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.593024015 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.593050003 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.593076944 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.593102932 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.593128920 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.593154907 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.593180895 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.593206882 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.593234062 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.593260050 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.593286991 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.593312979 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.593338966 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.593364954 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.593389988 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.593416929 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.593442917 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.593468904 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.593494892 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.593527079 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.593553066 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.593580008 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.593605042 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.593631029 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.593657970 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.593683004 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.593709946 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.593735933 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.593761921 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.593787909 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.593813896 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.593839884 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.593888998 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.594248056 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.594317913 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.597161055 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.597189903 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.597404003 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.597497940 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.597860098 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.597887993 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.597915888 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.597942114 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.597969055 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.598014116 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.598041058 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.598068953 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.598094940 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.598120928 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.598148108 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.598175049 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.598200083 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.598232031 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.598258018 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.598423004 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.598450899 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.598476887 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.598504066 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.598531008 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.598637104 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.598664045 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.598690033 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.598737001 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.598763943 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.598789930 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.598819017 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.598845005 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.598871946 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.598897934 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.598923922 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.598949909 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.598975897 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.599001884 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.599412918 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.599441051 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.599467039 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.599493027 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.599519968 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.599546909 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.599572897 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.599600077 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.599626064 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.599653006 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.599678993 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.599705935 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.600805998 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.600833893 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.600860119 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.600908995 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.600935936 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.600964069 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.600991964 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.601016998 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.601043940 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.601070881 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.601098061 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.601124048 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.601150990 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.601176977 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.601202965 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.601222992 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.601227999 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.601259947 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.601286888 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.601313114 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.601337910 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.601342916 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.601371050 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.601419926 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.601449013 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.601478100 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.601490021 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.601516008 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.601541996 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.601568937 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.601596117 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.601623058 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.601650953 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.601675987 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.601702929 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.601731062 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.601758003 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.601783991 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.601809025 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.601836920 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.601887941 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.601914883 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.601942062 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.601969004 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.601994991 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.602020979 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.602051020 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.602077961 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.602103949 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.602130890 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.602158070 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.602185011 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.602210999 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.602236986 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.602262974 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.602288961 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.602319002 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.602345943 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.608532906 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.608561993 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.608588934 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.608728886 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.608756065 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.608782053 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.608788967 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.608808041 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.608839989 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.608865976 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.608894110 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.608896971 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.608921051 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.608947039 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.609069109 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.609097004 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.609122992 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.609163046 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.609189987 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.609216928 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.609242916 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.609268904 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.609294891 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.609321117 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.609348059 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.609374046 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.609400034 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.609425068 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.609451056 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.609477043 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.609503984 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.609533072 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.609580040 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.609606981 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.609633923 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.609659910 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.609688997 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.609735966 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.609761953 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.609788895 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.609816074 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.609843016 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.609920025 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.609947920 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.609975100 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.610002995 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.610028028 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.610054970 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.610081911 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.610109091 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.610135078 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.610161066 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.610188007 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.610218048 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.610244036 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.614428997 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.614727020 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.618077993 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.618210077 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.660504103 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:23.660741091 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:23.690681934 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:24.723870039 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:24.774463892 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:24.791517019 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:24.796574116 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:24.796704054 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:24.796895027 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:24.796979904 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:24.797007084 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:24.797034025 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:24.797060966 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:24.797086954 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:24.797112942 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:24.797138929 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:24.797164917 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:24.797420025 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:24.797447920 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:25.159065008 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:25.161436081 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:25.167510033 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:25.395262957 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:25.420754910 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:25.451363087 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:25.674411058 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:25.678761959 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:25.683995008 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:25.922630072 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:25.923590899 CEST	49710	15206	192.168.2.6	185.215.113.67
Sep 27, 2024 17:22:25.928935051 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:26.168049097 CEST	15206	49710	185.215.113.67	192.168.2.6
Sep 27, 2024 17:22:26.203907013 CEST	49710	15206	192.168.2.6	185.215.113.67

Target ID:	0
Start time:	11:22:07
Start date:	27/09/2024
Path:	C:\Users\user\Desktop\kYpONUhAR5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\kYpONUhAR5.exe"
Imagebase:	0xe30000
File size:	311'296 bytes
MD5 hash:	58E8B2EB19704C5A59350D4FF92E5AB6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000000.2140548501.0000000000E32000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2320321106.00000000033D7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	72
Total number of Limit Nodes:	6

Executed Functions

Function 06A767D8 Relevance: .4, Instructions: 417COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f31c159a7727f4049d422c2dadfea36ca48a75693f2a3e64d17a688c298a9931
Instruction ID: a6afd33617673a37713cd11421f347ee3693303cb2e6781b727d6fed7f23b639
Opcode Fuzzy Hash: f31c159a7727f4049d422c2dadfea36ca48a75693f2a3e64d17a688c298a9931
Instruction Fuzzy Hash: 5AF1AF30A0060A9FDB55DFA8DD40B9EBBF2EF84300F149569E545AF2A1DB70ED46CB90

Function 06A7A3D8 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71da7217371c148f35902ca86630b1bef0b109cc972cd1393d50ec94e0d767d5
Instruction ID: 567ee54c69f09912874798188d4afcad8a9ef0da76379af3f9a38131cf4b04ad
Opcode Fuzzy Hash: 71da7217371c148f35902ca86630b1bef0b109cc972cd1393d50ec94e0d767d5
Instruction Fuzzy Hash: B9D1C134E01218CFDB18EFB4D854AADBBB2FF8A301F1085A9D51AAB354DB315986CF11

Function 06A7A3E8 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03c1ad8f0034de4db1e188755f7f01a89fea8ed6981305614fa40ae2e3487250
Instruction ID: 464ccae1cfa5fc5c4debca305a55501d03a5967aa6d2a8fb093d007df986bfd2
Opcode Fuzzy Hash: 03c1ad8f0034de4db1e188755f7f01a89fea8ed6981305614fa40ae2e3487250
Instruction Fuzzy Hash: 19D1C234E01218CFDB18EFB5D854A9DBBB2FF8A301F1081A9D51AAB394DB315986CF11

Function 017DD0A8 Relevance: 6.1, APIs: 4, Instructions: 131
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 017DD136
GetCurrentThread.KERNEL32 ref: 017DD173
GetCurrentProcess.KERNEL32 ref: 017DD1B0
GetCurrentThreadId.KERNEL32 ref: 017DD209

Memory Dump Source

Source File: 00000000.00000002.2320063609.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17d0000_kYpONUhAR5.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: a89b3b18d0e640732c6f6dca3e0208f3630740fa0f04fd193c9698fd1efb112c
Instruction ID: 0fe2512aa073c808e53b6d4b61b69ebbb936064063b42b2382b013ee06b69cf0
Opcode Fuzzy Hash: a89b3b18d0e640732c6f6dca3e0208f3630740fa0f04fd193c9698fd1efb112c
Instruction Fuzzy Hash: 955152B090024ACFDB14CFA9D948B9EBFF1EF88314F208459E509A73A0DB75A944CF65

Function 017DD0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 017DD136
GetCurrentThread.KERNEL32 ref: 017DD173
GetCurrentProcess.KERNEL32 ref: 017DD1B0
GetCurrentThreadId.KERNEL32 ref: 017DD209

Memory Dump Source

Source File: 00000000.00000002.2320063609.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17d0000_kYpONUhAR5.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 91e53a34d8277f29b676a0556c94a5413f23f3c69d51b776ebc28156d840cd5b
Instruction ID: b4b895e0daabb0c94f4d9602061178b5db704801dda873ccf4dae2af13dfb568
Opcode Fuzzy Hash: 91e53a34d8277f29b676a0556c94a5413f23f3c69d51b776ebc28156d840cd5b
Instruction Fuzzy Hash: D45155B090024A8FDB14CFA9D948B9EBFF1FF88314F208419E509A7390DB75A944CF65

Function 017DAE30 Relevance: 1.7, APIs: 1, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 017DB086

Memory Dump Source

Source File: 00000000.00000002.2320063609.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17d0000_kYpONUhAR5.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f0d047f8dd8137d00a53252387ce78a9184558edc2ea5781afdde1ba5cdfb384
Instruction ID: b9cd111f84b0ff1750366c5c216f00c7f1792e4c7f8506797ec6a1398ec6ddae
Opcode Fuzzy Hash: f0d047f8dd8137d00a53252387ce78a9184558edc2ea5781afdde1ba5cdfb384
Instruction Fuzzy Hash: 2C7123B0A00B0A8FEB24DF6AD54575AFBF1FF88200F04896DD54AD7A90DB74E845CB91

Function 017D4248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 017D59F1

Memory Dump Source

Source File: 00000000.00000002.2320063609.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17d0000_kYpONUhAR5.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 7e8352bc816aa387b831a8879c21ec96106cc7ededeb964039f2e539e8732354
Instruction ID: bcb7c2e5b908cf2f067078f417d8a4429c6bf94f849adefbd75c926996cf3e70
Opcode Fuzzy Hash: 7e8352bc816aa387b831a8879c21ec96106cc7ededeb964039f2e539e8732354
Instruction Fuzzy Hash: 3941EFB1C0072DCBEB24CFA9C984B8DBBB5FF89304F20816AD408AB251DB756945CF91

Function 017D5935 Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 017D59F1

Memory Dump Source

Source File: 00000000.00000002.2320063609.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17d0000_kYpONUhAR5.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 67f09e45e19e3e427ade0ab69503bb4bb2f4e887d909c92789e722d0d052652c
Instruction ID: 1e8266968184e6bb70f8dff9150bd7379bce7758768d61e8b52e7d26d7508b1b
Opcode Fuzzy Hash: 67f09e45e19e3e427ade0ab69503bb4bb2f4e887d909c92789e722d0d052652c
Instruction Fuzzy Hash: F541EFB0C0072DCBEB24CFA9C984B8DBBF5BF89304F20815AD508AB251DB756945CF91

Function 06A759C8 Relevance: 1.6, Strings: 1, Instructions: 318
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 06A75C29

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 95de1d6f1eb56b67ef9b6b4043919dd017aefb2fdcce62cb84af1f04b3a26b46
Instruction ID: 16c8f0e13f67d4c6e3d437da3b7ad1ddc77f697d2c932016a38841d042548af9
Opcode Fuzzy Hash: 95de1d6f1eb56b67ef9b6b4043919dd017aefb2fdcce62cb84af1f04b3a26b46
Instruction Fuzzy Hash: 86D15934B00602CFCB54DF69C98096ABBF2FF89310725CA59D55A9B662DB30FD46CB90

Function 017DD300 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 017DD387

Memory Dump Source

Source File: 00000000.00000002.2320063609.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17d0000_kYpONUhAR5.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3e66b214cb5339764406cbbe78db7342df8880bf6332a1529877695f280076d4
Instruction ID: e6ee3fcee35b8bf5e3762afe9fc08bb73cb27048a3eafa4265d7b16b315c7302
Opcode Fuzzy Hash: 3e66b214cb5339764406cbbe78db7342df8880bf6332a1529877695f280076d4
Instruction Fuzzy Hash: B821B3B5900249DFDB10CF9AD984ADEFFF5EB48320F14841AE918A3350D774A954CFA5

Function 017DD2F9 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 017DD387

Memory Dump Source

Source File: 00000000.00000002.2320063609.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17d0000_kYpONUhAR5.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 33a79f5d2150c21fb6b53dc02f6f3e507567d51b565c532451e42cbb1bfb16c6
Instruction ID: cea140a4f92ac7ed6d2fc1e10e0dece29e3301ea94c3bc2d05f622526cc16073
Opcode Fuzzy Hash: 33a79f5d2150c21fb6b53dc02f6f3e507567d51b565c532451e42cbb1bfb16c6
Instruction Fuzzy Hash: 8721E0B5900209DFDB10CFAAD985ADEFBF5AB48320F14841AE918A3350D378A950CF60

Function 017DB020 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 017DB086

Memory Dump Source

Source File: 00000000.00000002.2320063609.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17d0000_kYpONUhAR5.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 4b18b9e1916110808f6b3e8e617bf34f67081ec59c642e5b406e03daa82d5ff6
Instruction ID: 885d2a6829281a487a53c5a5403118fe3b1986553200cb2248e8d3ce91e9046f
Opcode Fuzzy Hash: 4b18b9e1916110808f6b3e8e617bf34f67081ec59c642e5b406e03daa82d5ff6
Instruction Fuzzy Hash: D3110FB6C003498FDB20CF9AC444B9EFBF4AB89320F14842AD928B7210C379A545CFA1

Function 06A61BA0 Relevance: 1.5, Instructions: 1454
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2324468236.0000000006A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a60000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccb427507a818868c6b3610cb75de0bccddf6ee76cad2c5c492267f566090dd5
Instruction ID: 65eb924e8032bf5a4a5bf375279155de6a2038377cb10fa2047e4e4a097a22da
Opcode Fuzzy Hash: ccb427507a818868c6b3610cb75de0bccddf6ee76cad2c5c492267f566090dd5
Instruction Fuzzy Hash: 90C22B70A002189FCB54DF64C994BADBBB6FF88700F118499E606AB3A1DF719E41DF61

Function 06A600D8 Relevance: .7, Instructions: 676
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2324468236.0000000006A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a60000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f506e848fe934b553de58f914533237d85930d8d5d03ade56e252cf6516db7c
Instruction ID: 1cbd081cca0282f0d5d2e230e960a31ce5ae36eadcec5c7f52074254894b5f96
Opcode Fuzzy Hash: 1f506e848fe934b553de58f914533237d85930d8d5d03ade56e252cf6516db7c
Instruction Fuzzy Hash: 04427730B00715CFDB68AF79D85066EBAB2FBC5604B005A5CD503AB391CFBAEC458B95

Function 06A63838 Relevance: .6, Instructions: 634
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2324468236.0000000006A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a60000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bcf521891f72f0e2cdcc67027bdecd61fc933de94c4a30bfda27f260ba74b35
Instruction ID: 4799c6485c22b5e101a2b29928460f93e8ed44c18e488aebb6d485c51c90d5c4
Opcode Fuzzy Hash: 3bcf521891f72f0e2cdcc67027bdecd61fc933de94c4a30bfda27f260ba74b35
Instruction Fuzzy Hash: 09420474B002149FCB44DF69C994AAEBBF6AF89704F118099E606EB3A1DB71ED41CB50

Function 06A60D80 Relevance: .6, Instructions: 618
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2324468236.0000000006A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a60000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b52a36dbc0d740de27f3914aa1069932ca5031245d0b6dce975d0bbaf1b73ed
Instruction ID: 452b1ae91513f80b5010d0d58dd5848c26d3bc47e459a4e10cc5f64c4047a843
Opcode Fuzzy Hash: 7b52a36dbc0d740de27f3914aa1069932ca5031245d0b6dce975d0bbaf1b73ed
Instruction Fuzzy Hash: D832A070B002059FDB54AB6AC944A6EBBF6FF89304B158469F506DB3A2DF70DC41CBA1

Function 06A748A8 Relevance: .5, Instructions: 504
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8128b0a25268a3757a0193823dbf670a15cdff1902282606f7747e9fcc2cb382
Instruction ID: 143c9e02b033445b0a5ce63a41ee3fec8d168e6a06c1e62d6acd1484a33a5f78
Opcode Fuzzy Hash: 8128b0a25268a3757a0193823dbf670a15cdff1902282606f7747e9fcc2cb382
Instruction Fuzzy Hash: B3121934B00605CFDB54EF29C984A6ABBF2FF89305B1584A9E506DB762DB34EC45CB90

Function 06A64BEC Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324468236.0000000006A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a60000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17c34f6bc11193c5a6d30d203cfa8cfdd35d5898239ac85721b9621e70a797c7
Instruction ID: 0e36b1164304b52edd6b40449b68dc65e00c7a5f6eff2a586f9e5e964a3e9cfd
Opcode Fuzzy Hash: 17c34f6bc11193c5a6d30d203cfa8cfdd35d5898239ac85721b9621e70a797c7
Instruction Fuzzy Hash: B791CB70B00205CFDB54AF79C854A6EBBF6EF89200B1585AAE516CB3A2DF34DC05CB60

Function 06A73F50 Relevance: .4, Instructions: 397COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb47e015741673f3a61d72ed0d6b572cf4c93c1ecaa6579d614921d8bd9a38d7
Instruction ID: 1c8fd086586ebb72d9029bd17256d1007dc33dae5902b3e69a364bc9991518bd
Opcode Fuzzy Hash: cb47e015741673f3a61d72ed0d6b572cf4c93c1ecaa6579d614921d8bd9a38d7
Instruction Fuzzy Hash: 64E11D34B002158FCB54EF69C9949AEBBF6FF88710B158169D906EB365DB71DC01CBA0

Function 06A600B9 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324468236.0000000006A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a60000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d014e4d106cad1d187df2234ddcad099975fa42deed9ffe350018b2359f3473
Instruction ID: eef2c6705c0ad01daaa0368403afb44ea57429f664a2601a31c7cfa302a50737
Opcode Fuzzy Hash: 7d014e4d106cad1d187df2234ddcad099975fa42deed9ffe350018b2359f3473
Instruction Fuzzy Hash: B9C15E34B00204DFEB449BA5C958B697AB6FF89704F108459FA02DB3A1CFB5DD81CB61

Function 06A61530 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324468236.0000000006A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a60000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30767561b2f30755f95c1c9ada7f019ef01b473a01d4a5eee38b49b5a504ba1c
Instruction ID: 9dfa3e269cfbc22dca2d7f6ea1c8176094340673fb4ea124453ae7310c46a7b9
Opcode Fuzzy Hash: 30767561b2f30755f95c1c9ada7f019ef01b473a01d4a5eee38b49b5a504ba1c
Instruction Fuzzy Hash: 9171D178B002449FDB40EBA9C85496EBBF6EF85300B14845AE812DB3A2DF74DC01CF50

Function 06A73F3F Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 347dd4b1e35e1242cccf2f3a0f035a8bdc8a78468540b8a5d8fb124d69a11bc5
Instruction ID: 0f1bd0236c24be45fe41939f958bdd7b65622954b7f90d260af54716b4e1e8b8
Opcode Fuzzy Hash: 347dd4b1e35e1242cccf2f3a0f035a8bdc8a78468540b8a5d8fb124d69a11bc5
Instruction Fuzzy Hash: 9E610C34F006168FCB54EF69C9446AEBBF6EF88600B158169D906EB765DB71DC01CBA0

Function 06A77D58 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41e8c23216a97879583395cf9e5b75b27f8911b53bef1dcb2b42be8b4b49e7ce
Instruction ID: 39739dcb77ad123be4ae5c68623aabcf4bb17943762529cff1a9d32012554c2d
Opcode Fuzzy Hash: 41e8c23216a97879583395cf9e5b75b27f8911b53bef1dcb2b42be8b4b49e7ce
Instruction Fuzzy Hash: AC513371E0021DDFDB54DFA9C980BEEBBF6AF88710F14852AE815AB244DB749841CF81

Function 06A63328 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324468236.0000000006A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a60000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8520ede3bc014877675656fdf2669c95f946a908daef283c56641f3a67ee695
Instruction ID: 6715a21cf003e64d668f72550f721925bac1848f33afa37f89296ae1d3e6dc52
Opcode Fuzzy Hash: e8520ede3bc014877675656fdf2669c95f946a908daef283c56641f3a67ee695
Instruction Fuzzy Hash: 94513935B10218AFCB44DF69C8849AEBBB2FF89710B15806AF905EB361DB71EC05CB50

Function 06A634D8 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324468236.0000000006A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a60000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa53f8c340fd2ff401452a0840f87a5a97246db51bc16116aa58f9fd5fb1f7ac
Instruction ID: de63a508b8ce907340b2523ed4a051b5b63ae37c9d9e16aa041f260eeac02772
Opcode Fuzzy Hash: fa53f8c340fd2ff401452a0840f87a5a97246db51bc16116aa58f9fd5fb1f7ac
Instruction Fuzzy Hash: 04513635B106099FCB44DF69C8849AEBBF2EF89714B15806AF906EB361DB71EC05CB50

Function 06A77D4C Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0541c96fbf8bd0028a9c5aa9933d06945b1de6a00d4ee0bbc4c3d51e773cb08
Instruction ID: 5b3f054004f32c822a53dd1f93641d492d7d9cd1ec36e54a068652c8c1e2b59e
Opcode Fuzzy Hash: d0541c96fbf8bd0028a9c5aa9933d06945b1de6a00d4ee0bbc4c3d51e773cb08
Instruction Fuzzy Hash: F45134B0E0025D9FDB55DFA9C984BDEBBF6BF48700F14842AE815AB280DB749845CF91

Function 06A61290 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324468236.0000000006A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a60000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d03140323e584988acdbae62333de0bd61843f9c9983cd4d9048f6bae369cd8
Instruction ID: 419dc09ec33473ebc26999c7169844587b4da7d9bea7b35d9ffbbe2583ab5703
Opcode Fuzzy Hash: 6d03140323e584988acdbae62333de0bd61843f9c9983cd4d9048f6bae369cd8
Instruction Fuzzy Hash: 144165B47102019FD7445BAE9854B6F7AABAFC9B04F114465FB02DB7A2CFB1DC018791

Function 06A73DE0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba0772a1985b50c79cb269a8c2311c8dec586da1e504ed1e81fedf8739c4989f
Instruction ID: 315c3bd722ee37492616dc45d1b0c76a11116bda36b74a90c4f109c2b0974c99
Opcode Fuzzy Hash: ba0772a1985b50c79cb269a8c2311c8dec586da1e504ed1e81fedf8739c4989f
Instruction Fuzzy Hash: 9931F2317053518FC71AA738A8504AE7BE6DFC622031644AED44ACF781CE35DC4BC7A5

Function 06A784C8 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e24deba4465e8eb1a1de008a63c635df37ec70caec4894ae913e4ffd9b67a9ac
Instruction ID: dcc1ba3ac341287fc139b651e4185a3ff8b2c53de8dadd79e6fbdb8ad35d5da3
Opcode Fuzzy Hash: e24deba4465e8eb1a1de008a63c635df37ec70caec4894ae913e4ffd9b67a9ac
Instruction Fuzzy Hash: 1931D1717002149BDB09AF79E8641BE3BE7EFC8210750447ED60ACB385EE359D0687E2

Function 06A75579 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77fbbfe2cca4bade4d2c7d718659c5c8b4d29b6c23a035335a050dbf48583462
Instruction ID: 25ccc8c54d9337d8b68206939368067572a996354b39bf348e82812e96a83475
Opcode Fuzzy Hash: 77fbbfe2cca4bade4d2c7d718659c5c8b4d29b6c23a035335a050dbf48583462
Instruction Fuzzy Hash: 6A317A35B012119FCB05DF38D88496E7BF2BF89701B058469EA06CB365DB30ED05CB90

Function 06A75588 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32c6b8f1c4fbc10cde095462d5b5eebc915705ef188f00d7661e0e9fc20f77aa
Instruction ID: 000c35bdd66c5b37ae2f3dd54c20b942819eeeb9923a575d95778fbe2d829ba4
Opcode Fuzzy Hash: 32c6b8f1c4fbc10cde095462d5b5eebc915705ef188f00d7661e0e9fc20f77aa
Instruction Fuzzy Hash: 6D315534B012109FCB49EF38D88496EBBF2FF89210B018469EE068B365DB30ED01CB90

Function 06A787A0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58cff16cf917d6fc2653c9caa1d26a2a0cc98666f37eebc50288dceb494d8c17
Instruction ID: 69794dbdc67d6f4fb4f174ed6beb454082708dea705f9dbcbc0e4f192556be9d
Opcode Fuzzy Hash: 58cff16cf917d6fc2653c9caa1d26a2a0cc98666f37eebc50288dceb494d8c17
Instruction Fuzzy Hash: AD4102B1D01248DFDB54DFAAD944ADEFBF6AF88310F14802AE815BB250DB34A945CF90

Function 06A61515 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324468236.0000000006A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a60000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b96ee7a24b4f3d4bd19925881a79e2ea447ac14dbec002eb3c84190bd8ba48a2
Instruction ID: cfd77a4d31f9eadb966c725412361727cb3064e287797d4c6c5149e6d647fedc
Opcode Fuzzy Hash: b96ee7a24b4f3d4bd19925881a79e2ea447ac14dbec002eb3c84190bd8ba48a2
Instruction Fuzzy Hash: F431C174B002449FDB009FA9C9548AEBFF6EF85210B15416AE816DB3A2CB74DD01CBA1

Function 06A78797 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cf0ecff6b74d60def02925716f0af2f4f58376dfdb56b87b7bb5385f92ae7d1
Instruction ID: d93e3a662f98b0f3797f71dd5ab0ddba8d851d9b47215377537667d64423452f
Opcode Fuzzy Hash: 8cf0ecff6b74d60def02925716f0af2f4f58376dfdb56b87b7bb5385f92ae7d1
Instruction Fuzzy Hash: 233103B1D012499FDB54DFAAC944BDEBFF6AF88310F14802AE415BB290DB74A945CF90

Function 06A78A98 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f03699f48230eaa66d2afd1873de7dd8d1629c97b8dd743677beb80548f51069
Instruction ID: 865bed38fbb607202ae1c829ada1b9744b3cec0b4a1c3283eff1252e3312e70d
Opcode Fuzzy Hash: f03699f48230eaa66d2afd1873de7dd8d1629c97b8dd743677beb80548f51069
Instruction Fuzzy Hash: 523114B1D01218DFDB54DFA9D894BDEBBF5BF88310F14802AE405B7240C778A845CB90

Function 0166D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2319788416.000000000166D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0166D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_166d000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 441c7a91833aa558d951d050ae61e8e9f0658841ae70ca5535080b90c05004a9
Instruction ID: 013d4ae75d43c758423b8cd89e6bb07d12c158c1ff630f76fc079258fb344963
Opcode Fuzzy Hash: 441c7a91833aa558d951d050ae61e8e9f0658841ae70ca5535080b90c05004a9
Instruction Fuzzy Hash: E0213672200244EFDB05DF44D9C0B6ABF69FB88324F20C16CD94A0B256C336E856CAA1

Function 06A61068 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324468236.0000000006A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a60000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17c4b1297f90a12993de25c546af729dd17be6bc3eb2eb510e64d7447053dc93
Instruction ID: 0f03ead25e6494110c17f19949ea74427f874bac855b0ac23651b61b314b45a5
Opcode Fuzzy Hash: 17c4b1297f90a12993de25c546af729dd17be6bc3eb2eb510e64d7447053dc93
Instruction Fuzzy Hash: 03219F30B001049FDB44AB6ED9449AEBBFAFFD8210B158569E5269B7A1DB30CD10CBA1

Function 0167D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2319823019.000000000167D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0167D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_167d000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e57e07b6ba0a5eafb31af54a1ad3fac129fd3ee0b85a91502d559f6592463eea
Instruction ID: 5c8dddaf4870facd67f33fb4517dc506c3eed01e2210182cb33365528c367db6
Opcode Fuzzy Hash: e57e07b6ba0a5eafb31af54a1ad3fac129fd3ee0b85a91502d559f6592463eea
Instruction Fuzzy Hash: 03210075604200EFDB16DF64D980B26BB61EF84314F20C96DD90A0B392C37AD447CA61

Function 06A78F43 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 334e18e2f9ca5c08084ffdedbaee6ef0c47ff0b4bd6588bf44ace510515146cb
Instruction ID: f109958cc8304cc5f12269305ff2ffd4a7f86b71455e141cb516d3b5cf2cfb67
Opcode Fuzzy Hash: 334e18e2f9ca5c08084ffdedbaee6ef0c47ff0b4bd6588bf44ace510515146cb
Instruction Fuzzy Hash: 3B211374D0525ADFCB40DFA8D888AEEBBB1EF09311F1041AAE415AB351D7385A81CB90

Function 06A78A8C Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e34c5ef34e99817ad5616f7b0b72100b8ef6c2d9aa1a0862f5a8fdbda4cd38c
Instruction ID: 4c8da2254f654ee8a5a135c224cbbdaa7471338d5bf121025f3e83ca3e0fb4cf
Opcode Fuzzy Hash: 9e34c5ef34e99817ad5616f7b0b72100b8ef6c2d9aa1a0862f5a8fdbda4cd38c
Instruction Fuzzy Hash: 742135B1D01349AFDB14DFA9C894BDEBFF9AF88310F14842AE405A7241DB74A845CBA0

Function 06A76E73 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f11e3295369b0048ce304344e3728487ac2b608d04b68030971f1ac98807671
Instruction ID: 50105188c34d169856ce020876739c89e9ca10961a6640d9cceb1be52ff1e178
Opcode Fuzzy Hash: 2f11e3295369b0048ce304344e3728487ac2b608d04b68030971f1ac98807671
Instruction Fuzzy Hash: AF01923220E2E92EC7524AA95C10CFB7FEDDA8F161709419BFAD5C6153C0188A66D7B1

Function 06A64B3C Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324468236.0000000006A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a60000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7b99cd68a37e962399c466c4e2cad7265e295063fccc0720c943d7278245bce
Instruction ID: c9b75fbd52bb98702335edd2aa4feec09ab83842420b0416e0d8b3db55f2fc2e
Opcode Fuzzy Hash: c7b99cd68a37e962399c466c4e2cad7265e295063fccc0720c943d7278245bce
Instruction Fuzzy Hash: 25116AB27402069FCB44DBB8C854A6EFBF2FFC8610B108469D25ADB3A1DE71E805CB51

Function 0166D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2319788416.000000000166D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0166D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_166d000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction ID: 91900e32326ba5df87661f0cf27d05bcbfb702c1f7bee489a5a6fa263652b7d2
Opcode Fuzzy Hash: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction Fuzzy Hash: 0C11DFB6504280DFCB02CF44D9C0B56BF71FB84324F24C2A9D8490B257C33AE856CBA1

Function 0167D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2319823019.000000000167D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0167D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_167d000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction ID: 88e4ad97f46bdb9a9e1805b38277984b730604a883a3219fb2afa0f5c21eb0a9
Opcode Fuzzy Hash: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction Fuzzy Hash: D811BB75504280CFCB12CF54D9C4B15BBA2FB84314F28CAAAD8094B796C33AD40ACBA2

Function 06A7BC5F Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a674d6dc2199d518d70fc0e596b3e192d1d27ac013e591f98d1de9de5382fb8c
Instruction ID: 5aa8e392e608998e8c3531bee4cda3a0ef2f9c26f28ec2e15e8b442c945cad5f
Opcode Fuzzy Hash: a674d6dc2199d518d70fc0e596b3e192d1d27ac013e591f98d1de9de5382fb8c
Instruction Fuzzy Hash: 560192312002069FD798AB38E854A6E7BA7FFC1254B54482CD64B87B40DE707D4AC7F5

Function 06A78350 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1f36934afaa56ea60da76edadc91e692a541003d7078dcc480ae467d84b27d7
Instruction ID: 00eba52cca8dfdf66832b7d46d322a7fabbb13bc5c222489f28eaf9f9632ca42
Opcode Fuzzy Hash: f1f36934afaa56ea60da76edadc91e692a541003d7078dcc480ae467d84b27d7
Instruction Fuzzy Hash: 7F018F31B001199BDF10DEADEC98ABFF7FAEBD4661B14403AE605D3240EB74991587A1

Function 06A7C499 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85f41907e6cd90d450d5e2a3f878265a786a56604f56a5891cc6dd1afdf3b6cb
Instruction ID: 5be2e9566b0c7ee822ce6bdb25d1f74d9d5df466840515138d7dd56a2dc78f65
Opcode Fuzzy Hash: 85f41907e6cd90d450d5e2a3f878265a786a56604f56a5891cc6dd1afdf3b6cb
Instruction Fuzzy Hash: 2501A1342007068BE364AF69E41465A7BE3FFC5315F108A2DD14A87740CF74A80ACBA1

Function 06A7BC70 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e3abd510e1e04f6f6fc12a989cf23a986caaf513f26bdd7c3eac66ef348320a
Instruction ID: 4a4ec0de07cfcfa866829bae17a667e3f20df8748f5a7629000159f3193f7df0
Opcode Fuzzy Hash: 4e3abd510e1e04f6f6fc12a989cf23a986caaf513f26bdd7c3eac66ef348320a
Instruction Fuzzy Hash: 35018F3120020A8FDA88A738E85452E7BA7FFC1254754582CD20B8BB40DEB07D4AC7F6

Function 0166DAA5 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2319788416.000000000166D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0166D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_166d000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d79c286e8a660947de419883ee3b85ac2e5210be29f59864b63d23068ccf8e8
Instruction ID: 308c4eaea2f98fe5d4dfb2fe9611850c52ff213ae860505a228a828cb2a4a700
Opcode Fuzzy Hash: 8d79c286e8a660947de419883ee3b85ac2e5210be29f59864b63d23068ccf8e8
Instruction Fuzzy Hash: 0A01F77160C3409EE7104F99CD84B2BBF9CDF41370F18C45AEE480A286C7B89441CBB1

Function 06A7C4A8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ae00ee6c68b324ad9e17efa489119b0d06ced6978b0c3611462c031de2d03f8
Instruction ID: 7025f981baefd04779b69caebdca3fa1f317284a2362fc7ee1641f3212245ae9
Opcode Fuzzy Hash: 0ae00ee6c68b324ad9e17efa489119b0d06ced6978b0c3611462c031de2d03f8
Instruction Fuzzy Hash: EB01B53420060A8FE314EF66E44465A7BE3FFC5715B108A2CC14B87740CF74AC0ACBA1

Function 06A75508 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be72fca4a7f48f1b9d3db54647cc1eb6b721f228077f6cdea630f87534c0086a
Instruction ID: 7dced5d4fa2dc7dbfa43cf9fa5f23b7619c12e587ab42f643504012d67496c99
Opcode Fuzzy Hash: be72fca4a7f48f1b9d3db54647cc1eb6b721f228077f6cdea630f87534c0086a
Instruction Fuzzy Hash: 8D018130E01712CFDBA9AB39F804527B7F7BF84619714883CD5068AA14DEB5E481CBD0

Function 06A7E8B0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dee8093d95cedf51e57d684ae30e821261f94ad3742a4657e789f826636f135
Instruction ID: ea226feba8004f96db075a384a5731ef538ee9579771665c244b8d4929661073
Opcode Fuzzy Hash: 1dee8093d95cedf51e57d684ae30e821261f94ad3742a4657e789f826636f135
Instruction Fuzzy Hash: 5A01AD34618309DFCB05AF64D8148693FB6EF8620071488EDE5458B221DA329C11DB91

Function 06A78F50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4abc46e191fec10f1d51bebc47e087f281c8e8d996781d075a212a304ea10925
Instruction ID: f64c9525892e50e4dea54c4eb597d7222ba1c3e633160647c8dbb4dfa2eb0060
Opcode Fuzzy Hash: 4abc46e191fec10f1d51bebc47e087f281c8e8d996781d075a212a304ea10925
Instruction Fuzzy Hash: 4C01D2B4D0520AEFDB44EFA9D9496AEBBF1BF49301F1095AAD815A3340E7780A40CF91

Function 0166DAA4 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2319788416.000000000166D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0166D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_166d000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b1ae5444f3f6e67d0a7691dbd24fbad8f4b9f11e1c3b5a0a70a4cd5765989aa
Instruction ID: 888c3c38a1047837d344aca276fbf844869e3af0db146059ab53b573bf82cf7c
Opcode Fuzzy Hash: 7b1ae5444f3f6e67d0a7691dbd24fbad8f4b9f11e1c3b5a0a70a4cd5765989aa
Instruction Fuzzy Hash: 68F0C2B1504344AEE7108E09CDC4B62FF9CEB41674F18C45AEE480B386C3789840CAB1

Function 06A7B358 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32c3829391c904d9cb5e376f43c217bfafe95295edafeae07882ca282255c4b5
Instruction ID: 08e5c793542b6c839d3edb535b8ef2296bf654651b698d24b23c44b127729c92
Opcode Fuzzy Hash: 32c3829391c904d9cb5e376f43c217bfafe95295edafeae07882ca282255c4b5
Instruction Fuzzy Hash: 22011634A0120AEFCB44EFA9E98479CBBB2FB85205F1045ACD905A7310EB341E85DB65

Function 06A73EC8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0fb0f85eca920269731fd8524f6c5789145b4c2ca6784865aa217d6991d4382
Instruction ID: 6bf05ac58c801e96920cb1ced6f41bb2e9421106093e26ce737e815765554830
Opcode Fuzzy Hash: e0fb0f85eca920269731fd8524f6c5789145b4c2ca6784865aa217d6991d4382
Instruction Fuzzy Hash: BAF090303002018BC609E72AE85096E7BD7EFC9210750592CC50E9BB40EF70ED0B87E5

Function 06A76EA0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 812d44c9b86153eb4e3810141dba45a00d0ecf94aa2ae4b9b2f66f47c9a7155e
Instruction ID: 2deb1294c766d48179b2c846593c57ff9909ae9ad0a5c46e21cc38f049bb5daf
Opcode Fuzzy Hash: 812d44c9b86153eb4e3810141dba45a00d0ecf94aa2ae4b9b2f66f47c9a7155e
Instruction Fuzzy Hash: 78F012722081E83F8B554E9A5C10CFB7FEDDA8E161B084156FE99D2241C429C921ABB0

Function 06A7ACB8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38ffefbf3b047d8ebf2cc92eb58712d618fae80ae698d6c5fd762fb987bbcdb2
Instruction ID: 7a280fd320cf9b8a5d85c775904585fe2911cee9ecf63ef66a3529ca1f93edbe
Opcode Fuzzy Hash: 38ffefbf3b047d8ebf2cc92eb58712d618fae80ae698d6c5fd762fb987bbcdb2
Instruction Fuzzy Hash: 0EF05972309190AFC71227789C240AD3FB5DEC625134800DFD686CF351DE944502C3E5

Function 06A7ADE9 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19b744905f059a83dd817aa32cbc13d17a1548615cbca405882ca53265b61941
Instruction ID: d7a77ce12034b60414865e285a0f615b562cbdfa7a90e10e8edcfdf61e8502ad
Opcode Fuzzy Hash: 19b744905f059a83dd817aa32cbc13d17a1548615cbca405882ca53265b61941
Instruction Fuzzy Hash: CCF0A731205212AFC3503B66A89869B7FEBEFCA714B04446DF10ED7342CE751C4987B5

Function 06A767C8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89c8e6b7abce4ca84ab8ba310034b22167a56ab4a381e5a838d9d0d8e0d1275a
Instruction ID: 073e3add9b8a02dfbe0f8641dd65140f96b9979f6dc80885a1ce6e5edd75bbc1
Opcode Fuzzy Hash: 89c8e6b7abce4ca84ab8ba310034b22167a56ab4a381e5a838d9d0d8e0d1275a
Instruction Fuzzy Hash: 46F0BE31B407019FDB209BA8AD40F947BE2AF82721F14D266E254CF5E2DBB1D8469B84

Function 06A78341 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfbc6f4c91dba57f3762786209d1431a7aa9a9d1dd497d595e4874120a024870
Instruction ID: 1c2f1766f40b222afe3bd91cb32d30b8bb91db9b2a66fad8bad87fcbea7bfbff
Opcode Fuzzy Hash: dfbc6f4c91dba57f3762786209d1431a7aa9a9d1dd497d595e4874120a024870
Instruction Fuzzy Hash: B3F0A072F051155BCF10DAACAD986FEBBAAAB845617084037EA14D3100FB34881983A0

Function 06A78FC0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c69ceef8aef2dc65bf399543cf764c80d707dd0bf2839ec94ed872ccc2bdd83
Instruction ID: 5f6439cd21db090e20af4c5f6e1f9597a45cf32a90e3515117034b3cf355b280
Opcode Fuzzy Hash: 3c69ceef8aef2dc65bf399543cf764c80d707dd0bf2839ec94ed872ccc2bdd83
Instruction Fuzzy Hash: B1F0CDB1C09149DFDB00EFA0C8191AEBFB0EF5A201F0041EAE842EB350E6394A01CB50

Function 06A7B368 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99e04d2213a77f5c0dfbf578b8b5fc8372cc740657ddde4fea4db5377925ebb0
Instruction ID: a6daebba7a3f0ea7242de93c5a707aa4cc3f722910c4c498b485798f973e1d1b
Opcode Fuzzy Hash: 99e04d2213a77f5c0dfbf578b8b5fc8372cc740657ddde4fea4db5377925ebb0
Instruction Fuzzy Hash: D5F03C74E0120AEFCB08EFB9E84465C7BB6FB85205B1045ADD509E7310DF341E44CBA5

Function 06A7C110 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 686d515d15bd4e8fcb2180a83091988f4690283c600fe610912bf5ed7febbcb2
Instruction ID: e9065399646cef5d569efb9e2ac662b5942e8cf751e033e706248f9a13b84a01
Opcode Fuzzy Hash: 686d515d15bd4e8fcb2180a83091988f4690283c600fe610912bf5ed7febbcb2
Instruction Fuzzy Hash: 33F0B4302057918FC312E729E80879F7FE7DFC1304F04056DE28687641DBE5680587A5

Function 06A7C170 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ca57e2b26e1619c3d77f30ae5dd8993870066d1cc6dca6670ecf1d283db3189
Instruction ID: de0671e9c20c033ec97c3d0ff1e253e1a7555fa4e8b5c8e979bdea950663b91e
Opcode Fuzzy Hash: 4ca57e2b26e1619c3d77f30ae5dd8993870066d1cc6dca6670ecf1d283db3189
Instruction Fuzzy Hash: C2F0AF34500B069FD725DF66E408612BBF6FF88311B108A2EE88A82A00DB70A585CF95

Function 06A7ADF8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45d2a54898eb06b0d80644085dab09b1afa89621365c2aa05f52f261a8d6d660
Instruction ID: c6921ec50bc166025c3e86309b3e3b321c73bd1ef35b117e5733cd12ed728dab
Opcode Fuzzy Hash: 45d2a54898eb06b0d80644085dab09b1afa89621365c2aa05f52f261a8d6d660
Instruction Fuzzy Hash: DAE09231200112ABC3143B9AA888A9E7ADFEBC9355B00442CE20EC3341CEB1180587B5

Function 06A7C180 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f2e251a6e19a6ba94fdeb46d018d4087f83877220fa9fe0282209df96b512fc
Instruction ID: e0b220a39c0829c8a63e7498d9421aebbebbaec4d411b8c957bb81f645bac68f
Opcode Fuzzy Hash: 6f2e251a6e19a6ba94fdeb46d018d4087f83877220fa9fe0282209df96b512fc
Instruction Fuzzy Hash: B9F09034500B059FD715DF66E408512BBF6FB88311700C62EE54A82A10DB70A549CF95

Function 06A7B500 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d754a95c78436e92eabcdc3539bc0b3bf87ebfae05c0869329de07a9a8d4827a
Instruction ID: 17bb89496630c3e1fd1e2b175f2d6920af444a0ab45952a75a76bf405e8f6285
Opcode Fuzzy Hash: d754a95c78436e92eabcdc3539bc0b3bf87ebfae05c0869329de07a9a8d4827a
Instruction Fuzzy Hash: C8F01535D0520DEFCB01DFB4E9488CDBFB9EB44200F1042A6A805E2240EA315B45CBA1

Function 06A7C120 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cef579192a3bf5d6974f0b8cced26e9e2959993cf66da9b48367b8ce5757129
Instruction ID: 43566900333bbeee9a6607dd20a6c3c34c0f80274e69150bc17e67325f30f1b8
Opcode Fuzzy Hash: 7cef579192a3bf5d6974f0b8cced26e9e2959993cf66da9b48367b8ce5757129
Instruction Fuzzy Hash: A5E030302047568FC716E729E80879E7FE6DBC5614F04052DD24A87741CBA5A80587A5

Function 06A75698 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a30bd35ec7137f061463956a1a0cc0aa8e9a0baad2abb657a16212b6885d9380
Instruction ID: 79dc8cfbf416b0792f7cd1f42ee2b41a3c66fc39e1dd2e9ec83d16bde523be94
Opcode Fuzzy Hash: a30bd35ec7137f061463956a1a0cc0aa8e9a0baad2abb657a16212b6885d9380
Instruction Fuzzy Hash: 63E048B350C3509FD705DB20FC5489A77A9DFA1310B15DC6EE4418B541EB32E851CBA5

Function 06A7E280 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd7c917112dbe54c4e6110e4dc914c8eb0cbdfa9b7be4ad88f4fac0426af163d
Instruction ID: 6de1b196352cc8f65cfdb6266c872d94f3981fa6e458e57d1173b7e27fa05507
Opcode Fuzzy Hash: dd7c917112dbe54c4e6110e4dc914c8eb0cbdfa9b7be4ad88f4fac0426af163d
Instruction Fuzzy Hash: 68E02033D012514FD745A312BD019443F62E796201F031146D80C5B6B1CB780D8BCBF2

Function 06A7E1FF Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 066582ae25d568457ad494e1b90f9355c035d4748a85e46b3213cecdba52c94b
Instruction ID: 30ae198c9b2b2f3743f8b13c65151667b8b17e7c9a2f535638ce80ced10a20ce
Opcode Fuzzy Hash: 066582ae25d568457ad494e1b90f9355c035d4748a85e46b3213cecdba52c94b
Instruction Fuzzy Hash: D7E0D872909209EFCB01DB64AC1089D7BB2DB8210072042DAD409E3290E5300F158761

Function 06A7CE88 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f600d6ffe1c1346dfe82f30930888603bf7e19bf11dd8ba8c23127d70125d0eb
Instruction ID: 1ddc25e1d03915f02e51c88d0b14397d841e1d94d005e3ba9327743ec202004a
Opcode Fuzzy Hash: f600d6ffe1c1346dfe82f30930888603bf7e19bf11dd8ba8c23127d70125d0eb
Instruction Fuzzy Hash: 3BE08675905206EFDB619724F409B997BA6EB41311F00001CED4A97B00DB745CC287A6

Function 06A7AC80 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3548fc7776166345eb8927b7f82f0212fdf5578312b20c44a1cd20439e09e1d2
Instruction ID: 0568067d645e378950d70a20ab9de55b0bf65929aac343336e3846c2cf2fcf7a
Opcode Fuzzy Hash: 3548fc7776166345eb8927b7f82f0212fdf5578312b20c44a1cd20439e09e1d2
Instruction Fuzzy Hash: A5D05B313001159786153769B4584AE7BABEBC5661305002EE70FCF340CEA51D0587D5

Function 06A7CC38 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aa93ba6abfe4e3bd840c378e95cdd63232056765abb32ce3f1a9f816ca80847
Instruction ID: 3673010c55cf55a32941356e06aace1c10593b189f266d55d419225b7da2b9eb
Opcode Fuzzy Hash: 9aa93ba6abfe4e3bd840c378e95cdd63232056765abb32ce3f1a9f816ca80847
Instruction Fuzzy Hash: A8E08C33A002128FDB51EF0AF800F8A77A1EB85662F004228D04997704CB391C87CFA1

Function 06A7B510 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38d2d4a7a9b9dd2e7cfbbcc21c16b7a857f02e186af29fe34a55a9e819cd974e
Instruction ID: e9d5f7135c5f99ab958b95696acf1ddb003c8f2ff31fdeaffdb1ccf7279b7b2f
Opcode Fuzzy Hash: 38d2d4a7a9b9dd2e7cfbbcc21c16b7a857f02e186af29fe34a55a9e819cd974e
Instruction Fuzzy Hash: E9E09275D0020DEFCB40DFE4E9448DDBBB9EB48200F1082AAD909A3200EB306B55DF91

Function 06A7E210 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac0cc12f16254e33bcf98f6547bf1fa902eee7f792e707766c6bba1b02e2d182
Instruction ID: b977ac9efc612863aaa565cc9b7dd502980d58d49daee754cabbf4d091f46fae
Opcode Fuzzy Hash: ac0cc12f16254e33bcf98f6547bf1fa902eee7f792e707766c6bba1b02e2d182
Instruction Fuzzy Hash: AED05E72E0020DFFCB40EFA8E90095DBBBAEB84204B1045ADD50DE3300EA712F049BA1

Function 06A7E8F8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25000e3d536dc692f84bb0ce1fbe7c14c5ae6dfd50f7d1b89f1e102fa45cdb49
Instruction ID: 4579d012bea10b6108768425fcf3a0b59bbc220a0fdc9a2500923b9895f5bf35
Opcode Fuzzy Hash: 25000e3d536dc692f84bb0ce1fbe7c14c5ae6dfd50f7d1b89f1e102fa45cdb49
Instruction Fuzzy Hash: 27D05239210208EFC740AF48C881B427BF8BF48B00F10808CFA804B621CB32A860EF90

Function 06A7F8EB Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a774ffdf800575b07326d51594cd4baeb7662e574f9d4ef568cc91c4364d2da
Instruction ID: b0cb1a7f43499140d2ab43c36dfc619d8baa979b849f9c1ebaee152f4f7c1543
Opcode Fuzzy Hash: 3a774ffdf800575b07326d51594cd4baeb7662e574f9d4ef568cc91c4364d2da
Instruction Fuzzy Hash: 5AC012727400200B0A89B66CB4200AD76DBA3C81A3385002FEA0ED3348CD718C868BA5

Function 06A73721 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c36b4146de38ceb4a7b1825b63b0168f0836480268a72ff2eb362ac2412fbdb4
Instruction ID: bbb1ea712d2e3fe19de860852e1894be955650bcbdb8e01e504f0e26592f67ce
Opcode Fuzzy Hash: c36b4146de38ceb4a7b1825b63b0168f0836480268a72ff2eb362ac2412fbdb4
Instruction Fuzzy Hash: F7C09B9650F3C15FD30617601C118F729765FE764031F82D355A3D7B93DD14052482F6

Function 06A7DFD1 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d8ec5a98d17b66ab8f4203e6fc4261ffa61f9d147be3e2d75413c28fd88713d
Instruction ID: 85f67cc4631b51dd7e0cdcde6aa6ec4955c7c7d84e5316fa5e36707ec932f92f
Opcode Fuzzy Hash: 1d8ec5a98d17b66ab8f4203e6fc4261ffa61f9d147be3e2d75413c28fd88713d
Instruction Fuzzy Hash: E7C09B3658F7D45FDF0217309C0D4857E56AF9271071500C6A3418E463E7620005CBA1

Non-executed Functions

Function 06A76FE8 Relevance: .8, Instructions: 787COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91b1d67b3dddb282fd89078d69e0e9d8fc4a3f6c89f712ed4c22cdc1119bd1f7
Instruction ID: 1347b1525da7c6ccb20629d120b093d5a8fa5ba817ab8793539d378d622c1332
Opcode Fuzzy Hash: 91b1d67b3dddb282fd89078d69e0e9d8fc4a3f6c89f712ed4c22cdc1119bd1f7
Instruction Fuzzy Hash: 5D62FCB06002019FE788DF69D85875A7AD6EF84308F64C55CC10E9F392DFBAD90B8B95

Function 06A76FF8 Relevance: .8, Instructions: 780COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2324496108.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a70000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79054e0d4e65f435236e31298ca9c4d86e7d11e932f3e01de7e19dbe514cde09
Instruction ID: 59e1211bd61aba2e03fde06483afd989e3fbb2626bf61030d59be67233fff798
Opcode Fuzzy Hash: 79054e0d4e65f435236e31298ca9c4d86e7d11e932f3e01de7e19dbe514cde09
Instruction Fuzzy Hash: 07620CB06002019FE788DF69D85875A7AD6EF84308F64C55CC10E9F392DFBAD90B8B95

Function 017DDC74 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2320063609.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17d0000_kYpONUhAR5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba16c5e87df82d0a11ec00da1144476aa3c6c89b53a5c67e6c1abb4af4b4281
Instruction ID: 86bad7f9d0ab523b8350de7abe1933aa5a145c52083b294fc11db1853dd8890e
Opcode Fuzzy Hash: 9ba16c5e87df82d0a11ec00da1144476aa3c6c89b53a5c67e6c1abb4af4b4281
Instruction Fuzzy Hash: 38A15032E0021A8FCF15DFB9C8445DEFBB2FF84300B15456AE906AB265DB71E956CB90

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report kYpONUhAR5.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Desktop\Google Chrome.lnk

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\kYpONUhAR5.exe.log

C:\Users\user\AppData\Local\Temp\Tmp382E.tmp

C:\Users\user\AppData\Local\Temp\Tmp383F.tmp

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Windows Analysis Report
kYpONUhAR5.exe

Function 017DD0A8 Relevance: 6.1, APIs: 4, Instructions: 131
threadCOMMON

Function 017DD0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 017DAE30 Relevance: 1.7, APIs: 1, Instructions: 194
COMMON

Function 017D4248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 017D5935 Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Function 06A759C8 Relevance: 1.6, Strings: 1, Instructions: 318
COMMON

Function 017DD300 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 017DD2F9 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 017DB020 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 06A61BA0 Relevance: 1.5, Instructions: 1454
COMMON

Function 06A600D8 Relevance: .7, Instructions: 676
COMMON

Function 06A63838 Relevance: .6, Instructions: 634
COMMON

Function 06A60D80 Relevance: .6, Instructions: 618
COMMON

Function 06A748A8 Relevance: .5, Instructions: 504
COMMON