Edit tour

Windows Analysis Report
NI0Y4iB1ON.exe

Overview

General Information

Sample name:	NI0Y4iB1ON.exe renamed because original name is a hash value
Original sample name:	375e9acde29beee941aa2706285f34b1.exe
Analysis ID:	1465053
MD5:	375e9acde29beee941aa2706285f34b1
SHA1:	e4beb794991712982a6ef02fb41b59b7eb82b202
SHA256:	b2a4a9e9cd0fbce0d8bb0e6d7bd34aacca346ad20e0835064366a557bba2e20b
Tags:	exeRedLineStealer
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (creates a PE file in dynamic memory)

Found malware configuration

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected RedLine Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops large PE files

Injects a PE file into a foreign processes

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Internet Provider seen in connection with other malware

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

NI0Y4iB1ON.exe (PID: 6600 cmdline: "C:\Users\user\Desktop\NI0Y4iB1ON.exe" MD5: 375E9ACDE29BEEE941AA2706285F34B1)

csc.exe (PID: 1196 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": "5.161.190.139:8732", "Authorization Header": "249e1ece2f90b39d9c5563282076f21f"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1900270000.000000000075B000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1900709118.0000000005152000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.2156084327.0000000005202000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: NI0Y4iB1ON.exe PID: 6600	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: csc.exe PID: 1196	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: csc.exe PID: 1196	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.NI0Y4iB1ON.exe.75ba92.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.NI0Y4iB1ON.exe.75ba92.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2.2.csc.exe.5200000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.NI0Y4iB1ON.exe.5150000.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.NI0Y4iB1ON.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\Documents\OTOTOTOT\TITUIFO.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\NI0Y4iB1ON.exe, ProcessId: 6600, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kooo

Snort Signatures

ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.4 - Destination IP: 5.161.190.139

Timestamp:	07/01/24-08:47:32.504841
SID:	2046045
Source Port:	49737
Destination Port:	8732
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) - Source IP: 5.161.190.139 - Destination IP: 192.168.2.4

Timestamp:	07/01/24-08:47:39.139186
SID:	2046056
Source Port:	8732
Destination Port:	49737
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.161.190.139

Timestamp:	07/01/24-08:47:46.398128
SID:	2043231
Source Port:	49737
Destination Port:	8732
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 5.161.190.139 - Destination IP: 192.168.2.4

Timestamp:	07/01/24-08:47:32.607724
SID:	2043234
Source Port:	8732
Destination Port:	49737
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: NI0Y4iB1ON.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\Documents\OTOTOTOT\TITUIFO.exe

Avira: detection malicious, Label: TR/Dropper.Gen2

Found malware configuration

Source: 0.2.NI0Y4iB1ON.exe.400000.0.unpack

Malware Configuration Extractor: RedLine {"C2 url": "5.161.190.139:8732", "Authorization Header": "249e1ece2f90b39d9c5563282076f21f"}

Multi AV Scanner detection for submitted file

Source: NI0Y4iB1ON.exe	ReversingLabs: Detection: 39%
Source: NI0Y4iB1ON.exe	Virustotal: Detection: 47%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\NI0Y4iB1ON.exe

Unpacked PE file: 0.2.NI0Y4iB1ON.exe.5150000.2.unpack

Source: NI0Y4iB1ON.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: NI0Y4iB1ON.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:

Binary string: C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb source: NI0Y4iB1ON.exe, TITUIFO.exe.0.dr

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) 192.168.2.4:49737 -> 5.161.190.139:8732
Source: Traffic	Snort IDS: 2043231 ET TROJAN Redline Stealer TCP CnC Activity 192.168.2.4:49737 -> 5.161.190.139:8732
Source: Traffic	Snort IDS: 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response 5.161.190.139:8732 -> 192.168.2.4:49737
Source: Traffic	Snort IDS: 2046056 ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) 5.161.190.139:8732 -> 192.168.2.4:49737

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 5.161.190.139:8732

Source: global traffic

TCP traffic: 192.168.2.4:49737 -> 5.161.190.139:8732

Source: Joe Sandbox View

ASN Name: HETZNER-ASDE HETZNER-ASDE

Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139
Source: unknown	TCP traffic detected without corresponding DNS query: 5.161.190.139

Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: csc.exe, 00000002.00000002.2161332834.00000000075A7000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: csc.exe, 00000002.00000003.2131906888.000000000842A000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008608000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.00000000083EF000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2131906888.0000000008381000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008361000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008624000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2125394511.0000000008559000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2131906888.000000000839D000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008597000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.000000000857D000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008461000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2125394511.0000000008575000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2131906888.000000000840E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.00000000084EE000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.000000000850A000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.00000000083D4000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.000000000847D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: NI0Y4iB1ON.exe, NI0Y4iB1ON.exe, 00000000.00000002.1900270000.000000000075B000.00000040.00000001.01000000.00000003.sdmp, NI0Y4iB1ON.exe, 00000000.00000002.1900709118.0000000005152000.00000040.00001000.00020000.00000000.sdmp, csc.exe, 00000002.00000002.2156084327.0000000005202000.00000040.00000400.00020000.00000000.sdmp, csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: csc.exe, 00000002.00000003.2131906888.000000000842A000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008608000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.00000000083EF000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2131906888.0000000008381000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008361000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008624000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2125394511.0000000008559000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2131906888.000000000839D000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008597000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.000000000857D000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008461000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2125394511.0000000008575000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2131906888.000000000840E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.00000000084EE000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.000000000850A000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.00000000083D4000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.000000000847D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: csc.exe, 00000002.00000003.2131906888.000000000842A000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008608000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.00000000083EF000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2131906888.0000000008381000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008361000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008624000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2125394511.0000000008559000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2131906888.000000000839D000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008597000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.000000000857D000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008461000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2125394511.0000000008575000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2131906888.000000000840E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.00000000084EE000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.000000000850A000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.00000000083D4000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.000000000847D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: csc.exe, 00000002.00000003.2131906888.000000000842A000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008608000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.00000000083EF000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2131906888.0000000008381000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008361000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008624000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2125394511.0000000008559000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2131906888.000000000839D000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008597000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.000000000857D000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008461000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2125394511.0000000008575000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2131906888.000000000840E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.00000000084EE000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.000000000850A000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.00000000083D4000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.000000000847D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: csc.exe, 00000002.00000003.2131906888.000000000842A000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008608000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.00000000083EF000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2131906888.0000000008381000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008361000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008624000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2125394511.0000000008559000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2131906888.000000000839D000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008597000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.000000000857D000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008461000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2125394511.0000000008575000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2131906888.000000000840E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.00000000084EE000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.000000000850A000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.00000000083D4000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.000000000847D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: csc.exe, 00000002.00000003.2131906888.000000000842A000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.00000000083EF000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008624000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2131906888.000000000839D000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008597000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2125394511.0000000008575000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.000000000850A000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.000000000847D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: csc.exe, 00000002.00000003.2127187764.0000000008608000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2131906888.0000000008381000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008361000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2125394511.0000000008559000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.000000000857D000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008461000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2131906888.000000000840E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.00000000084EE000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.00000000083D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabS
Source: csc.exe, 00000002.00000003.2131906888.000000000842A000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008608000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.00000000083EF000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2131906888.0000000008381000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008361000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008624000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2125394511.0000000008559000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2131906888.000000000839D000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008597000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.000000000857D000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008461000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2125394511.0000000008575000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2131906888.000000000840E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.00000000084EE000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.000000000850A000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.00000000083D4000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.000000000847D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: csc.exe, 00000002.00000003.2131906888.000000000842A000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008608000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.00000000083EF000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2131906888.0000000008381000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008361000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008624000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2125394511.0000000008559000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2131906888.000000000839D000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008597000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.000000000857D000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008461000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2125394511.0000000008575000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2131906888.000000000840E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.00000000084EE000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.000000000850A000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.00000000083D4000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.000000000847D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: csc.exe, 00000002.00000003.2131906888.000000000842A000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008608000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.00000000083EF000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2131906888.0000000008381000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008361000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008624000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2125394511.0000000008559000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2131906888.000000000839D000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008597000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.000000000857D000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008461000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2125394511.0000000008575000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2131906888.000000000840E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.00000000084EE000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.000000000850A000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.00000000083D4000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.000000000847D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

System Summary

Drops large PE files

Source: C:\Users\user\Desktop\NI0Y4iB1ON.exe

File dump: TITUIFO.exe.0.dr 953255531

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 2_2_057ADC74	2_2_057ADC74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 2_2_098F6948	2_2_098F6948
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 2_2_098F8D28	2_2_098F8D28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 2_2_098F8D18	2_2_098F8D18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 2_2_098F001B	2_2_098F001B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 2_2_098F0040	2_2_098F0040

Source: NI0Y4iB1ON.exe	Binary or memory string: OriginalFilename vs NI0Y4iB1ON.exe
Source: NI0Y4iB1ON.exe, 00000000.00000002.1900709118.0000000005194000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameThalian.exe8 vs NI0Y4iB1ON.exe
Source: NI0Y4iB1ON.exe, 00000000.00000002.1900270000.000000000078E000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameThalian.exe8 vs NI0Y4iB1ON.exe

Source: NI0Y4iB1ON.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/2@0/1

Source: C:\Users\user\Desktop\NI0Y4iB1ON.exe

File created: C:\Users\user\Documents\OTOTOTOT

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Mutant created: NULL

Source: NI0Y4iB1ON.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: C:\Users\user\Desktop\NI0Y4iB1ON.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: csc.exe, 00000002.00000002.2161332834.000000000786C000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000002.2161332834.000000000787A000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: NI0Y4iB1ON.exe	ReversingLabs: Detection: 39%
Source: NI0Y4iB1ON.exe	Virustotal: Detection: 47%

Source: C:\Users\user\Desktop\NI0Y4iB1ON.exe

File read: C:\Users\user\Desktop\NI0Y4iB1ON.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\NI0Y4iB1ON.exe "C:\Users\user\Desktop\NI0Y4iB1ON.exe"
Source: C:\Users\user\Desktop\NI0Y4iB1ON.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Source: C:\Users\user\Desktop\NI0Y4iB1ON.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"	Jump to behavior

Source: C:\Users\user\Desktop\NI0Y4iB1ON.exe	Section loaded: k7rn7l32.dll	Jump to behavior
Source: C:\Users\user\Desktop\NI0Y4iB1ON.exe	Section loaded: ntd3ll.dll	Jump to behavior
Source: C:\Users\user\Desktop\NI0Y4iB1ON.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\NI0Y4iB1ON.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32

Jump to behavior

Source: NI0Y4iB1ON.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: NI0Y4iB1ON.exe

Static file information: File size 4686848 > 1048576

Source: NI0Y4iB1ON.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x297400
Source: NI0Y4iB1ON.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x129800

Source: NI0Y4iB1ON.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: NI0Y4iB1ON.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: NI0Y4iB1ON.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: NI0Y4iB1ON.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: NI0Y4iB1ON.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: NI0Y4iB1ON.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: NI0Y4iB1ON.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: NI0Y4iB1ON.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb source: NI0Y4iB1ON.exe, TITUIFO.exe.0.dr

Data Obfuscation

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\NI0Y4iB1ON.exe

Unpacked PE file: 0.2.NI0Y4iB1ON.exe.5150000.2.unpack

Source: C:\Users\user\Desktop\NI0Y4iB1ON.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Source: C:\Users\user\Desktop\NI0Y4iB1ON.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"			Jump to behavior

Source: NI0Y4iB1ON.exe	Static PE information: section name: .didat
Source: TITUIFO.exe.0.dr	Static PE information: section name: .didat

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Code function: 2_2_098FD912 push eax; ret

2_2_098FD921

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\NI0Y4iB1ON.exe

File created: C:\Users\user\Documents\OTOTOTOT\TITUIFO.exe

Jump to dropped file

Source: C:\Users\user\Desktop\NI0Y4iB1ON.exe

File created: C:\Users\user\Documents\OTOTOTOT\TITUIFO.exe

Jump to dropped file

Source: C:\Users\user\Desktop\NI0Y4iB1ON.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run kooo			Jump to behavior
Source: C:\Users\user\Desktop\NI0Y4iB1ON.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run kooo			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: 57A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: 72B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: 5860000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Window / User API: threadDelayed 1058			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Window / User API: threadDelayed 2500			Jump to behavior

Source: C:\Users\user\Desktop\NI0Y4iB1ON.exe

Dropped PE file which has not been started: C:\Users\user\Documents\OTOTOTOT\TITUIFO.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2032	Thread sleep time: -11990383647911201s >= -30000s			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 6724	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: csc.exe, 00000002.00000002.2159730888.0000000005492000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2153885572.0000000005492000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\NI0Y4iB1ON.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\NI0Y4iB1ON.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 5200000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\NI0Y4iB1ON.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 5200000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\NI0Y4iB1ON.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 5200000			Jump to behavior
Source: C:\Users\user\Desktop\NI0Y4iB1ON.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 4F0E008			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: csc.exe, 00000002.00000003.2129924299.000000000B858000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.NI0Y4iB1ON.exe.75ba92.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NI0Y4iB1ON.exe.75ba92.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.csc.exe.5200000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NI0Y4iB1ON.exe.5150000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NI0Y4iB1ON.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1900270000.000000000075B000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1900709118.0000000005152000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2156084327.0000000005202000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NI0Y4iB1ON.exe PID: 6600, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: csc.exe PID: 1196, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: csc.exe PID: 1196, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.NI0Y4iB1ON.exe.75ba92.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NI0Y4iB1ON.exe.75ba92.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.csc.exe.5200000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NI0Y4iB1ON.exe.5150000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NI0Y4iB1ON.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1900270000.000000000075B000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1900709118.0000000005152000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2156084327.0000000005202000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NI0Y4iB1ON.exe PID: 6600, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: csc.exe PID: 1196, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	31 Process Injection	1 Masquerading	1 OS Credential Dumping	231 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	11 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	31 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	113 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
NI0Y4iB1ON.exe	39%	ReversingLabs	Win32.Spyware.RedLine
NI0Y4iB1ON.exe	47%	Virustotal		Browse
NI0Y4iB1ON.exe	100%	Avira	TR/Dropper.Gen2

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\Documents\OTOTOTOT\TITUIFO.exe	100%	Avira	TR/Dropper.Gen2

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://tempuri.org/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23ResponseD	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	0%	Virustotal		Browse
http://tempuri.org/Entity/Id14ResponseD	2%	Virustotal		Browse
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	0%	Virustotal		Browse
http://tempuri.org/Entity/Id23ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id2Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	0%	Virustotal		Browse
http://tempuri.org/Entity/Id12Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Virustotal		Browse
http://tempuri.org/Entity/Id12Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id2Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id9	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	0%	Virustotal		Browse
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21Response	4%	Virustotal		Browse
http://tempuri.org/Entity/Id8	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	0%	Virustotal		Browse
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	0%	Virustotal		Browse
http://tempuri.org/Entity/Id5	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9	3%	Virustotal		Browse
http://tempuri.org/Entity/Id8	1%	Virustotal		Browse
http://tempuri.org/Entity/Id6ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id4	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id7	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	0%	Virustotal		Browse
http://tempuri.org/Entity/Id19Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5	1%	Virustotal		Browse
http://tempuri.org/Entity/Id4	1%	Virustotal		Browse
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6	1%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id7	1%	Virustotal		Browse
http://tempuri.org/Entity/Id13ResponseD	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	0%	Virustotal		Browse
http://tempuri.org/Entity/Id19Response	2%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/10/wsat	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	0%	Virustotal		Browse
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id15Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6Response	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15Response	2%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/04/sc	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id9Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1ResponseD	1%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/04/sc	0%	Virustotal		Browse
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	0%	Virustotal		Browse
http://tempuri.org/Entity/Id20	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	0%	Virustotal		Browse
http://tempuri.org/Entity/Id23	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	csc.exe, 00000002.00000003.2131906888.000000000842A000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.00000000083EF000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008624000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2131906888.000000000839D000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008597000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2125394511.0000000008575000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.000000000850A000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.000000000847D000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	csc.exe, 00000002.00000003.2131906888.000000000842A000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008608000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.00000000083EF000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2131906888.0000000008381000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008361000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008624000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2125394511.0000000008559000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2131906888.000000000839D000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008597000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.000000000857D000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008461000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2125394511.0000000008575000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2131906888.000000000840E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.00000000084EE000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.000000000850A000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.00000000083D4000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.000000000847D000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14ResponseD	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12Response	csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/	csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21Response	csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id9	csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8	csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6ResponseD	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5	csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id4	csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id7	csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6	csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19Response	csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id13ResponseD	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15Response	csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5ResponseD	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6Response	csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.ip.sb/ip	NI0Y4iB1ON.exe, NI0Y4iB1ON.exe, 00000000.00000002.1900270000.000000000075B000.00000040.00000001.01000000.00000003.sdmp, NI0Y4iB1ON.exe, 00000000.00000002.1900709118.0000000005152000.00000040.00001000.00020000.00000000.sdmp, csc.exe, 00000002.00000002.2156084327.0000000005202000.00000040.00000400.00020000.00000000.sdmp, csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id1ResponseD	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id9Response	csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	csc.exe, 00000002.00000003.2131906888.000000000842A000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008608000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.00000000083EF000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2131906888.0000000008381000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008361000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008624000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2125394511.0000000008559000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2131906888.000000000839D000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008597000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.000000000857D000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008461000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2125394511.0000000008575000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2131906888.000000000840E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.00000000084EE000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.000000000850A000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.00000000083D4000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.000000000847D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id20	csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21	csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id22	csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23	csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id24	csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id24Response	csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	csc.exe, 00000002.00000003.2131906888.000000000842A000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008608000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.00000000083EF000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2131906888.0000000008381000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008361000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008624000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2125394511.0000000008559000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2131906888.000000000839D000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008597000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.000000000857D000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.0000000008461000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2125394511.0000000008575000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2131906888.000000000840E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.00000000084EE000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.000000000850A000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.00000000083D4000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.2127187764.000000000847D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1Response	csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21ResponseD	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10	csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id11	csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10ResponseD	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12	csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16Response	csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id13	csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14	csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15	csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16	csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id17	csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id18	csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5Response	csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19	csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15ResponseD	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10Response	csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id11ResponseD	csc.exe, 00000002.00000002.2161332834.00000000075A7000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8Response	csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id17ResponseD	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	csc.exe, 00000002.00000002.2161332834.00000000072B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8ResponseD	csc.exe, 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
5.161.190.139	unknown	Germany		24940	HETZNER-ASDE	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1465053
Start date and time:	2024-07-01 08:46:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	NI0Y4iB1ON.exe renamed because original name is a hash value
Original Sample Name:	375e9acde29beee941aa2706285f34b1.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/2@0/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 74% Number of executed functions: 18 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target NI0Y4iB1ON.exe, PID 6600 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:47:43	API Interceptor	19x Sleep call for process: csc.exe modified
07:47:22	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run kooo C:\Users\user\Documents\OTOTOTOT\TITUIFO.exe
07:47:30	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run kooo C:\Users\user\Documents\OTOTOTOT\TITUIFO.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
5.161.190.139	9E56BC168EFC43001C19A1720891C88FA4CEFB2057B0B.exe	Get hash	malicious	RedLine	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	https://www.teamviewer.com/en-in/download/windows/	Get hash	malicious	Unknown	Browse	144.76.236.241
	https://he110ca11he1lpn0wwb112.pages.dev/	Get hash	malicious	TechSupportScam	Browse	195.201.57.90
	https://serviceca11he1pn0waa12.pages.dev/	Get hash	malicious	TechSupportScam	Browse	195.201.57.90
	https://u.to/NuS5IA	Get hash	malicious	Unknown	Browse	94.130.141.49
	botx.x86.elf	Get hash	malicious	Mirai	Browse	135.181.82.247
	vjYcExA6ou.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	195.201.251.214
	_$phantom-SCV.cmd	Get hash	malicious	Unknown	Browse	144.76.71.93
	Evo Resou_nls..scr.exe	Get hash	malicious	AsyncRAT	Browse	49.12.202.237
	https://he110ca11he1lpn0wwb112.pages.dev/	Get hash	malicious	TechSupportScam	Browse	195.201.57.90
	https://serviceca11he1pn0waa12.pages.dev/	Get hash	malicious	TechSupportScam	Browse	195.201.57.90

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\csc.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3094
Entropy (8bit):	5.33145931749415
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0atTqdqlq7qV
MD5:	3FD5C0634443FB2EF2796B9636159CB6
SHA1:	366DDE94AEFCFFFAB8E03AD8B448E05D7489EB48
SHA-256:	58307E94C67E2348F5A838DE4FF668983B38B7E9A3B1D61535D3A392814A57D6
SHA-512:	8535E7C0777C6B0876936D84BDE2BDC59963CF0954D4E50D65808E6E806E8B131DF5DB8FA0E030FAE2702143A7C3A70698A2B9A80519C9E2FFC286A71F0B797C
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\Documents\OTOTOTOT\TITUIFO.exe

Download File

Process:	C:\Users\user\Desktop\NI0Y4iB1ON.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	953255531
Entropy (8bit):	0.06579742896447444
Encrypted:	false
SSDEEP:
MD5:	44B7D1F5510DBF3BEB498D5A75392E83
SHA1:	3D703E1225B0374094D9FCE60EEA6F62BE17EB91
SHA-256:	AB899360300CB48AC4FEB96681F411A685823E1B632D265ECAF651789150A43E
SHA-512:	465E1EAF9CF692248CBFC5483B9153C668DE5DBD6000238EABC483C0874A20A33ADF8D8EE204D0E25861654130246A760483255A0B6BA29FD67242F585E089EB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y............~j......~j........................~j.....~j.....~j.....~j........O......).... .....H..........Rich....................PE..L.....e.........."....&.t)........... .......)...@..........................PH.......G...@...... ............................4.<.....5.[............i...)....=.$.......p...................@.........+.@.............). .....4.@....................text.....)......t)................. ..`.rdata...@....)..8...x).............@..@.data.........4..4....4.............@....didat........5.......4.............@....rsrc...[.....5.......4.............@..@................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.476570625780272
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	NI0Y4iB1ON.exe
File size:	4'686'848 bytes
MD5:	375e9acde29beee941aa2706285f34b1
SHA1:	e4beb794991712982a6ef02fb41b59b7eb82b202
SHA256:	b2a4a9e9cd0fbce0d8bb0e6d7bd34aacca346ad20e0835064366a557bba2e20b
SHA512:	4d376813cb1ede9ad20cac49a8ad8bc83dfaefd13e1326f7710fa357e9c636446c19684641ecf16eaf0e73283895a3fe7fd29fdb12c1f60065d7c9810d256597
SSDEEP:	98304:ZWFsTuRN2zazBLlLvOc1Pgd1Ea0fzsFvOFLyf:ZWFsTuRN2zahf1Y7Efy
TLSH:	45262820325E8D2FD59128F1962897B7911CAD2B0B61A0D7B68C7E5F27710C70BF7E1A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y..............~j......~j..............................~j......~j......~j......~j..........O.......)..... .......H............

File Icon


Icon Hash:	c338dad2da985006

Static PE Info

General

Entrypoint:	0x60c1a0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x65AFEAC5 [Tue Jan 23 16:35:17 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	36aca8edddb161c588fcf5afdc1ad9fa

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
call 00007F65647D8A2Bh
jmp 00007F65647D826Dh
push ebp
mov ebp, esp
and dword ptr [00750BACh], 00000000h
sub esp, 24h
or dword ptr [0074D020h], 01h
push 0000000Ah
call dword ptr [00699268h]
test eax, eax
je 00007F65647D85A2h
and dword ptr [ebp-10h], 00000000h
xor eax, eax
push ebx
push esi
push edi
xor ecx, ecx
lea edi, dword ptr [ebp-24h]
push ebx
cpuid
mov esi, ebx
pop ebx
nop
mov dword ptr [edi], eax
mov dword ptr [edi+04h], esi
mov dword ptr [edi+08h], ecx
xor ecx, ecx
mov dword ptr [edi+0Ch], edx
mov eax, dword ptr [ebp-24h]
mov edi, dword ptr [ebp-20h]
mov dword ptr [ebp-0Ch], eax
xor edi, 756E6547h
mov eax, dword ptr [ebp-18h]
xor eax, 49656E69h
mov dword ptr [ebp-04h], eax
mov eax, dword ptr [ebp-1Ch]
xor eax, 6C65746Eh
mov dword ptr [ebp-08h], eax
xor eax, eax
inc eax
push ebx
cpuid
mov esi, ebx
pop ebx
nop
lea ebx, dword ptr [ebp-24h]
mov dword ptr [ebx], eax
mov eax, dword ptr [ebp-04h]
or eax, dword ptr [ebp-08h]
or eax, edi
mov dword ptr [ebx+04h], esi
mov dword ptr [ebx+08h], ecx
mov dword ptr [ebx+0Ch], edx
jne 00007F65647D8435h
mov eax, dword ptr [ebp-24h]
and eax, 0FFF3FF0h
cmp eax, 000106C0h
je 00007F65647D8415h
cmp eax, 00020660h
je 00007F65647D840Eh
cmp eax, 00020670h
je 00007F65647D8407h
cmp eax, 00030650h
je 00007F65647D8400h
cmp eax, 00030660h
je 00007F65647D83F9h
cmp eax, 00030670h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x34b518	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x35b000	0x12965b	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x806908	0x29b8
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3de000	0x2d824	.rsrc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2ed3b0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2ed440	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2beb00	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x299000	0x320	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x348804	0x240	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x298000	0x297400	57da8830c31be32bc33e4e134aa599fa	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x299000	0xb4000	0xb3800	4f9d26185e37b65035edbc1141b2007e	False	0.32706411037604455	data	5.068944901847019	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x34d000	0xd000	0x3400	e98ea88d23706ee22313e0c4a05673ed	False	0.2342247596153846	data	4.472160620433143	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didat	0x35a000	0x1000	0x800	024099aaf5ddf68616b817cf9ff2cd48	False	0.4072265625	data	4.513561592019692	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x35b000	0x12965b	0x129800	7cf64a4b1d83d73c8b57c1f9cea01194	False	0.30150341386554624	data	6.117507832819866	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x35ba5c	0x4a436	PC bitmap, Windows 3.x format, 38982 x 2 x 52, image size 304445, cbSize 304182, bits offset 54			0.49700179497800656
RT_BITMAP	0x3a5e94	0x13e	Device independent bitmap graphic, 32 x 16 x 4, image size 258, resolution 2834 x 2834 px/m, 5 important colors	English	United States	0.25471698113207547
RT_BITMAP	0x3a5fd4	0x828	Device independent bitmap graphic, 32 x 16 x 32, image size 0	English	United States	0.03017241379310345
RT_BITMAP	0x3a67fc	0x48a8	Device independent bitmap graphic, 290 x 16 x 32, image size 0	English	United States	0.11881720430107527
RT_BITMAP	0x3ab0a4	0xa6a	Device independent bitmap graphic, 320 x 16 x 4, image size 2562, resolution 2834 x 2834 px/m	English	United States	0.21680420105026257
RT_BITMAP	0x3abb10	0x152	Device independent bitmap graphic, 32 x 16 x 4, image size 258, resolution 2834 x 2834 px/m, 10 important colors	English	United States	0.5295857988165681
RT_BITMAP	0x3abc64	0x828	Device independent bitmap graphic, 32 x 16 x 32, image size 0	English	United States	0.4875478927203065
RT_ICON	0x3ac48c	0xb4bd	PC bitmap, Windows 3.x format, 6396 x 2 x 51, image size 47160, cbSize 46269, bits offset 54			0.48287190127299057
RT_ICON	0x3b794c	0x6c3d	PC bitmap, Windows 3.x format, 4011 x 2 x 52, image size 28203, cbSize 27709, bits offset 54			0.5219242845284926
RT_ICON	0x3be58c	0x99c9	PC bitmap, Windows 3.x format, 5428 x 2 x 46, image size 39539, cbSize 39369, bits offset 54			0.4305417968452336
RT_ICON	0x3c7f58	0x41b89	PC bitmap, Windows 3.x format, 34018 x 2 x 35, image size 269636, cbSize 269193, bits offset 54			0.49671053853554886
RT_ICON	0x409ae4	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 262144, resolution 2835 x 2835 px/m	English	United States	0.016724857235849336
RT_ICON	0x44bb0c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2835 x 2835 px/m	English	United States	0.2624113475177305
RT_ICON	0x44bf74	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2835 x 2835 px/m	English	United States	0.08153526970954357
RT_ICON	0x44e51c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2835 x 2835 px/m	English	United States	0.12312382739212008
RT_ICON	0x44f5c4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.3262411347517731
RT_ICON	0x44fa2c	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2835 x 2835 px/m	English	United States	0.030078078788595766
RT_ICON	0x460254	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2835 x 2835 px/m	English	United States	0.05922295701464336
RT_DIALOG	0x46447c	0xac	data	English	United States	0.7151162790697675
RT_DIALOG	0x464528	0xcc	data	English	United States	0.6911764705882353
RT_DIALOG	0x4645f4	0x1b4	data	English	United States	0.5458715596330275
RT_DIALOG	0x4647a8	0x136	data	English	United States	0.6064516129032258
RT_DIALOG	0x4648e0	0x4c	data	English	United States	0.8289473684210527
RT_STRING	0x46492c	0x234	data	English	United States	0.4645390070921986
RT_STRING	0x464b60	0x182	data	English	United States	0.5103626943005182
RT_STRING	0x464ce4	0x50	data	English	United States	0.7375
RT_STRING	0x464d34	0x9a	data	English	United States	0.37662337662337664
RT_STRING	0x464dd0	0x2f6	data	English	United States	0.449868073878628
RT_STRING	0x4650c8	0x5c0	data	English	United States	0.3498641304347826
RT_STRING	0x465688	0x434	data	English	United States	0.32899628252788105
RT_STRING	0x465abc	0x100	data	English	United States	0.5703125
RT_STRING	0x465bbc	0x484	data	English	United States	0.39186851211072665
RT_STRING	0x466040	0x1ea	data	English	United States	0.44081632653061226
RT_STRING	0x46622c	0x18a	data	English	United States	0.5228426395939086
RT_STRING	0x4663b8	0x216	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	United States	0.46254681647940077
RT_STRING	0x4665d0	0x624	data	English	United States	0.3575063613231552
RT_STRING	0x466bf4	0x660	data	English	United States	0.3474264705882353
RT_STRING	0x467254	0x396	data	English	United States	0.3867102396514161
RT_GROUP_ICON	0x4675ec	0x5a	data	English	United States	0.7444444444444445
RT_HTML	0x467648	0x3835	ASCII text, with very long lines (443), with CRLF line terminators	English	United States	0.08298005420807561
RT_HTML	0x46ae80	0x1316	ASCII text, with CRLF line terminators	English	United States	0.18399508800654932
RT_HTML	0x46c198	0x8c77	HTML document, ASCII text, with CRLF line terminators	English	United States	0.08081426068578103
RT_HTML	0x474e10	0x6acd	HTML document, ASCII text, with CRLF line terminators	English	United States	0.10679931238798873
RT_HTML	0x47b8e0	0x6a2	HTML document, ASCII text, with CRLF line terminators	English	United States	0.3486454652532391
RT_HTML	0x47bf84	0x104a	HTML document, ASCII text, with CRLF line terminators	English	United States	0.2170263788968825
RT_HTML	0x47cfd0	0x15b1	HTML document, ASCII text, with CRLF line terminators	English	United States	0.17612101566720692
RT_HTML	0x47e584	0x205c	exported SGML document, ASCII text, with very long lines (659), with CRLF line terminators	English	United States	0.13604538870111058
RT_HTML	0x4805e0	0x368d	HTML document, ASCII text, with CRLF line terminators	English	United States	0.10834228428213391
RT_HTML	0x483c70	0x1d7	ASCII text, with CRLF line terminators	English	United States	0.6008492569002123
RT_MANIFEST	0x483e48	0x813	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.41025641025641024

Imports

DLL

Import

KERNEL32.dll

WriteFile, DeleteFileW, HeapDestroy, HeapSize, HeapReAlloc, HeapFree, HeapAlloc, GetProcessHeap, SizeofResource, LockResource, LoadResource, FindResourceW, FindResourceExW, CreateEventExW, WaitForSingleObject, CreateProcessW, GetLastError, GetExitCodeProcess, SetEvent, RemoveDirectoryW, GetProcAddress, GetModuleHandleW, GetWindowsDirectoryW, CreateDirectoryW, GetTempPathW, GetTempFileNameW, MoveFileW, EnterCriticalSection, LeaveCriticalSection, GetModuleFileNameW, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, GetCurrentThreadId, RaiseException, SetLastError, GlobalUnlock, GlobalLock, GlobalAlloc, MulDiv, lstrcmpW, CreateEventW, FindClose, FindFirstFileW, GetFullPathNameW, InitializeCriticalSection, lstrcpynW, CreateThread, LoadLibraryExW, GetCurrentProcess, Sleep, WideCharToMultiByte, GetDiskFreeSpaceExW, DecodePointer, GetExitCodeThread, GetCurrentProcessId, FreeLibrary, GetSystemDirectoryW, lstrlenW, VerifyVersionInfoW, VerSetConditionMask, lstrcmpiW, LoadLibraryW, GetDriveTypeW, CompareStringW, FindNextFileW, GetLogicalDriveStringsW, GetFileSize, GetFileAttributesW, GetShortPathNameW, GetFinalPathNameByHandleW, SetFileAttributesW, GetFileTime, CopyFileW, ReadFile, SetFilePointer, SetFileTime, SystemTimeToFileTime, MultiByteToWideChar, GetSystemInfo, WaitForMultipleObjects, GetVersionExW, CreateSemaphoreW, ReleaseSemaphore, GlobalMemoryStatus, GetModuleHandleA, GetProcessAffinityMask, VirtualProtect, VirtualQuery, LoadLibraryExA, GetStringTypeW, LocalFree, LocalAlloc, SetUnhandledExceptionFilter, FileTimeToSystemTime, GetEnvironmentVariableW, GetSystemTime, GetDateFormatW, GetTimeFormatW, GetLocaleInfoW, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, FormatMessageW, GetEnvironmentStringsW, InitializeCriticalSectionEx, CloseHandle, GetModuleFileNameA, GetCurrentThread, GetConsoleOutputCP, FlushFileBuffers, Wow64DisableWow64FsRedirection, Wow64RevertWow64FsRedirection, IsWow64Process, SetConsoleTextAttribute, GetStdHandle, GetConsoleScreenBufferInfo, OutputDebugStringW, GetTickCount, GetCommandLineW, SetCurrentDirectoryW, SetEndOfFile, EnumResourceLanguagesW, GetSystemDefaultLangID, GetUserDefaultLangID, GetLocalTime, ResetEvent, GlobalFree, GetPrivateProfileStringW, GetPrivateProfileSectionNamesW, WritePrivateProfileStringW, CreateNamedPipeW, ConnectNamedPipe, TerminateThread, CompareFileTime, CopyFileExW, OpenEventW, PeekNamedPipe, WaitForSingleObjectEx, QueryPerformanceCounter, QueryPerformanceFrequency, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, WakeAllConditionVariable, SleepConditionVariableSRW, EncodePointer, LCMapStringEx, CompareStringEx, GetCPInfo, GetSystemTimeAsFileTime, IsDebuggerPresent, InitializeSListHead, InterlockedPopEntrySList, InterlockedPushEntrySList, FlushInstructionCache, IsProcessorFeaturePresent, VirtualAlloc, VirtualFree, UnhandledExceptionFilter, TerminateProcess, GetStartupInfoW, RtlUnwind, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, ExitThread, FreeLibraryAndExitThread, GetModuleHandleExW, ExitProcess, GetFileType, LCMapStringW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetTimeZoneInformation, GetConsoleMode, GetFileSizeEx, SetFilePointerEx, FindFirstFileExW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, FreeEnvironmentStringsW, SetEnvironmentVariableW, SetStdHandle, ReadConsoleW, WriteConsoleW, LoadLibraryA, CreateFileW

imagehlp.dll

SymGetModuleBase, SymFunctionTableAccess, SymGetLineFromAddr, SymSetSearchPath, SymCleanup, SymInitialize, SymSetOptions, StackWalk

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/01/24-08:47:32.504841	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	49737	8732	192.168.2.4	5.161.190.139
07/01/24-08:47:39.139186	TCP	2046056	ET TROJAN Redline Stealer/MetaStealer Family Activity (Response)	8732	49737	5.161.190.139	192.168.2.4
07/01/24-08:47:46.398128	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49737	8732	192.168.2.4	5.161.190.139
07/01/24-08:47:32.607724	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	8732	49737	5.161.190.139	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 1, 2024 08:47:30.910645008 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:30.915456057 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:30.917887926 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:31.266604900 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:31.272547960 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:31.385631084 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:31.435139894 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:32.504841089 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:32.509671926 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:32.607723951 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:32.653928041 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:39.033618927 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:39.038450956 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:39.139185905 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:39.139231920 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:39.139241934 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:39.139251947 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:39.139262915 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:39.139283895 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:39.139345884 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:39.185159922 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:40.006119013 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:40.011168957 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:40.110004902 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:40.124138117 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:40.128932953 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:40.226454973 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:40.245136976 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:40.252286911 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:40.350320101 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:40.371150017 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:40.376569986 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:40.474334955 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:40.485517025 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:40.490328074 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:40.588082075 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:40.590353966 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:40.595185041 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:40.692997932 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:40.747628927 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:40.792191029 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:40.797164917 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:40.797175884 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:40.797214031 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:40.797223091 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:40.797234058 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:40.797338009 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:40.797405005 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:40.797430038 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:40.802270889 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:40.802320957 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:40.802329063 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:41.066373110 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:41.107034922 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:41.332055092 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:41.336982012 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:41.434650898 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:41.443778992 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:41.448586941 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:41.547449112 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:41.565918922 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:41.570868969 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:41.668555975 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:41.716384888 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:42.146190882 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:42.151185989 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.249062061 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.256036997 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:42.260804892 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.358704090 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.388199091 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:42.393140078 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.393151999 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.393161058 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.393198967 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:42.393228054 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.393238068 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.393279076 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:42.393326998 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.393337011 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.393345118 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.393382072 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:42.393414021 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.393424988 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.393464088 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.393464088 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:42.393560886 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:42.398271084 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.398422956 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.398432016 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.398442030 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.398451090 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.398648977 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.398658037 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.398665905 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.398674965 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.398684978 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.403081894 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.403090954 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.403106928 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.403115034 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.403151989 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.403161049 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.403177023 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.403184891 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.403197050 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.403206110 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.403258085 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.403265953 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.403289080 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.797054052 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.806741953 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:42.811534882 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.914407969 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:42.966370106 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:43.206640959 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:43.211494923 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:43.309596062 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:43.357012033 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:43.368031979 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:43.372781038 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:43.471086025 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:43.528894901 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:45.618731022 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:45.623599052 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.623619080 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.623630047 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.730051994 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.779627085 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:45.864243031 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:45.864322901 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:45.864757061 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:45.869196892 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.869254112 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:45.869286060 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.869343996 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.869354010 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.869375944 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:45.869395018 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:45.869401932 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.869445086 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.869496107 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:45.869527102 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.869569063 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:45.869585991 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.869612932 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.869621992 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.869631052 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.869640112 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.869642973 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:45.869651079 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.869667053 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:45.869693995 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:45.874054909 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.874063015 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.874104977 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.874114037 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.874125957 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:45.874150991 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:45.874171972 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:45.874174118 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.874182940 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.874228001 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:45.874254942 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.874268055 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.874322891 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.874331951 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.874381065 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.874388933 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.874470949 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.874479055 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.874483109 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.874500990 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.874507904 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.874516010 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.874557018 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.874563932 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.874615908 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.874624968 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.874656916 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.874665976 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.874710083 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.874716997 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.878721952 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.878731966 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.878771067 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.878797054 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.878868103 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.878881931 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.878926039 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.878933907 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.879013062 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.879021883 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.879061937 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.879070044 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.879117012 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.879177094 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.879185915 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.879246950 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.879255056 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.879286051 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.879293919 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.879338026 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.879388094 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.879396915 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:45.879414082 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.879456997 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:45.879471064 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.879509926 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.879518986 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.879571915 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.879580975 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.879610062 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.879617929 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.879663944 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.879712105 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.879725933 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.879734039 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.879756927 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.879765034 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.879833937 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.879842997 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.879904985 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.879914045 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.879964113 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.879972935 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.880012035 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.880075932 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.880084991 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.880093098 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.880111933 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.880120993 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.880193949 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.880253077 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.880260944 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.880269051 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.880306959 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.880321026 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.880373955 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.880382061 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.883492947 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.883502007 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.883536100 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.883543968 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.883594036 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.883603096 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.883665085 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.883675098 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.883729935 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.883738041 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.883771896 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.883794069 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.883853912 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.883862972 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.884095907 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:45.884151936 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:45.884205103 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.884219885 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.884238958 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.884253979 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.884315968 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.884325027 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.884366989 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.884376049 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.884473085 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.884486914 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.884507895 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.884540081 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.884579897 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.884588957 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.884632111 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.884640932 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.884701967 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.884710073 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.884774923 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.884783983 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.884824038 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.884860992 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.884908915 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.884917021 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.884960890 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.884968996 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.885013103 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.885021925 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.885072947 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.885082006 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.885097980 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.885107040 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.885160923 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.885169983 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.885234118 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.885243893 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.885282993 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.885291100 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.885328054 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.885380983 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.885390043 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.885401011 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.885447025 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.885454893 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.885574102 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.885582924 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.885617018 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.885664940 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.885679960 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.885689020 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.885710955 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.885719061 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.885757923 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.885766983 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.885945082 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:45.886008978 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:45.888914108 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.888957977 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.888967037 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.888982058 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.888991117 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889031887 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889040947 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889106035 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889115095 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889122963 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889132023 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889189005 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889197111 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889247894 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889257908 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889266968 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889307976 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889323950 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889332056 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889425993 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889435053 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889450073 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889458895 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889502048 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889509916 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889553070 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889561892 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889609098 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889617920 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889668941 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889677048 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889709949 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889719009 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889759064 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889766932 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889775038 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889784098 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889816999 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889826059 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889864922 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889873981 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889915943 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889924049 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889949083 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889956951 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889971972 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.889980078 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.890024900 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.890033007 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.890048981 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.890062094 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.890094995 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.890104055 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.890113115 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.890312910 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:45.890379906 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:45.890755892 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.890791893 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.890799999 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.890810013 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.890914917 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.890923023 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.890976906 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.890985966 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891002893 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891011953 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891113043 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891122103 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891130924 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891155005 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891163111 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891212940 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891226053 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891233921 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891311884 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891321898 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891330004 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891338110 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891357899 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891366959 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891372919 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891376972 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891422987 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891432047 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891446114 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891453981 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891499043 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891509056 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891518116 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891525984 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891557932 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891566992 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891599894 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891627073 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891659975 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891669035 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891716957 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891726017 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891732931 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891741991 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891757965 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891767979 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891803980 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891813040 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891828060 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891835928 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891850948 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891860008 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891937971 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.891946077 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.892129898 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:45.892195940 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:45.895239115 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.895248890 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.895339966 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.895348072 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.895387888 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.895435095 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.895443916 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.895451069 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.895545959 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.895555019 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.895562887 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.895565987 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.895575047 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.895653009 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.895662069 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.895668983 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.895678997 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.895687103 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.895703077 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.895711899 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.895720005 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.895728111 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.895742893 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.895750999 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.895791054 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.895800114 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.895839930 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.895849943 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.895867109 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.895874977 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.895905018 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.895914078 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.895960093 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.895968914 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.895983934 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.895992041 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.896037102 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.896045923 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.896106958 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.896114111 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.896153927 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.896162033 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.896174908 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.896183014 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.896229029 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.896236897 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.896245003 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.896258116 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.896306038 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.896312952 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.896321058 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.896328926 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.896363974 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.896372080 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.896565914 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:45.896627903 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:45.896934986 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.896943092 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.896951914 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.896990061 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897034883 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897042990 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897058010 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897069931 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897088051 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897114038 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897205114 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897212982 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897219896 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897228003 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897234917 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897243023 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897257090 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897264957 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897273064 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897279978 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897295952 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897304058 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897316933 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897325039 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897346020 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897353888 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897402048 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897409916 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897418022 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897425890 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897485018 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897491932 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897536993 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897545099 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897553921 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897557020 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897602081 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897609949 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897617102 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897624016 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897631884 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897639990 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897648096 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897655964 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897713900 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897721052 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897727966 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897736073 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897742987 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897752047 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897761106 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897767067 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897773981 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897780895 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.897949934 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:45.898005009 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:45.901483059 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.901493073 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.901540041 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.901549101 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.901618004 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.901627064 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.901657104 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.901664972 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.901704073 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.901711941 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.901722908 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.901731968 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.901755095 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.901763916 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.901813984 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.901823044 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.901885986 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.901894093 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.901920080 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.901927948 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.901977062 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.901985884 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902004004 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902012110 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902046919 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902055979 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902116060 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902124882 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902133942 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902142048 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902158022 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902165890 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902180910 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902189016 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902240992 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902249098 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902266979 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902276039 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902291059 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902299881 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902313948 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902323008 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902371883 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902379990 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902400970 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902410030 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902443886 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902452946 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902467966 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902477026 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902508974 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902517080 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902559042 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902568102 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902693987 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902748108 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:45.902781010 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902795076 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902803898 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:45.902822018 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902832031 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902848005 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902873993 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902884007 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902930975 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902940035 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902947903 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902983904 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.902992964 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.903059006 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.903067112 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.903212070 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.903227091 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.903306007 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.903315067 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.903323889 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.903386116 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.903394938 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.903426886 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.903434992 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.903443098 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.903491020 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.903508902 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.903609991 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.903620005 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.903629065 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.903633118 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.903683901 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.903693914 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.903709888 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.903717995 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.903758049 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.903767109 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.903786898 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.903795958 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.903810978 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.903821945 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.903871059 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.903879881 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.903897047 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.903904915 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.903985023 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.903994083 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.904000998 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.904009104 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.904023886 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.904031038 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.904059887 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.904067993 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.904148102 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.904309988 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:45.907577038 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.907665968 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.907675982 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.907685995 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.907701015 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.907778978 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.907834053 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.907911062 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.907919884 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.907943010 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.907951117 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908000946 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908010006 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908191919 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908200979 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908247948 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908256054 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908309937 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908318043 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908332109 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908339977 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908354044 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908360958 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908405066 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908411980 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908422947 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908503056 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908512115 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908518076 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908591032 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908598900 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908607006 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908613920 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908621073 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908627987 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908634901 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908643007 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908724070 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908731937 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908739090 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908741951 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908746004 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908751965 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908760071 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908767939 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908775091 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908782005 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908853054 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908860922 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908868074 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908870935 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908874035 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908880949 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.908888102 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.909145117 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.909152985 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.909187078 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.909194946 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.909243107 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.909250975 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.909259081 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.909311056 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.909320116 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.909327030 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.909354925 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.909363031 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.909396887 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.909404993 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.909413099 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.909473896 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.909482002 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.909488916 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.909502983 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.909512043 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.909575939 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.909584045 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.909637928 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.909646034 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.909719944 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.909728050 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.909735918 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.909779072 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.909818888 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.909827948 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:45.909863949 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:46.294169903 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:46.294950962 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:46.299772978 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:46.397349119 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:46.398128033 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:46.402921915 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:46.501074076 CEST	8732	49737	5.161.190.139	192.168.2.4
Jul 1, 2024 08:47:46.544504881 CEST	49737	8732	192.168.2.4	5.161.190.139
Jul 1, 2024 08:47:46.843913078 CEST	49737	8732	192.168.2.4	5.161.190.139

Target ID:	0
Start time:	02:47:02
Start date:	01/07/2024
Path:	C:\Users\user\Desktop\NI0Y4iB1ON.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\NI0Y4iB1ON.exe"
Imagebase:	0x400000
File size:	4'686'848 bytes
MD5 hash:	375E9ACDE29BEEE941AA2706285F34B1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1900270000.000000000075B000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1900709118.0000000005152000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:47:21
Start date:	01/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Imagebase:	0x9a0000
File size:	2'141'552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.2156084327.0000000005202000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2161332834.0000000007344000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	88
Total number of Limit Nodes:	7

Executed Functions

Function 098F6948 Relevance: .5, Instructions: 499COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2169285191.00000000098F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 098F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_98f0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19b2c19884f087f8e3f7020b3c9d4785079547d07a907352203af7122da56f6d
Instruction ID: 9d9704cb2e61d224de3f1cc6f91994b19478308e23bb42e426f8cf36ee856a93
Opcode Fuzzy Hash: 19b2c19884f087f8e3f7020b3c9d4785079547d07a907352203af7122da56f6d
Instruction Fuzzy Hash: D9220071900228CFDB69DF64C958BE9BBB2FF4A300F0095E9D509AB261DB359E84CF41

Function 098F8D18 Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2169285191.00000000098F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 098F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_98f0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61be74e7376646dd2b12657366b8f1dbcb8e640868853baab5cd6a39ce3931b4
Instruction ID: 9f29f34965cc73188e02e7c2e7ffff1fe9070201b80801143f5f5515f1d0c7e5
Opcode Fuzzy Hash: 61be74e7376646dd2b12657366b8f1dbcb8e640868853baab5cd6a39ce3931b4
Instruction Fuzzy Hash: 3CD1B734A00358CFCB18EFB4D858A9DBBB2FF8A301F5085ADE41AA7254DB355986CF51

Function 098F8D28 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2169285191.00000000098F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 098F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_98f0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ae9c47d8fd2d03b9442ed311856e5087f7b6aeb88f53a546225a903326360ac
Instruction ID: 2e057cc4670d387108841d014bf98e284831516d8d72a8ad5db4a205bfbab600
Opcode Fuzzy Hash: 6ae9c47d8fd2d03b9442ed311856e5087f7b6aeb88f53a546225a903326360ac
Instruction Fuzzy Hash: 7ED1B634A00358CFCB18EFB4D858A9DBBB2FF8A301F50856DE41AA7254DB359986CF51

Function 057AAE30 Relevance: 1.7, APIs: 1, Instructions: 209
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 057AB086

Memory Dump Source

Source File: 00000002.00000002.2160268233.00000000057A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_57a0000_csc.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 1c5939ae9f80740f57075f9409111fb61588050ccba444220503f7d6b5a60cd1
Instruction ID: 32c56c696f10131acd597ad2dd13fc6768cd22ffb283e1a5d3daadc471b07e99
Opcode Fuzzy Hash: 1c5939ae9f80740f57075f9409111fb61588050ccba444220503f7d6b5a60cd1
Instruction Fuzzy Hash: B28147B1A04B458FD728DF29D04576ABBF1FF88304F008A2DD49ADBA50D775E84ACB91

Function 057A5935 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 057A59F1

Memory Dump Source

Source File: 00000002.00000002.2160268233.00000000057A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_57a0000_csc.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 0886b1155f66370fef1c7a6566ec97cf072fbce1907103a5fbda67f7e18446d1
Instruction ID: a3e549da05462979147ef3094ef907c180793a2ea55f951370359f1cbaf659d2
Opcode Fuzzy Hash: 0886b1155f66370fef1c7a6566ec97cf072fbce1907103a5fbda67f7e18446d1
Instruction Fuzzy Hash: D24102B1D04719CEDB24CFA9C884B8DBBF5BF84304F24816AD008AB255DB75594ACF91

Function 098F0BFC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 098F4381

Memory Dump Source

Source File: 00000002.00000002.2169285191.00000000098F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 098F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_98f0000_csc.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 293412fa841a3efa130e70c6ed4b03ac2a322d650d184a326f57b68127d67d22
Instruction ID: 9a723d303c6c7a14fa038c537a24cb20d2bd24be3e2b5194f2da54acb2658757
Opcode Fuzzy Hash: 293412fa841a3efa130e70c6ed4b03ac2a322d650d184a326f57b68127d67d22
Instruction Fuzzy Hash: C94113B49003099FDB14CF99C488AAAFBF5FB88314F24C45DE619AB321D730A845CBA0

Function 057A4248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 057A59F1

Memory Dump Source

Source File: 00000002.00000002.2160268233.00000000057A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_57a0000_csc.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 4c562f9c3587713668f7888774b62debb4551dbd074631b55183a42bad8b3090
Instruction ID: 5ac0a242bfa5705500f0d329f2440667537137c868dfbfd38d5b8e05e2ad5117
Opcode Fuzzy Hash: 4c562f9c3587713668f7888774b62debb4551dbd074631b55183a42bad8b3090
Instruction Fuzzy Hash: 2041E0B1D00719CADB24CFA9C888B8DBBF5FF88304F20816AD408AB255DB756945CF91

Function 057AC9A0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,057AD2C6,?,?,?,?,?), ref: 057AD387

Memory Dump Source

Source File: 00000002.00000002.2160268233.00000000057A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_57a0000_csc.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7e0e982247048df79b98f59990e1fe006b679db8dac6af34699c4a51a34b6062
Instruction ID: 9f09b8be57472c2fccaf4227d889c866d76bb7dc2b41a154cca359392316b112
Opcode Fuzzy Hash: 7e0e982247048df79b98f59990e1fe006b679db8dac6af34699c4a51a34b6062
Instruction Fuzzy Hash: 6D21E3B5900308EFDB10CF9AD984ADEBBF9EB48320F14841AE959A7310D374A954DFA5

Function 057AD2F9 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,057AD2C6,?,?,?,?,?), ref: 057AD387

Memory Dump Source

Source File: 00000002.00000002.2160268233.00000000057A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_57a0000_csc.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f66c7030e9a18ce6da33152acb02ee67fdbe538705e82c5a63f8a14694c8d45c
Instruction ID: acedc65f7f9b8201720a9b424ea7bde64ef6ee3bca978f45f5b04bb48edafe5a
Opcode Fuzzy Hash: f66c7030e9a18ce6da33152acb02ee67fdbe538705e82c5a63f8a14694c8d45c
Instruction Fuzzy Hash: BD21D2B5901218EFDB10CFAAD584ADEBBF5EB48314F14842AE958A7310D375A940CFA4

Function 057AA870 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,057AB101,00000800,00000000,00000000), ref: 057AB312

Memory Dump Source

Source File: 00000002.00000002.2160268233.00000000057A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_57a0000_csc.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9fdb1202b5a04219d2ea9f539964710b32009733b83cded0dcab56f1bc40eae4
Instruction ID: b44bddb2b252ec3fa32b37e1aa4baa84d8560987976cfda6d5e76deb99f0043b
Opcode Fuzzy Hash: 9fdb1202b5a04219d2ea9f539964710b32009733b83cded0dcab56f1bc40eae4
Instruction Fuzzy Hash: 281114B69003499FDB10CF9AC444ADEFBF4EB98310F10852EE559A7210C375A545CFA4

Function 057AB2A0 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,057AB101,00000800,00000000,00000000), ref: 057AB312

Memory Dump Source

Source File: 00000002.00000002.2160268233.00000000057A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_57a0000_csc.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d85869425ba54cf9c4605ee15509422c63c60687b480996c8949fd9999038fda
Instruction ID: bba50c284ed3c9c5eab344eaa3aea600a3f89429735a53aada4b93f39217b599
Opcode Fuzzy Hash: d85869425ba54cf9c4605ee15509422c63c60687b480996c8949fd9999038fda
Instruction Fuzzy Hash: 6A1112B69003499FDB10CFAAD444ADEFFF4EB88310F14842AD869A7210C375A545CFA1

Function 057AB020 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 057AB086

Memory Dump Source

Source File: 00000002.00000002.2160268233.00000000057A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_57a0000_csc.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d88012337c07bbbf7f18943c3a5f1a17b462135e0b6981e4a0fdbec8b47b33f5
Instruction ID: 29632b95107c33c85097a7dcca547dd682f71fa0219b92de18a6813612b119b8
Opcode Fuzzy Hash: d88012337c07bbbf7f18943c3a5f1a17b462135e0b6981e4a0fdbec8b47b33f5
Instruction Fuzzy Hash: C411DFB6D003498FDB20DF9AC444ADEFBF4EB88224F10852AD469A7210C375A545CFA5

Function 0536D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2158350438.000000000536D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0536D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_536d000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13fee7e1af27ce4b409bab7e49e0752ede13307910ab88f638f407a119f74f4b
Instruction ID: b059fcdc95e57dd08ad08133538a09dd0fdfc6a38e198eb1b965cde175e73d77
Opcode Fuzzy Hash: 13fee7e1af27ce4b409bab7e49e0752ede13307910ab88f638f407a119f74f4b
Instruction Fuzzy Hash: 79214871204244DFCB02DF04D9C0F26BF66FB98314F20C96DD80A4F25AC776E866C6A1

Function 0536D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2158350438.000000000536D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0536D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_536d000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4325fe2c44d0d61e6eb40744b023460b392c713d67b76d70e8d3e58beab4329
Instruction ID: 3ad549be6467a37e39f0472b1b5f776add00c5eb6c27bd63b4b4f4c30aaedafd
Opcode Fuzzy Hash: b4325fe2c44d0d61e6eb40744b023460b392c713d67b76d70e8d3e58beab4329
Instruction Fuzzy Hash: FA212571604240DFCB05DF14D9C0F26BF66FB88318F24C96DEA094FA5AC376D456CAA1

Function 0537D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2158457359.000000000537D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0537D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_537d000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30159c368f8ec7a2c40624a3966f199aee9969a2343a5880311a2211c7c5c03e
Instruction ID: aac439287327633e606db6bfbeb7c1bc5ff34dea9990df5f36c14be814b5de46
Opcode Fuzzy Hash: 30159c368f8ec7a2c40624a3966f199aee9969a2343a5880311a2211c7c5c03e
Instruction Fuzzy Hash: D421F275A04208DFCB24DF14D9C4B26BFA6FF88314F64C96DD80A4B256C37AD447CA61

Function 0537D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2158457359.000000000537D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0537D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_537d000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ce15913fd23f022e0a0c9b833867818f23e800896805d7753f0690b2ac455bc
Instruction ID: 997716d2eda448dedfe4be3ff36e633eafcb9649043da5be6e1cd129edb9cdf2
Opcode Fuzzy Hash: 0ce15913fd23f022e0a0c9b833867818f23e800896805d7753f0690b2ac455bc
Instruction Fuzzy Hash: D5219F755083849FCB12CF14D994B11BFB1FF46314F28C5AAD8498F2A6C37A981ACB62

Function 0536D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2158350438.000000000536D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0536D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_536d000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 404e5828daab406ad2f71dc544b9c00471ab47ae6fd9423f95f6f309ae1eeaf7
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 7811D376504280CFCB16CF14D5C4B26BF72FB84318F24C6AED9490B65AC376D45ACBA1

Function 0536D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2158350438.000000000536D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0536D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_536d000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 62dddd016ffb29c21a718937d710693738790309ea353a60e6267957626422b1
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 5411CD72504240CFCB02CF00D5C4B26BF72FB94224F24C6A9D8090E25AC37AE86ACBA1

Non-executed Functions

Function 098F0040 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2169285191.00000000098F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 098F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_98f0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3c5a98766bddfdcd3583d3f9cab80f944257414e50872559d06ba50de507d06
Instruction ID: ed3494936c5901ce9fa61c90be9f6ced63b7bf43f6a3dbd58668320be7468844
Opcode Fuzzy Hash: b3c5a98766bddfdcd3583d3f9cab80f944257414e50872559d06ba50de507d06
Instruction Fuzzy Hash: 1E12A4B84617868BE310CF65EC4C28D7BB1BF81718B904229F2616F7E5DBB8154ACF46

Function 057ADC74 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2160268233.00000000057A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_57a0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f253fdbba315ae979d6403402c5a3a260f3366cb71788bfcec1eb16155074f7
Instruction ID: acaabdbabb9129940304c476aea25fd552bf30e8f5611a8028bdacab140dd45f
Opcode Fuzzy Hash: 8f253fdbba315ae979d6403402c5a3a260f3366cb71788bfcec1eb16155074f7
Instruction Fuzzy Hash: EDA16E36E002158FCF15DFB4C8489EEB7B2FFC8300B15466AE906AB265DB75E945DB80

Function 098F001B Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2169285191.00000000098F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 098F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_98f0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 499ee43c343747f7b190fe51e09acc1366046c4c1701dd9c1397dd561f4d5789
Instruction ID: 4eac7def147aac84bbfe9df1e17768859c10f10966e849dd227d177fefde66a5
Opcode Fuzzy Hash: 499ee43c343747f7b190fe51e09acc1366046c4c1701dd9c1397dd561f4d5789
Instruction Fuzzy Hash: BFC118B88217868BD710CF64EC4828D7BB1FF85328F544229E1616B3E1DBB8158ACF46

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report NI0Y4iB1ON.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\csc.exe.log

C:\Users\user\Documents\OTOTOTOT\TITUIFO.exe

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Windows Analysis Report
NI0Y4iB1ON.exe

Function 057AAE30 Relevance: 1.7, APIs: 1, Instructions: 209
COMMON

Function 057A5935 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Function 098F0BFC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Function 057A4248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 057AC9A0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 057AD2F9 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Function 057AA870 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Function 057AB2A0 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Function 057AB020 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON