Edit tour

Windows Analysis Report
build.exe

Overview

General Information

Sample name:	build.exe
Analysis ID:	1570969
MD5:	dfefdd2e554fd23f3b87f68c3e0f9622
SHA1:	8be107d3c7e0aba6346ccdac289e29e3a8127af2
SHA256:	f47c2bb84ce619d0d69445b0a1dce760482f2dd508815ba2667bab5c3a3541e9
Tags:	exeRedLineStealeruser-aachum
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected RedLine Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

build.exe (PID: 6508 cmdline: "C:\Users\user\Desktop\build.exe" MD5: DFEFDD2E554FD23F3B87F68C3E0F9622)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["78.70.235.238:1912"], "Bot Id": "l3monlogs", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
build.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1667956540.00000000001C2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: build.exe PID: 6508	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: build.exe PID: 6508	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.build.exe.1c0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

ET MALWARE Redline Stealer TCP CnC - Id1Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T15:05:58.077421+0100	2043234	1	A Network Trojan was detected	78.70.235.238	1912	192.168.2.4	49730	TCP

ET MALWARE Redline Stealer TCP CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T15:05:57.672919+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49730	78.70.235.238	1912	TCP
2024-12-08T15:06:03.136441+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49730	78.70.235.238	1912	TCP
2024-12-08T15:06:06.371336+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49730	78.70.235.238	1912	TCP
2024-12-08T15:06:06.805609+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49730	78.70.235.238	1912	TCP

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T15:06:03.665319+0100	2046056	1	A Network Trojan was detected	78.70.235.238	1912	192.168.2.4	49730	TCP

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T15:05:57.672919+0100	2046045	1	A Network Trojan was detected	192.168.2.4	49730	78.70.235.238	1912	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: build.exe

Malware Configuration Extractor: RedLine {"C2 url": ["78.70.235.238:1912"], "Bot Id": "l3monlogs", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Multi AV Scanner detection for submitted file

Source: build.exe

ReversingLabs: Detection: 87%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: build.exe

Joe Sandbox ML: detected

Source: build.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: build.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2043231 - Severity 1 - ET MALWARE Redline Stealer TCP CnC Activity : 192.168.2.4:49730 -> 78.70.235.238:1912
Source: Network traffic	Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.4:49730 -> 78.70.235.238:1912
Source: Network traffic	Suricata IDS: 2043234 - Severity 1 - ET MALWARE Redline Stealer TCP CnC - Id1Response : 78.70.235.238:1912 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 78.70.235.238:1912 -> 192.168.2.4:49730

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 78.70.235.238:1912

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 78.70.235.238:1912

Source: Joe Sandbox View

ASN Name: TELIANET-SWEDENTeliaCompanySE TELIANET-SWEDENTeliaCompanySE

Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238
Source: unknown	TCP traffic detected without corresponding DNS query: 78.70.235.238

Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: build.exe, 00000000.00000002.1784260335.00000000007CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://purl.oen
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: build.exe, 00000000.00000002.1785220407.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: build.exe, 00000000.00000002.1785220407.00000000028F1000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: build.exe, 00000000.00000002.1785220407.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3ResponseD
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: build.exe, 00000000.00000002.1785220407.0000000002C8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: build.exe	String found in binary or memory: https://api.ip.sb/ip
Source: build.exe, 00000000.00000002.1785220407.0000000002C8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: build.exe, 00000000.00000002.1785220407.0000000002C8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: build.exe, 00000000.00000002.1785220407.0000000002C8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: build.exe, 00000000.00000002.1785220407.0000000002C8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: build.exe, 00000000.00000002.1785220407.0000000002C8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabS
Source: build.exe, 00000000.00000002.1785220407.0000000002C8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: build.exe, 00000000.00000002.1785220407.0000000002C8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: build.exe, 00000000.00000002.1785220407.0000000002C8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Users\user\Desktop\build.exe

Code function: 0_2_024DDC74

0_2_024DDC74

Source: build.exe, 00000000.00000000.1668000119.0000000000206000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs build.exe
Source: build.exe, 00000000.00000002.1784655916.00000000009AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs build.exe
Source: build.exe, 00000000.00000002.1785220407.00000000028CB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefirefox.exe0 vs build.exe
Source: build.exe, 00000000.00000002.1785220407.00000000028CB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $kq,\\StringFileInfo\\000004B0\\OriginalFilename vs build.exe
Source: build.exe, 00000000.00000002.1785220407.00000000028CB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamechrome.exe< vs build.exe
Source: build.exe, 00000000.00000002.1785220407.00000000028CB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $kq,\\StringFileInfo\\040904B0\\OriginalFilename vs build.exe
Source: build.exe, 00000000.00000002.1785220407.00000000028CB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIEXPLORE.EXE.MUID vs build.exe
Source: build.exe, 00000000.00000002.1785220407.00000000028CB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIEXPLORE.EXED vs build.exe
Source: build.exe, 00000000.00000002.1785220407.00000000028CB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $kq,\\StringFileInfo\\080904B0\\OriginalFilename vs build.exe
Source: build.exe, 00000000.00000002.1785220407.00000000028CB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsedge.exe> vs build.exe
Source: build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs build.exe
Source: build.exe	Binary or memory string: OriginalFilenameSteanings.exe8 vs build.exe

Source: build.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/1@0/1

Source: C:\Users\user\Desktop\build.exe

File created: C:\Users\user\AppData\Local\SystemCache

Jump to behavior

Source: C:\Users\user\Desktop\build.exe

Mutant created: NULL

Source: build.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: build.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\build.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\build.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\build.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\build.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Users\user\Desktop\build.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: build.exe

ReversingLabs: Detection: 87%

Source: C:\Users\user\Desktop\build.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: ntasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\build.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: build.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: build.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: build.exe

Static PE information: 0xD22848DC [Tue Sep 23 12:17:32 2081 UTC]

Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\build.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\build.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\build.exe	Memory allocated: 2490000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Memory allocated: 26F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Memory allocated: 2610000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\build.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\build.exe	Window / User API: threadDelayed 1203			Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Window / User API: threadDelayed 2508			Jump to behavior

Source: C:\Users\user\Desktop\build.exe TID: 3492	Thread sleep time: -12912720851596678s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\build.exe TID: 6568	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\build.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\build.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: build.exe, 00000000.00000002.1784655916.00000000009E7000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\build.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\build.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\build.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\build.exe	Queries volume information: C:\Users\user\Desktop\build.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\build.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\build.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\build.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\build.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\build.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\build.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\build.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: build.exe, type: SAMPLE
Source: Yara match	File source: 0.0.build.exe.1c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1667956540.00000000001C2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: build.exe PID: 6508, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\build.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\build.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: build.exe PID: 6508, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: build.exe, type: SAMPLE
Source: Yara match	File source: 0.0.build.exe.1c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1667956540.00000000001C2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: build.exe PID: 6508, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Masquerading	1 OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Timestomp	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	113 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
build.exe	88%	ReversingLabs	ByteCode-MSIL.Trojan.RedLineStealz
build.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://purl.oen	0%	Avira URL Cloud	safe
78.70.235.238:1912	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
78.70.235.238:1912	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	build.exe, 00000000.00000002.1785220407.0000000002C8D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id23ResponseD	build.exe, 00000000.00000002.1785220407.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id12Response	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id2Response	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21Response	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id5	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id4	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id7	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://purl.oen	build.exe, 00000000.00000002.1784260335.00000000007CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id19Response	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15Response	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id6Response	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/ip	build.exe	false		high
http://schemas.xmlsoap.org/ws/2004/04/sc	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id1ResponseD	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9Response	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	build.exe, 00000000.00000002.1785220407.0000000002C8D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id20	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id22	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id23	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24Response	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	build.exe, 00000000.00000002.1785220407.0000000002C8D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id1Response	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id11	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id12	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id16Response	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id14	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id16	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id17	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id18	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id5Response	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id19	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10Response	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8Response	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	build.exe, 00000000.00000002.1785220407.0000000002C8D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtabS	build.exe, 00000000.00000002.1785220407.0000000002C8D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id3ResponseD	build.exe, 00000000.00000002.1785220407.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id23Response	build.exe, 00000000.00000002.1785220407.00000000026F1000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	build.exe, 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
78.70.235.238	unknown	Sweden		3301	TELIANET-SWEDENTeliaCompanySE	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1570969
Start date and time:	2024-12-08 15:05:03 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	build.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/1@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 14 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): SIHClient.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: build.exe

Simulations

Behavior and APIs

Time	Type	Description
09:06:03	API Interceptor	21x Sleep call for process: build.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
78.70.235.238	OXrZ6fj4Hq.exe	Get hash	malicious	Neshta, Oski Stealer, StormKitty, SugarDump, Vidar, XWorm	Browse
78.70.235.238	mgHpGWB37W.exe	Get hash	malicious	RedLine	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELIANET-SWEDENTeliaCompanySE	meerkat.mpsl.elf	Get hash	malicious	Mirai	Browse	90.230.133.78
	meerkat.arm5.elf	Get hash	malicious	Mirai	Browse	147.13.236.157
	jmhgeojeri.elf	Get hash	malicious	Unknown	Browse	147.13.249.90
	jmhgeojeri.elf	Get hash	malicious	Unknown	Browse	2.252.178.113
	akcqrfutuo.elf	Get hash	malicious	Unknown	Browse	90.232.44.27
	home.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	2.251.105.70
	home.arm.elf	Get hash	malicious	Mirai, Gafgyt	Browse	78.64.30.110
	jew.arm7.elf	Get hash	malicious	Mirai	Browse	90.230.39.157
	arm5.elf	Get hash	malicious	Unknown	Browse	95.193.59.249
	jew.arm6.elf	Get hash	malicious	Unknown	Browse	194.23.194.71

Process:	C:\Users\user\Desktop\build.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3094
Entropy (8bit):	5.33145931749415
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0atTqdqlq7qV
MD5:	3FD5C0634443FB2EF2796B9636159CB6
SHA1:	366DDE94AEFCFFFAB8E03AD8B448E05D7489EB48
SHA-256:	58307E94C67E2348F5A838DE4FF668983B38B7E9A3B1D61535D3A392814A57D6
SHA-512:	8535E7C0777C6B0876936D84BDE2BDC59963CF0954D4E50D65808E6E806E8B131DF5DB8FA0E030FAE2702143A7C3A70698A2B9A80519C9E2FFC286A71F0B797C
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.081385717584516
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	build.exe
File size:	307'712 bytes
MD5:	dfefdd2e554fd23f3b87f68c3e0f9622
SHA1:	8be107d3c7e0aba6346ccdac289e29e3a8127af2
SHA256:	f47c2bb84ce619d0d69445b0a1dce760482f2dd508815ba2667bab5c3a3541e9
SHA512:	8f11525da059c6aa655d5ad2c41f89ce535ebb7a2bd4d7ce197c2ea244f28947e2338b1f97378130179490e49fd73402ee3dcdc507901f48b41ce9acf79ca182
SSDEEP:	3072:OcZqf7D34bp/0+mA6ky4mEQog8JB1fA0PuTVAtkxzr3RgeqiOL2bBOA:OcZqf7DIFnGfsB1fA0GTV8kZgL
TLSH:	B2645A5833E8C910DA7F4775D861D67093B0BCA3A552E70B4FC4ACAB3D32740EA50AB6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....H(...............0.................. ... ....@.. ....................... ............@................................

File Icon


Icon Hash:	4d8ea38d85a38e6d

Static PE Info

General

Entrypoint:	0x43029e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xD22848DC [Tue Sep 23 12:17:32 2081 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x30248	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x32000	0x1c9c6	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x50000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x2e2a4	0x2e400	8459de5d2a039aedb931e431c84e7c3e	False	0.47478885135135135	data	6.18628062971852	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x32000	0x1c9c6	0x1ca00	a8cf3f8ff27a4a736ba8fb433d91107f	False	0.2380765556768559	data	2.615031395625776	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x50000	0xc	0x200	ad0a6b4525092f96ee7808055cdae654	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x32220	0x3d04	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9934058898847631
RT_ICON	0x35f24	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2835 x 2835 px/m	0.09013072282030049
RT_ICON	0x4674c	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2835 x 2835 px/m	0.13905290505432216
RT_ICON	0x4a974	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2835 x 2835 px/m	0.17033195020746889
RT_ICON	0x4cf1c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2835 x 2835 px/m	0.2045028142589118
RT_ICON	0x4dfc4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2835 x 2835 px/m	0.24645390070921985
RT_GROUP_ICON	0x4e42c	0x5a	data	0.7666666666666667
RT_VERSION	0x4e488	0x352	data	0.4447058823529412
RT_MANIFEST	0x4e7dc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-08T15:05:57.672919+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49730	78.70.235.238	1912	TCP
2024-12-08T15:05:57.672919+0100	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	1	192.168.2.4	49730	78.70.235.238	1912	TCP
2024-12-08T15:05:58.077421+0100	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	1	78.70.235.238	1912	192.168.2.4	49730	TCP
2024-12-08T15:06:03.136441+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49730	78.70.235.238	1912	TCP
2024-12-08T15:06:03.665319+0100	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	78.70.235.238	1912	192.168.2.4	49730	TCP
2024-12-08T15:06:06.371336+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49730	78.70.235.238	1912	TCP
2024-12-08T15:06:06.805609+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49730	78.70.235.238	1912	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 8, 2024 15:05:56.105886936 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:05:56.225562096 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:05:56.225661993 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:05:56.233915091 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:05:56.353198051 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:05:57.491250992 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:05:57.536016941 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:05:57.672919035 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:05:57.792361975 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:05:58.077420950 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:05:58.129720926 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:03.136440992 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:03.257009983 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:03.546165943 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:03.546184063 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:03.546195030 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:03.546231031 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:03.546232939 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:03.546277046 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:03.665318966 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:03.707859039 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:04.766613007 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:04.886425018 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:04.886436939 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:04.886488914 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:04.886511087 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:04.886544943 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:04.886598110 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:04.886662006 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:04.886672020 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:04.886713028 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:04.886797905 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:04.886843920 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:04.886907101 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:04.886917114 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:04.886925936 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:04.886950016 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:04.886977911 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.006081104 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.006165028 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.006180048 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.006238937 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.006310940 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.006321907 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.006375074 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.006473064 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.006556034 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.006808043 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.006818056 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.006897926 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.006938934 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.006992102 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.006995916 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.007006884 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.007065058 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.007118940 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.007344961 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.125674009 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.125745058 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.125803947 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.125910997 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.126008987 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.126064062 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.126216888 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.126276970 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.126303911 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.126358032 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.126485109 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.126524925 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.126539946 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.126569986 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.126611948 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.126665115 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.126709938 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.126738071 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.126751900 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.126802921 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.126888037 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.126889944 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.126899958 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.126910925 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.126945972 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.126959085 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.127033949 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.127043009 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.127078056 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.127084017 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.127087116 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.127103090 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.127136946 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.127155066 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.127163887 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.127207994 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.127247095 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.127257109 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.127306938 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.127319098 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.127343893 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.127352953 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.127402067 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.245491028 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.245503902 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.245544910 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.245570898 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.245621920 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.245742083 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.245750904 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.245762110 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.245781898 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.245790958 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.245805025 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.245821953 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.245831013 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.245850086 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.245874882 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.245907068 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.245915890 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.245951891 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.245970011 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.246112108 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.246150970 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.246160030 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.246212959 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.246249914 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.246259928 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.246354103 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.246362925 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.246397972 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.246510029 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.246517897 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.246587038 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.246598959 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.246722937 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.246793985 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.246803999 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.246819019 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.247966051 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.247975111 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.247982979 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.247992039 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.248002052 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.248011112 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.248027086 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.248035908 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.248049021 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.248058081 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.248064995 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.248075008 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.248081923 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.248090029 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.248105049 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.248114109 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.248121977 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.248159885 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.248194933 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.248203993 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.248236895 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.248290062 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.248294115 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.248298883 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.248327017 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.248409986 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.248419046 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.248426914 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.248512030 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.248526096 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.248548985 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.248697042 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.248708010 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.248711109 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.248728991 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.248763084 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.248819113 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.248828888 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.248878956 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.249005079 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.249013901 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.249022007 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.249088049 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.365061045 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.365072012 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.365140915 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.365228891 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.365238905 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.365247011 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.365339041 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.365348101 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.365423918 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.365447998 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.365457058 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.365466118 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.365576982 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.365585089 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.365638018 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.365722895 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.365731955 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.365741968 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.365902901 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.365911961 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.366142035 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.366202116 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.367604971 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.367789030 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.367799044 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.367808104 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.367815971 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.367918968 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.367928028 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.367994070 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.368002892 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.368103027 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.368112087 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.368247986 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.368362904 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.368372917 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.368381023 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.368443012 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.368453026 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.368583918 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.368671894 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.368717909 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.368727922 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.368814945 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.368823051 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.368832111 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.368837118 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.368865013 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.368913889 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.368922949 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.368947029 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.369153023 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.369280100 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.369287968 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.369297981 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.369376898 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.369388103 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.369471073 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.369479895 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.369518042 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.369527102 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.369636059 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.369645119 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.369671106 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.369684935 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.369692087 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.369729042 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.369739056 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.369746923 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.369868994 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.369915009 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.369929075 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.369945049 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.369986057 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.369995117 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.373389006 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.373580933 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.373639107 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.485533953 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.485614061 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.485652924 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.485730886 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.485738993 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.485747099 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.485831022 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.485934019 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.485944033 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.485950947 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.485960007 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.486052990 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.486129999 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.486139059 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.486251116 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.486329079 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.486337900 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.486404896 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.486414909 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.486422062 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.486519098 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.486604929 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.486617088 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.486624002 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.486687899 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.486696959 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.486834049 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.486845970 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.486917019 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.486924887 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.487010956 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.487061024 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.487158060 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.487257004 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.487266064 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.487272978 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.487322092 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.487329960 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.487430096 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.487438917 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.487505913 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.487514973 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.487521887 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.487560987 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.487682104 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.487694025 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.487700939 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.487732887 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.487740993 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.487819910 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.487875938 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.487930059 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.487966061 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.487974882 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.488154888 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.488209963 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.493136883 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.493161917 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.493196011 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.493205070 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.493264914 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.493314981 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.493323088 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.493371010 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.493405104 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.493417025 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.493494987 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.493545055 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.493628025 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.493726969 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.493735075 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.493779898 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.493827105 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.493834972 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.493879080 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.493938923 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.493978024 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.494055033 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.494062901 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.494076967 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.494198084 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.494205952 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.494277954 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.494292974 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.494298935 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.494313002 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.494321108 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.494503975 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.494509935 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.494556904 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.494602919 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.494654894 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.494663954 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.494775057 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.494784117 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.494869947 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.494879007 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.494913101 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.495007038 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.495014906 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.495022058 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.495048046 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.495055914 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.495107889 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.495151997 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.495160103 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.495167017 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.495250940 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.495259047 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.495270014 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.495461941 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.495522976 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.607621908 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.607634068 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.607753038 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.607805014 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.607814074 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.607841015 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.607906103 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.608022928 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.608032942 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.608089924 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.608098984 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.608108997 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.608151913 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.608160973 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.608302116 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.608310938 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.608346939 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.608356953 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.608459949 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.608470917 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.608599901 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.608608961 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.608728886 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.608737946 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.608776093 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.608784914 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.608899117 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.608910084 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.609020948 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.609030008 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.609064102 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.609143019 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.609153032 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.609162092 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.609178066 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.609186888 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.609260082 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.609316111 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.609325886 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.609437943 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.609447002 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.609455109 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.609517097 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.609527111 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.609534979 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.609544039 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.609621048 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.609630108 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.609677076 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.609685898 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.609694004 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.609780073 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.609788895 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.609797001 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.610080957 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.610150099 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.614913940 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.615003109 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.615098000 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.615107059 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.615252972 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.615336895 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.615381956 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.615417957 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.615505934 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.615546942 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.615748882 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.615791082 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.615878105 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.615885973 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.615999937 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.616086960 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.616241932 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.616261959 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.616389036 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.616400957 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.616471052 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.616595984 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.616604090 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.616617918 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.616699934 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.616708040 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.616794109 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.616911888 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.616919994 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.616934061 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.617027044 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.617034912 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.617131948 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.617172956 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.617296934 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.617305040 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.617424965 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.617433071 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.617439985 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.617646933 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.617655039 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.617662907 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.617671013 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.617846966 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.617855072 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.617861032 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.617868900 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.618099928 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.618108034 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.618114948 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.618124008 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.618132114 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.618150949 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.618263006 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.618444920 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.618484974 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.729480982 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.729546070 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.729554892 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.729562998 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.729578018 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.729587078 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.729743004 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.729780912 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.729840040 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.729847908 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.730078936 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.730113029 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.730120897 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.730129957 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.730138063 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.730144978 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.730178118 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.730251074 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.730259895 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.730299950 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.730365038 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.730374098 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.730416059 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.730424881 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.730535984 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.730545998 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.730554104 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.730562925 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.730572939 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.730581045 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.730669022 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.730676889 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.730685949 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.730746031 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.730753899 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.731139898 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.731149912 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.731153011 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.731161118 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.731169939 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.731180906 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.731189966 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.731197119 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.731211901 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.731228113 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.731235981 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.731246948 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.731256008 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.731262922 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.731369972 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.731379032 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.731386900 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.731395006 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.731403112 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.731676102 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.731746912 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.738007069 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.738162994 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.738172054 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.738179922 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.738219976 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.738229036 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.738271952 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.738281012 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.738295078 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.738333941 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.738347054 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.738357067 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.738368034 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.738440037 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.738476038 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.738524914 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.738569021 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.738646030 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.738658905 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.738667965 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.738679886 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.738687992 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.738774061 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.738782883 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.738914967 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.738924026 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.738933086 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.738943100 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.739007950 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.739296913 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.739305973 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.739320993 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.739332914 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.739473104 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.739481926 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.739523888 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.739609957 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.739619017 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.739650965 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.739782095 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:05.851097107 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.851166964 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.851247072 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.851303101 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.851392031 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.851399899 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.851500034 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.851620913 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.851805925 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.851834059 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.851927996 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.851936102 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.851977110 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.852056026 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.852164984 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.852236032 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.852318048 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.852390051 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.852399111 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.852406025 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.852415085 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.852510929 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.852519035 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.852575064 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.852631092 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.852713108 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.852720976 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.859128952 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.859169960 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.859255075 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.859354019 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.859457970 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.859467030 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.859505892 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:05.870132923 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:06.370726109 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:06.371335983 CET	49730	1912	192.168.2.4	78.70.235.238
Dec 8, 2024 15:06:06.490827084 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:06.775859118 CET	1912	49730	78.70.235.238	192.168.2.4
Dec 8, 2024 15:06:06.805608988 CET	49730	1912	192.168.2.4	78.70.235.238

Target ID:	0
Start time:	09:05:53
Start date:	08/12/2024
Path:	C:\Users\user\Desktop\build.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\build.exe"
Imagebase:	0x1c0000
File size:	307'712 bytes
MD5 hash:	DFEFDD2E554FD23F3B87F68C3E0F9622
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000000.1667956540.00000000001C2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1785220407.0000000002786000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	38
Total number of Limit Nodes:	7

Executed Functions

Function 024DD0A8 Relevance: 6.1, APIs: 4, Instructions: 131
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 024DD136
GetCurrentThread.KERNEL32 ref: 024DD173
GetCurrentProcess.KERNEL32 ref: 024DD1B0
GetCurrentThreadId.KERNEL32 ref: 024DD209

Memory Dump Source

Source File: 00000000.00000002.1784956326.00000000024D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24d0000_build.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 3920544ee7b2e282016820bd851499597167acc57e6c030a52d483acf2251303
Instruction ID: 535708497b8406e9d6e3e00ca314b78de3b3277269db667f313b088876ee71f8
Opcode Fuzzy Hash: 3920544ee7b2e282016820bd851499597167acc57e6c030a52d483acf2251303
Instruction Fuzzy Hash: C55148B1900349CFDB15DFA9D54879EBBF1EF48314F20C45AE419AB3A0DB349984CB65

Function 024DD0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 024DD136
GetCurrentThread.KERNEL32 ref: 024DD173
GetCurrentProcess.KERNEL32 ref: 024DD1B0
GetCurrentThreadId.KERNEL32 ref: 024DD209

Memory Dump Source

Source File: 00000000.00000002.1784956326.00000000024D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24d0000_build.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: e2127b6df537712f7d7c55ad3bf20043e3dc727c15dd1c74751bf31da79a6a8b
Instruction ID: 760e8a06bf25c92fb2b18a98618480822bbe67ff9c93264d391e8272de371781
Opcode Fuzzy Hash: e2127b6df537712f7d7c55ad3bf20043e3dc727c15dd1c74751bf31da79a6a8b
Instruction Fuzzy Hash: B65134B1900209CFDB15DFAAD548B9EBBF1EF48314F20C45AE419A73A0DB34A984CB65

Function 024DAE30 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 024DB086

Memory Dump Source

Source File: 00000000.00000002.1784956326.00000000024D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24d0000_build.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f0ede205a9985b3e1ababa086b2943c741cc89976d07b7b68661ad58b0704968
Instruction ID: dbcc7c060d9612130aa4bc9010b49ba92c595aba7dc0203ba9a4eec5efb1e0ad
Opcode Fuzzy Hash: f0ede205a9985b3e1ababa086b2943c741cc89976d07b7b68661ad58b0704968
Instruction Fuzzy Hash: 3071F1B0A00B158FDB24DF2AD15475ABBF1FB88304F04896EE48A97B50DB75E949CB90

Function 024D5935 Relevance: 1.6, APIs: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 024D59F1

Memory Dump Source

Source File: 00000000.00000002.1784956326.00000000024D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24d0000_build.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 192e38d7e33f1f455b20476c366cf4637998417ff6846f1c48182387605f3213
Instruction ID: f75324fab35176506d31e80a8be4418fee9371a2d9e6ef2c4e61de8e343174e2
Opcode Fuzzy Hash: 192e38d7e33f1f455b20476c366cf4637998417ff6846f1c48182387605f3213
Instruction Fuzzy Hash: A341D3B0D00629CFDB14CFA9C98479EBBB5FF45314F24809AD408AB255DB756989CF90

Function 024D4248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 024D59F1

Memory Dump Source

Source File: 00000000.00000002.1784956326.00000000024D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24d0000_build.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 8f6d6116191e8243cd35a039e0403bc1fb8867207af53fa4ed5184030592e0f8
Instruction ID: f28e11b7b6da47918a793a9c0ba2b36b78784d16060e52e28dd95ddead46eeb1
Opcode Fuzzy Hash: 8f6d6116191e8243cd35a039e0403bc1fb8867207af53fa4ed5184030592e0f8
Instruction Fuzzy Hash: 3541F2B0D00729CFDB24CFA9C844B8EBBB5FF49314F20809AD408AB255DB756989CF90

Function 024DD2F9 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 024DD387

Memory Dump Source

Source File: 00000000.00000002.1784956326.00000000024D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24d0000_build.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3afde1d5b25289ff3b4cffc21a9b4841cf7bac4a9f19cbec383d5dccfd498744
Instruction ID: bc195f3f9b2d108a0eb4786adab4668a1b47a9058f98cada45f348ad6d33c693
Opcode Fuzzy Hash: 3afde1d5b25289ff3b4cffc21a9b4841cf7bac4a9f19cbec383d5dccfd498744
Instruction Fuzzy Hash: EC21E0B5D00219DFDB10CFAAD584AEEBBF5FB48324F14841AE918A7350C374A954CFA4

Function 024DD300 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 024DD387

Memory Dump Source

Source File: 00000000.00000002.1784956326.00000000024D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24d0000_build.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b934e6465d983080c64fd4e2a3f8198c6421a7f8e1f948a389eee43c57f29fa4
Instruction ID: f72198816c25829676f276749a16f84b0635eee586c3b19418cb95e99103ed6c
Opcode Fuzzy Hash: b934e6465d983080c64fd4e2a3f8198c6421a7f8e1f948a389eee43c57f29fa4
Instruction Fuzzy Hash: BE21E3B5900218DFDB10CF9AD584ADEBBF4FB48310F14841AE918A3350D374A944CFA4

Function 024DB020 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 024DB086

Memory Dump Source

Source File: 00000000.00000002.1784956326.00000000024D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24d0000_build.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d435d81592f151c3d6c4c8bbeaaa0695e8ddceeb5cc114a68845d744c674163d
Instruction ID: 48d4e035461820c59282c30d02935daad97c07ccb96bcff7cad768a55cf33321
Opcode Fuzzy Hash: d435d81592f151c3d6c4c8bbeaaa0695e8ddceeb5cc114a68845d744c674163d
Instruction Fuzzy Hash: A1110FB5C003498FCB20DF9AC444ADEFBF4FB88228F10842AD468B7210C375A549CFA5

Function 0095D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784447940.000000000095D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0095D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_95d000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9856988c26afb5dcd2db822d9b069efb22f1014a8eb50071ef15147332477c2d
Instruction ID: 2db1f6e87a1c7e9918273893fa7e5ff19455e4fe443e9f6e5d643d04834871bb
Opcode Fuzzy Hash: 9856988c26afb5dcd2db822d9b069efb22f1014a8eb50071ef15147332477c2d
Instruction Fuzzy Hash: 20214271500200DFCB21DF14D9C0B2ABF69FB98319F20C569EC090B25AC33AD84ACBA2

Function 0096D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784486033.000000000096D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0096D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_96d000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c319060913a7df879c2184356c5d57a782bbfc98279b0e42757902444e00b4
Instruction ID: bee8a7eef39750778e0e68b437a53049fd46eb7950d30e9f8ead4dacc1c9d91f
Opcode Fuzzy Hash: 37c319060913a7df879c2184356c5d57a782bbfc98279b0e42757902444e00b4
Instruction Fuzzy Hash: 33210475A04240DFDB14DF14D9C4B26BFA9FB88314F24C96DE81A4B296C33BD847CAA1

Function 0096D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784486033.000000000096D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0096D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_96d000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bb6adb97a9833e5b680fa73ab8f8c55c3f2515400a10d65a782b70c07f27dfc
Instruction ID: e0a0df9807eeba5b961e92576d0af33683925a428db141637dda9c16d2ef58f3
Opcode Fuzzy Hash: 2bb6adb97a9833e5b680fa73ab8f8c55c3f2515400a10d65a782b70c07f27dfc
Instruction Fuzzy Hash: 99215E755093808FDB12CF24D994B15BF71EB46314F28C5EAD8498F6A7C33A980ACB62

Function 0095D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784447940.000000000095D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0095D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_95d000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: a4054b9ab832bf5919886f06b2a44e348a4f9d9efe6536363ff6181a8965a46a
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: E311D376504280CFDB16CF14D5C4B16BF71FB94318F24C6A9EC490B65AC336D85ACBA1

Function 0095D989 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784447940.000000000095D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0095D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_95d000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7e7762a4a17faf913528227749bfbb34ccf11fcb1f1bc5abcc5eeae8c9c767d
Instruction ID: c877aeb7eec27d6679e0ca66181e0f1a8082c0b14debe72943f501e1e68f2c3c
Opcode Fuzzy Hash: b7e7762a4a17faf913528227749bfbb34ccf11fcb1f1bc5abcc5eeae8c9c767d
Instruction Fuzzy Hash: 9301F73100B3409AE720DA1BC984767BF9CEF51325F18C92AED094A286C6799844C772

Function 0095D988 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784447940.000000000095D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0095D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_95d000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a401500237454317d69988720eb168d3e143da33c69d5c862e83a9577ad9447
Instruction ID: a4a85e62e58ea8ef4a7ce24a6d865a6e04611e102208abfaf615a9634aa8a622
Opcode Fuzzy Hash: 8a401500237454317d69988720eb168d3e143da33c69d5c862e83a9577ad9447
Instruction Fuzzy Hash: 39F0F671006340AEE7208A1ACCC4B62FFACEF51735F18C55AED484F286C2799C44CBB1

Non-executed Functions

Function 024DDC74 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1784956326.00000000024D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24d0000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f248ff3e0563f93b80d94eaf3620da3413475a1bb60d2b423eba93101cc1c83b
Instruction ID: 9db4122bba2b3f9963ead497c5424adc05a36713a1c0d020be487d99629b0960
Opcode Fuzzy Hash: f248ff3e0563f93b80d94eaf3620da3413475a1bb60d2b423eba93101cc1c83b
Instruction Fuzzy Hash: CDA16A32E00219CFCF19DFB5C89059EB7B2FF85304B15856AE806AB265DB71E955CB80

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report build.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\build.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Statistics

Windows Analysis Report
build.exe

Function 024DD0A8 Relevance: 6.1, APIs: 4, Instructions: 131
threadCOMMON

Function 024DD0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 024DAE30 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Function 024D5935 Relevance: 1.6, APIs: 1, Instructions: 100
COMMON

Function 024D4248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 024DD2F9 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 024DD300 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 024DB020 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON