Edit tour

Windows Analysis Report
uFVtW2gkkN.exe

Overview

General Information

Sample name:	uFVtW2gkkN.exe renamed because original name is a hash value
Original sample name:	0c8cf3050320256cbdcc32691f38181ec71a700e.exe
Analysis ID:	1582811
MD5:	ae16de1c6c9e15f640b4d4b04310c4be
SHA1:	0c8cf3050320256cbdcc32691f38181ec71a700e
SHA256:	3e1fd18a294c1e2903cce49b29b42fe5669043c6f4a7f2b4bae865b7cbc0169e
Tags:	exeuser-NDA0E
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected RedLine Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

uFVtW2gkkN.exe (PID: 7396 cmdline: "C:\Users\user\Desktop\uFVtW2gkkN.exe" MD5: AE16DE1C6C9E15F640B4D4B04310C4BE)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["185.81.68.147:1912"], "Bot Id": "FJCX", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
uFVtW2gkkN.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
uFVtW2gkkN.exe	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x24cc3:$gen01: ChromeGetRoamingName 0x24ce8:$gen02: ChromeGetLocalName 0x24d2b:$gen03: get_UserDomainName 0x28bc4:$gen04: get_encrypted_key 0x27943:$gen05: browserPaths 0x27c19:$gen06: GetBrowsers 0x27501:$gen07: get_InstalledInputLanguages 0x239cc:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x3018:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x29006:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x290a4:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x296f2:$spe9: wallet 0x219ea:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x21f14:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x21fc1:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x21998:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x219c1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x21b92:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x21de5:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x220d4:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1683183240.00000000001A2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: uFVtW2gkkN.exe PID: 7396	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: uFVtW2gkkN.exe PID: 7396	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.uFVtW2gkkN.exe.1a0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.0.uFVtW2gkkN.exe.1a0000.0.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x24cc3:$gen01: ChromeGetRoamingName 0x24ce8:$gen02: ChromeGetLocalName 0x24d2b:$gen03: get_UserDomainName 0x28bc4:$gen04: get_encrypted_key 0x27943:$gen05: browserPaths 0x27c19:$gen06: GetBrowsers 0x27501:$gen07: get_InstalledInputLanguages 0x239cc:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x3018:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x29006:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x290a4:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x296f2:$spe9: wallet 0x219ea:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x21f14:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x21fc1:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x21998:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x219c1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x21b92:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x21de5:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x220d4:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13

Suricata Signatures

ET MALWARE Redline Stealer TCP CnC - Id1Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T15:04:23.074928+0100	2043234	1	A Network Trojan was detected	185.81.68.147	1912	192.168.2.4	49730	TCP

ET MALWARE Redline Stealer TCP CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T15:04:22.839306+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:28.374638+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:29.131904+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:29.488711+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:29.717720+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:29.943598+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:30.234409+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:30.239422+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:31.317347+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:31.538913+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:31.955774+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:32.262007+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:32.485963+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:33.253623+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:33.517140+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:33.870322+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:34.117321+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:34.432249+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:34.654092+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:34.877445+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:35.124264+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:35.342912+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:35.562204+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:35.830981+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49730	185.81.68.147	1912	TCP

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T15:04:29.136762+0100	2046056	1	A Network Trojan was detected	185.81.68.147	1912	192.168.2.4	49730	TCP

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T15:04:22.839306+0100	2046045	1	A Network Trojan was detected	192.168.2.4	49730	185.81.68.147	1912	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: uFVtW2gkkN.exe

Malware Configuration Extractor: RedLine {"C2 url": ["185.81.68.147:1912"], "Bot Id": "FJCX", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Multi AV Scanner detection for submitted file

Source: uFVtW2gkkN.exe	Virustotal: Detection: 72%			Perma Link
Source: uFVtW2gkkN.exe	ReversingLabs: Detection: 78%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: uFVtW2gkkN.exe

Joe Sandbox ML: detected

Source: uFVtW2gkkN.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: uFVtW2gkkN.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdbX source: uFVtW2gkkN.exe, 00000000.00000002.1830769693.0000000000881000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ServiceModel.pdb> source: uFVtW2gkkN.exe, 00000000.00000002.1840317069.00000000067C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ServiceModel.pdb source: uFVtW2gkkN.exe, 00000000.00000002.1830769693.00000000008EF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb source: uFVtW2gkkN.exe, 00000000.00000002.1830769693.0000000000881000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Code function: 4x nop then jmp 051E6CEFh	0_2_051E6590
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	0_2_051E7110
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Code function: 4x nop then jmp 051EA3A0h	0_2_051E9EA8
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Code function: 4x nop then jmp 051E7B44h	0_2_051E7880

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2043231 - Severity 1 - ET MALWARE Redline Stealer TCP CnC Activity : 192.168.2.4:49730 -> 185.81.68.147:1912
Source: Network traffic	Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.4:49730 -> 185.81.68.147:1912
Source: Network traffic	Suricata IDS: 2043234 - Severity 1 - ET MALWARE Redline Stealer TCP CnC - Id1Response : 185.81.68.147:1912 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 185.81.68.147:1912 -> 192.168.2.4:49730

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 185.81.68.147:1912

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 185.81.68.147:1912

Source: Joe Sandbox View

IP Address: 185.81.68.147 185.81.68.147

Source: Joe Sandbox View

ASN Name: KLNOPT-ASFI KLNOPT-ASFI

Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147

Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: uFVtW2gkkN.exe, 00000000.00000002.1830369212.000000000069E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://purl.oen
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002757000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002757000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002757000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/System.ServiceModel
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002757000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/System.ServiceModelD
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002757000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/System.ServiceModeld
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002757000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/:hardwares.
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1831584041.00000000027BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.00000000027BF000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002757000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002757000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1833894503.00000000037EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002757000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002757000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002757000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002757000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.00000000027BF000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002746000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002757000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.000000000274E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: uFVtW2gkkN.exe, 00000000.00000002.1833894503.000000000369A000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1833894503.000000000367F000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1833894503.00000000037EF000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1833894503.00000000037D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: uFVtW2gkkN.exe	String found in binary or memory: https://api.ip.sb/ip
Source: uFVtW2gkkN.exe, 00000000.00000002.1833894503.000000000369A000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1833894503.000000000367F000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1833894503.00000000037EF000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1833894503.00000000037D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: uFVtW2gkkN.exe, 00000000.00000002.1833894503.000000000369A000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1833894503.000000000367F000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1833894503.00000000037EF000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1833894503.00000000037D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: uFVtW2gkkN.exe, 00000000.00000002.1833894503.000000000369A000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1833894503.000000000367F000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1833894503.00000000037EF000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1833894503.00000000037D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: uFVtW2gkkN.exe, 00000000.00000002.1833894503.000000000369A000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1833894503.000000000367F000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1833894503.00000000037EF000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1833894503.00000000037D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: uFVtW2gkkN.exe, 00000000.00000002.1833894503.000000000369A000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1833894503.00000000037EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: uFVtW2gkkN.exe, 00000000.00000002.1833894503.000000000367F000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1833894503.00000000037D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabS
Source: uFVtW2gkkN.exe, 00000000.00000002.1833894503.000000000369A000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1833894503.000000000367F000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1833894503.00000000037EF000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1833894503.00000000037D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: uFVtW2gkkN.exe, 00000000.00000002.1833894503.000000000369A000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1833894503.000000000367F000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1833894503.00000000037EF000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1833894503.00000000037D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: uFVtW2gkkN.exe, 00000000.00000002.1833894503.000000000369A000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1833894503.000000000367F000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1833894503.00000000037EF000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1833894503.00000000037D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

System Summary

Malicious sample detected (through community Yara rule)

Source: uFVtW2gkkN.exe, type: SAMPLE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.0.uFVtW2gkkN.exe.1a0000.0.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io

Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Code function: 0_2_00ACDC74	0_2_00ACDC74
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Code function: 0_2_051E6590	0_2_051E6590
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Code function: 0_2_051E8718	0_2_051E8718
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Code function: 0_2_051E7110	0_2_051E7110
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Code function: 0_2_051E7C98	0_2_051E7C98
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Code function: 0_2_051EBCB8	0_2_051EBCB8
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Code function: 0_2_051ECE08	0_2_051ECE08
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Code function: 0_2_051E9EA8	0_2_051E9EA8
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Code function: 0_2_051E7100	0_2_051E7100
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Code function: 0_2_051E2D2F	0_2_051E2D2F
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Code function: 0_2_051E2D59	0_2_051E2D59
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Code function: 0_2_051E2D68	0_2_051E2D68
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Code function: 0_2_051E48A0	0_2_051E48A0
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Code function: 0_2_051E5BC0	0_2_051E5BC0
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Code function: 0_2_07130778	0_2_07130778

Source: uFVtW2gkkN.exe, 00000000.00000002.1830769693.000000000084E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs uFVtW2gkkN.exe
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002757000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefirefox.exe0 vs uFVtW2gkkN.exe
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002757000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $dq,\\StringFileInfo\\000004B0\\OriginalFilename vs uFVtW2gkkN.exe
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002757000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamechrome.exe< vs uFVtW2gkkN.exe
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002757000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $dq,\\StringFileInfo\\040904B0\\OriginalFilename vs uFVtW2gkkN.exe
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002757000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIEXPLORE.EXE.MUID vs uFVtW2gkkN.exe
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002757000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIEXPLORE.EXED vs uFVtW2gkkN.exe
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002757000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $dq,\\StringFileInfo\\080904B0\\OriginalFilename vs uFVtW2gkkN.exe
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002757000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsedge.exe> vs uFVtW2gkkN.exe
Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs uFVtW2gkkN.exe
Source: uFVtW2gkkN.exe, 00000000.00000000.1683224204.00000000001E6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs uFVtW2gkkN.exe
Source: uFVtW2gkkN.exe	Binary or memory string: OriginalFilenameSteanings.exe8 vs uFVtW2gkkN.exe

Source: uFVtW2gkkN.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: uFVtW2gkkN.exe, type: SAMPLE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.0.uFVtW2gkkN.exe.1a0000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/1@0/1

Source: C:\Users\user\Desktop\uFVtW2gkkN.exe

File created: C:\Users\user\AppData\Local\SystemCache

Jump to behavior

Source: C:\Users\user\Desktop\uFVtW2gkkN.exe

Mutant created: NULL

Source: uFVtW2gkkN.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: uFVtW2gkkN.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\uFVtW2gkkN.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002AC4000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002AD3000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002AAD000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002B55000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: uFVtW2gkkN.exe	Virustotal: Detection: 72%
Source: uFVtW2gkkN.exe	ReversingLabs: Detection: 78%

Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Section loaded: ntasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\uFVtW2gkkN.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: uFVtW2gkkN.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: uFVtW2gkkN.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdbX source: uFVtW2gkkN.exe, 00000000.00000002.1830769693.0000000000881000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ServiceModel.pdb> source: uFVtW2gkkN.exe, 00000000.00000002.1840317069.00000000067C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ServiceModel.pdb source: uFVtW2gkkN.exe, 00000000.00000002.1830769693.00000000008EF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb source: uFVtW2gkkN.exe, 00000000.00000002.1830769693.0000000000881000.00000004.00000020.00020000.00000000.sdmp

Source: uFVtW2gkkN.exe

Static PE information: 0xD22848DC [Tue Sep 23 12:17:32 2081 UTC]

Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Code function: 0_2_051E5720 push es; ret	0_2_051E5750
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Code function: 0_2_051E5670 push es; ret	0_2_051E5750
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Code function: 0_2_051E8031 push D005DB0Ah; retf	0_2_051E803D
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Code function: 0_2_051E3AD7 push ebx; retf	0_2_051E3ADA

Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\uFVtW2gkkN.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\uFVtW2gkkN.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Memory allocated: 820000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Memory allocated: 2580000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Memory allocated: 4580000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Window / User API: threadDelayed 991			Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Window / User API: threadDelayed 3665			Jump to behavior

Source: C:\Users\user\Desktop\uFVtW2gkkN.exe TID: 7544	Thread sleep time: -11068046444225724s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe TID: 7416	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\uFVtW2gkkN.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: uFVtW2gkkN.exe, 00000000.00000002.1830769693.000000000092C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllS

Source: C:\Users\user\Desktop\uFVtW2gkkN.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\uFVtW2gkkN.exe

Code function: 0_2_051E8718 LdrInitializeThunk,

0_2_051E8718

Source: C:\Users\user\Desktop\uFVtW2gkkN.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\uFVtW2gkkN.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Queries volume information: C:\Users\user\Desktop\uFVtW2gkkN.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\uFVtW2gkkN.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: uFVtW2gkkN.exe, type: SAMPLE
Source: Yara match	File source: 0.0.uFVtW2gkkN.exe.1a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1683183240.00000000001A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: uFVtW2gkkN.exe PID: 7396, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\uFVtW2gkkN.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match

File source: Process Memory Space: uFVtW2gkkN.exe PID: 7396, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: uFVtW2gkkN.exe, type: SAMPLE
Source: Yara match	File source: 0.0.uFVtW2gkkN.exe.1a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1683183240.00000000001A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: uFVtW2gkkN.exe PID: 7396, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Masquerading	1 OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	113 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
uFVtW2gkkN.exe	72%	Virustotal		Browse
uFVtW2gkkN.exe	78%	ReversingLabs	ByteCode-MSIL.Trojan.RedLineStealz
uFVtW2gkkN.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://schemas.datacontract.org/2004/07/System.ServiceModeld	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/System.ServiceModel	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
185.81.68.147:1912	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	uFVtW2gkkN.exe, 00000000.00000002.1833894503.000000000369A000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1833894503.00000000037EF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	uFVtW2gkkN.exe, 00000000.00000002.1833894503.000000000369A000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1833894503.000000000367F000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1833894503.00000000037EF000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1833894503.00000000037D3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.datacontract.org	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002757000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id14ResponseD	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id23ResponseD	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002757000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id12Response	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.datacontract.org/2004/07/System.ServiceModeld	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002757000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id2Response	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21Response	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002757000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id6ResponseD	uFVtW2gkkN.exe, 00000000.00000002.1831584041.00000000027BF000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id5	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id4	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id7	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002746000.00000004.00000800.00020000.00000000.sdmp	false		high
http://purl.oen	uFVtW2gkkN.exe, 00000000.00000002.1830369212.000000000069E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id6	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id19Response	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13ResponseD	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002757000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15Response	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id5ResponseD	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id6Response	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/ip	uFVtW2gkkN.exe	false		high
http://schemas.datacontract.org/2004/07/	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002757000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/sc	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id1ResponseD	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9Response	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	uFVtW2gkkN.exe, 00000000.00000002.1833894503.000000000369A000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1833894503.000000000367F000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1833894503.00000000037EF000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1833894503.00000000037D3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id20	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1833894503.00000000037EF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id22	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id23	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.datacontract.org/2004/07/System.ServiceModel	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002757000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id24Response	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	uFVtW2gkkN.exe, 00000000.00000002.1833894503.000000000369A000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1833894503.000000000367F000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1833894503.00000000037EF000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1833894503.00000000037D3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id1Response	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21ResponseD	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002757000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id11	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1831584041.00000000027BF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id12	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id16Response	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id14	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id16	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id17	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id18	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id5Response	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id19	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15ResponseD	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10Response	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id11ResponseD	uFVtW2gkkN.exe, 00000000.00000002.1831584041.00000000027BF000.00000004.00000800.00020000.00000000.sdmp, uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8Response	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	uFVtW2gkkN.exe, 00000000.00000002.1831584041.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.81.68.147	unknown	Finland		50108	KLNOPT-ASFI	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582811
Start date and time:	2024-12-31 15:03:28 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	uFVtW2gkkN.exe renamed because original name is a hash value
Original Sample Name:	0c8cf3050320256cbdcc32691f38181ec71a700e.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/1@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 26 Number of non-executed functions: 6
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:04:32	API Interceptor	24x Sleep call for process: uFVtW2gkkN.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.81.68.147	52kYJGCon6.exe	Get hash	malicious	MicroClip	Browse	185.81.68.147/data.php
	CwQQqCmqkY.exe	Get hash	malicious	MicroClip	Browse	185.81.68.147/gg.php
	uFVgJVXaEU.exe	Get hash	malicious	RedLine	Browse	185.81.68.147/VzCAHn.php?2F409E82DCA61388941053
	m5804Te9Uw.exe	Get hash	malicious	RedLine	Browse	185.81.68.147/VzCAHn.php?443320E440F81953448019
	3Qv3xyyL5G.exe	Get hash	malicious	RedLine	Browse	185.81.68.147/VzCAHn.php?65D35BAB97073674480464
	K6qneGSDSB.exe	Get hash	malicious	Babadeda, RedLine	Browse	185.81.68.147/VzCAHn.php?616766F8886C145454191
	file.exe	Get hash	malicious	Amadey, AsyncRAT, HVNC, LummaC Stealer, RedLine, Stealc	Browse	185.81.68.147/tizhyf/gate.php?232B06DEE822786254513
	mggoBrtk9t.exe	Get hash	malicious	Amadey, RedLine	Browse	185.81.68.147/7vhfjke3/index.php
	D72j5I83wU.dll	Get hash	malicious	Amadey	Browse	185.81.68.147/7vhfjke3/index.php
	D72j5I83wU.dll	Get hash	malicious	Amadey	Browse	185.81.68.147/7vhfjke3/index.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
KLNOPT-ASFI	nXkktDu3Fp.exe	Get hash	malicious	RedLine	Browse	185.81.68.147
	52kYJGCon6.exe	Get hash	malicious	MicroClip	Browse	185.81.68.147
	CwQQqCmqkY.exe	Get hash	malicious	MicroClip	Browse	185.81.68.147
	uFVgJVXaEU.exe	Get hash	malicious	RedLine	Browse	185.81.68.147
	m5804Te9Uw.exe	Get hash	malicious	RedLine	Browse	185.81.68.147
	3Qv3xyyL5G.exe	Get hash	malicious	RedLine	Browse	185.81.68.147
	K6qneGSDSB.exe	Get hash	malicious	Babadeda, RedLine	Browse	185.81.68.147
	file.exe	Get hash	malicious	Amadey, AsyncRAT, HVNC, LummaC Stealer, RedLine, Stealc	Browse	185.81.68.147
	mggoBrtk9t.exe	Get hash	malicious	Amadey, RedLine	Browse	185.81.68.148
	D72j5I83wU.dll	Get hash	malicious	Amadey	Browse	185.81.68.148

Process:	C:\Users\user\Desktop\uFVtW2gkkN.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3293
Entropy (8bit):	5.3364558769830905
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymTqdqlq7qqjqcEZ5sql:Pq5qHwCYqh3qtI6eqzxP0atTqdqlq7qp
MD5:	4597EFE428DB18BB65EEC00E0E0EC7B1
SHA1:	FC763F5655835DFA6E032D20FE81DE058DB88509
SHA-256:	CC68860A21A25EDB4BDE922B5E4C1AC0D9735D5E189387E8CDC2466EEE8DEDFE
SHA-512:	EE25B64D8221DAAFABA5908002725D8A9E5D851CC77D752C66A5572773A9F087C210D9C53CBC1A63C0BEFE99616D27D1373170BD6716BEC743ADD7BE5C66E07E
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.0819550541134895
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	uFVtW2gkkN.exe
File size:	307'712 bytes
MD5:	ae16de1c6c9e15f640b4d4b04310c4be
SHA1:	0c8cf3050320256cbdcc32691f38181ec71a700e
SHA256:	3e1fd18a294c1e2903cce49b29b42fe5669043c6f4a7f2b4bae865b7cbc0169e
SHA512:	e42b0cd82857484ed0a796c767fd7c9cfdef637d6fba9759be52c124c90eea69f0a19a10bdaf2f17efaabb2e9ee69a9f771a3f3fc394c5b79cc89462f1351f37
SSDEEP:	3072:2cZqf7D341p/0+mAIkygIQQUgWsB1fA0PuTVAtkxzE/3RoeqiOL2bBOA:2cZqf7DIvnyjPB1fA0GTV8k6oL
TLSH:	E4645A5833E8C910DA7F4775D861D67093B0BCA3A556E70B4FC4ACAB3D32740EA50AB6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....H(...............0.................. ... ....@.. ....................... ............@................................

File Icon


Icon Hash:	4d8ea38d85a38e6d

Static PE Info

General

Entrypoint:	0x4302be
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xD22848DC [Tue Sep 23 12:17:32 2081 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x30270	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x32000	0x1c9c6	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x50000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x2e2c4	0x2e400	7732cc4b9685e9b7fa87f008dccb9dbc	False	0.47498416385135134	data	6.1870426495782525	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x32000	0x1c9c6	0x1ca00	a8cf3f8ff27a4a736ba8fb433d91107f	False	0.2380765556768559	data	2.615031395625776	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x50000	0xc	0x200	b930e640a53471bfabaa3c1506fb3c25	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x32220	0x3d04	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9934058898847631
RT_ICON	0x35f24	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2835 x 2835 px/m	0.09013072282030049
RT_ICON	0x4674c	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2835 x 2835 px/m	0.13905290505432216
RT_ICON	0x4a974	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2835 x 2835 px/m	0.17033195020746889
RT_ICON	0x4cf1c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2835 x 2835 px/m	0.2045028142589118
RT_ICON	0x4dfc4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2835 x 2835 px/m	0.24645390070921985
RT_GROUP_ICON	0x4e42c	0x5a	data	0.7666666666666667
RT_VERSION	0x4e488	0x352	data	0.4447058823529412
RT_MANIFEST	0x4e7dc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-31T15:04:22.839306+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:22.839306+0100	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	1	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:23.074928+0100	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	1	185.81.68.147	1912	192.168.2.4	49730	TCP
2024-12-31T15:04:28.374638+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:29.131904+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:29.136762+0100	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	185.81.68.147	1912	192.168.2.4	49730	TCP
2024-12-31T15:04:29.488711+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:29.717720+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:29.943598+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:30.234409+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:30.239422+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:31.317347+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:31.538913+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:31.955774+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:32.262007+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:32.485963+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:33.253623+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:33.517140+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:33.870322+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:34.117321+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:34.432249+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:34.654092+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:34.877445+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:35.124264+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:35.342912+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:35.562204+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49730	185.81.68.147	1912	TCP
2024-12-31T15:04:35.830981+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49730	185.81.68.147	1912	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 31, 2024 15:04:22.096101999 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:22.101038933 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:22.101164103 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:22.110114098 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:22.114918947 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:22.804653883 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:22.839306116 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:22.844238043 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:23.074928045 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:23.130440950 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:28.374638081 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:28.379529953 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:28.594840050 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:28.594928026 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:28.594979048 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:28.595006943 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:28.595029116 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:28.595041037 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:28.595047951 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:28.595110893 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:29.131903887 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:29.136761904 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:29.352375031 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:29.396096945 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:29.488711119 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:29.493597031 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:29.709424973 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:29.717720032 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:29.722613096 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:29.722636938 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:29.722649097 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:29.722708941 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:29.941241026 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:29.943598032 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:29.948471069 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.162069082 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.208554029 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.234409094 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.239331007 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.239356995 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.239370108 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.239382029 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.239401102 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.239422083 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.239485979 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.239518881 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.239537001 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.239567995 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.239576101 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.239586115 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.239615917 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.244010925 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.244021893 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.244045019 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.244054079 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.244069099 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.244076014 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.244126081 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.244126081 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.244175911 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.244184971 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.244220972 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.244226933 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.244271040 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.244426012 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.244436026 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.244446993 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.244467974 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.244489908 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.244493961 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.244515896 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.244520903 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.244551897 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.244586945 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.248785019 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.248816967 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.248853922 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.248877048 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.248897076 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.248905897 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.248960018 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.248975039 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.248984098 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.249033928 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.249135017 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.249186039 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.249257088 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.249265909 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.249291897 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.249300957 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.249313116 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.249334097 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.249342918 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.249342918 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.249361992 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.249363899 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.249381065 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.249383926 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.249392033 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.249403000 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.249475002 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.249483109 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.249495029 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.249504089 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.249525070 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.249535084 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.249552965 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.249576092 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.249586105 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.249594927 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.249598980 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.249629021 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.249636889 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.249639034 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.249649048 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.249660015 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.249684095 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.249686956 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.249696016 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.249707937 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.249708891 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.249717951 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.249744892 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.249772072 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.253580093 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.253588915 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.253648996 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.253654957 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.253658056 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.253670931 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.253710032 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.253724098 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.253784895 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.253797054 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.253827095 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.253921986 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.253941059 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.253950119 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.253968954 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.253976107 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.253983974 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.253995895 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254014969 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254023075 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254051924 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254060030 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254097939 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254106045 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254123926 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254132032 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254167080 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254175901 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254206896 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254235029 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254266024 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254302979 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254326105 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254342079 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254391909 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254400015 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254426956 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254435062 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254551888 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254559994 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254574060 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254591942 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254604101 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254611015 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254622936 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254630089 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254652023 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254659891 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254667997 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254676104 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254687071 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254694939 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254714966 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254724026 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254730940 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254743099 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254764080 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254771948 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254806995 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.254848957 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254858017 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254864931 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.254884005 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.254892111 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.255019903 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.255028963 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.255039930 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.255055904 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.255067110 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.255074978 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.255085945 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.255094051 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.255120039 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.255127907 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.255156040 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.255163908 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.255198956 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.255211115 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.255234957 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.255243063 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.255274057 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.255281925 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.255300045 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.258445024 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.258721113 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.258734941 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.258847952 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.258862972 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.258872032 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.258888006 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.258892059 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.258907080 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.258915901 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.258919001 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.258955002 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.259218931 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.259294987 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.259615898 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.259762049 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.259772062 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.259860992 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.259870052 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.259907961 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.259917974 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260015011 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260021925 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260035992 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260052919 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260066032 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260102034 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260121107 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260155916 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260164976 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260190964 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260200024 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260221004 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260230064 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260250092 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260252953 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260320902 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260348082 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260375023 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260385036 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260416985 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260525942 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260534048 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260546923 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260555983 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260565042 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260571003 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260581017 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260592937 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260615110 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260626078 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260653019 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260664940 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260673046 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260679960 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260696888 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260705948 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260719061 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260726929 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260740042 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260762930 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260790110 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260808945 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260817051 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260833025 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260842085 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260867119 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.260875940 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.261147022 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.261230946 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.264038086 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.264162064 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.264172077 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.264292955 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.264302015 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.264322042 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.264362097 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.264439106 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.264446974 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.264503956 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.264513016 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.264586926 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.264595985 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.264714956 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.264730930 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.264740944 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.264753103 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.264770031 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.264780998 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.264791965 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.264807940 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.264816999 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.264828920 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.264870882 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.264884949 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.264904022 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.264911890 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.264933109 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.264940977 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.264954090 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.264962912 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.265078068 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.265086889 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.265094042 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.265096903 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.265100002 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.265104055 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.265108109 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.265110970 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.265144110 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.265153885 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.265173912 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.265182018 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.265235901 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.265244961 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.265255928 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.265266895 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.265288115 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.265295982 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.265314102 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.265324116 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.265326977 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.265341043 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.265361071 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.265614986 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.265700102 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.266067028 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.266079903 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.266125917 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.266134977 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.266205072 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.266216040 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.266324997 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.266334057 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.266352892 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.266366005 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.266460896 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.266472101 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.266509056 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.266515970 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.266549110 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.266558886 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.266617060 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.266627073 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.266640902 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.266649008 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.266669989 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.266683102 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.266685963 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.266690016 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.266693115 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.266695976 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.266720057 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.266724110 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.266727924 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.266738892 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.266807079 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.266815901 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.266853094 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.266860008 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.266864061 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.266891003 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.266912937 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.266922951 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.266936064 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.267075062 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.267102957 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.267123938 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.267132998 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.267153025 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.267163992 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.267178059 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.267185926 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.267196894 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.267210007 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.267219067 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.267230988 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.267239094 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.267258883 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.270503044 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.270519018 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.270550013 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.270559072 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.270605087 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.270613909 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.270636082 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.270684004 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.270734072 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.270746946 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.270747900 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.270768881 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.270819902 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.270833969 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.270843983 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.270852089 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.270880938 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.270891905 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.270919085 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.270931005 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.270982027 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.270991087 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.271015882 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.271024942 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.271059990 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.271068096 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.271106005 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.271115065 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.271138906 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.271147013 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.271173954 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.271183014 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.271207094 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.271214962 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.271223068 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.271239042 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.271276951 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.271286011 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.271323919 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.271336079 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.271346092 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.271353960 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.271375895 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.271388054 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.271399021 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.271410942 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.271428108 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.271440029 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.271467924 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.271544933 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.271553993 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.271565914 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.271580935 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.271590948 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.271596909 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.275619984 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.275755882 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.275763988 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.275778055 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.275785923 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.275806904 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.275815964 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.275840044 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.275849104 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.275878906 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.275935888 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.275990009 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276000023 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276036024 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276043892 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276077986 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276096106 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276129007 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276137114 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276222944 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276231050 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276284933 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276293993 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276324034 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276331902 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276494026 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276503086 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276524067 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276532888 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276546955 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276557922 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276624918 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276637077 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276649952 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276660919 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276673079 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276680946 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276684999 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276696920 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276719093 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276726961 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276740074 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276747942 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276768923 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276777983 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276788950 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276798010 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276808977 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276818991 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276830912 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276838064 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276859999 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276868105 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276875973 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.276889086 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.280781031 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.280797005 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.281080008 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.281147957 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.326881886 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:30.327124119 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:30.375005007 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:31.309412003 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:31.317347050 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:31.322109938 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:31.535662889 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:31.538913012 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:31.543698072 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:31.954586029 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:31.955774069 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:31.962055922 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:32.174398899 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:32.224212885 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:32.262006998 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:32.266854048 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:32.481069088 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:32.485963106 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:32.490770102 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:32.704220057 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:32.755410910 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:33.253623009 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:33.258558035 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:33.258574963 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:33.258590937 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:33.472893000 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:33.517139912 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:33.522002935 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:33.735528946 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:33.786665916 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:33.870321989 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:33.875230074 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:33.875246048 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:33.875269890 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:33.875283957 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:33.875307083 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:33.875329018 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:33.875349998 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:33.875361919 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:33.875375032 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:33.875386953 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:33.875408888 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:33.875423908 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:33.875439882 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:33.875462055 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:33.875473022 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:33.875488043 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:33.875500917 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:34.091449976 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:34.117321014 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:34.122108936 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:34.338077068 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:34.338090897 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:34.338154078 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:34.338182926 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:34.338207960 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:34.338216066 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:34.338222980 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:34.338265896 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:34.338294983 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:34.432249069 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:34.437160015 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:34.650283098 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:34.654092073 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:34.658945084 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:34.872296095 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:34.877444983 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:34.882296085 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:35.096738100 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:35.124264002 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:35.129134893 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:35.342298985 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:35.342911959 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:35.347695112 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:35.561168909 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:35.562203884 CET	49730	1912	192.168.2.4	185.81.68.147
Dec 31, 2024 15:04:35.567064047 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:35.781006098 CET	1912	49730	185.81.68.147	192.168.2.4
Dec 31, 2024 15:04:35.830981016 CET	49730	1912	192.168.2.4	185.81.68.147

Target ID:	0
Start time:	09:04:20
Start date:	31/12/2024
Path:	C:\Users\user\Desktop\uFVtW2gkkN.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\uFVtW2gkkN.exe"
Imagebase:	0x1a0000
File size:	307'712 bytes
MD5 hash:	AE16DE1C6C9E15F640B4D4B04310C4BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000000.1683183240.00000000001A2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	5.1%
Total number of Nodes:	79
Total number of Limit Nodes:	15

Executed Functions

Function 051EBCB8 Relevance: 6.6, Strings: 5, Instructions: 388
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hhq, xrefs: 051EC068
Hhq, xrefs: 051EC158
Hhq, xrefs: 051EC099
Hhq, xrefs: 051EC0CA
Hhq, xrefs: 051EC111

Memory Dump Source

Source File: 00000000.00000002.1838582680.00000000051E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_51e0000_uFVtW2gkkN.jbxd

Similarity

API ID:
String ID: Hhq$Hhq$Hhq$Hhq$Hhq
API String ID: 0-1427472961
Opcode ID: 0e3aeee82a456de9a79b12eb1cbbe367693cd502607b0b4fb88af3e7358054c2
Instruction ID: aa53e2354e4b0034419233f50d157863eba64da81ff533cbf3f478a00307cac2
Opcode Fuzzy Hash: 0e3aeee82a456de9a79b12eb1cbbe367693cd502607b0b4fb88af3e7358054c2
Instruction Fuzzy Hash: D3F1AE75E04656CBCB29CF74C4502BDFBB3BF85300F29C669D506AB241EB789A85CB90

Function 051E7110 Relevance: 5.3, Strings: 4, Instructions: 271
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$dq, xrefs: 051E7371
$dq, xrefs: 051E735B
$dq, xrefs: 051E72AB
$dq, xrefs: 051E72C1

Memory Dump Source

Source File: 00000000.00000002.1838582680.00000000051E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_51e0000_uFVtW2gkkN.jbxd

Similarity

API ID:
String ID: $dq$$dq$$dq$$dq
API String ID: 0-185584874
Opcode ID: 0ed284fa56f44b3adbf01db638ea8f09b6ff59d19eb335b1377c3435b335a33d
Instruction ID: a48b011da92113317425bca5b873bcdd83d8753fb5feaa4748d07056a2afc7f8
Opcode Fuzzy Hash: 0ed284fa56f44b3adbf01db638ea8f09b6ff59d19eb335b1377c3435b335a33d
Instruction Fuzzy Hash: 75C1D870E05658CFEB68DFA5C990B9EBBB2FF49300F208169D409AB295DB345D86CF50

Function 07130778 Relevance: 3.1, Strings: 2, Instructions: 626
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0V}, xrefs: 07130E6C
0V}, xrefs: 07130E47

Memory Dump Source

Source File: 00000000.00000002.1842191388.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_uFVtW2gkkN.jbxd

Similarity

API ID:
String ID: 0V}$0V}
API String ID: 0-670342930
Opcode ID: dfd34f96816ccdf26936bccabc6218dc6ce15b0a8e9314eae803e1a841bdf6f2
Instruction ID: e1b01be3ea5cea8245cac7800eedc437f9c996238fae93f695381c56302c62db
Opcode Fuzzy Hash: dfd34f96816ccdf26936bccabc6218dc6ce15b0a8e9314eae803e1a841bdf6f2
Instruction Fuzzy Hash: 59329BB0B012098FDB19DB69D550BAEBBF7AF88300F1544ADE50A9B3A1CB35ED01CB51

Function 051E9EA8 Relevance: 2.9, Strings: 2, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

., xrefs: 051EA128
1, xrefs: 051EA1AD

Memory Dump Source

Source File: 00000000.00000002.1838582680.00000000051E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_51e0000_uFVtW2gkkN.jbxd

Similarity

API ID:
String ID: .$1
API String ID: 0-1839485796
Opcode ID: b9c4d5894d0cca5417fe212069144ac3593114b59df442163cbaf6fe05c39dfd
Instruction ID: e30cc2104c7efd1847031d6858311c3821b9167ee5d48ec4c41fad4fd4bd57ac
Opcode Fuzzy Hash: b9c4d5894d0cca5417fe212069144ac3593114b59df442163cbaf6fe05c39dfd
Instruction Fuzzy Hash: B7F1DE74E01229CFDB68DF65C884B9DBBB2FF89301F5081A9D50AAB254DB319E85CF50

Function 051E7C98 Relevance: 2.7, Strings: 2, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$dq, xrefs: 051E7DFA
$dq, xrefs: 051E7DEA

Memory Dump Source

Source File: 00000000.00000002.1838582680.00000000051E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_51e0000_uFVtW2gkkN.jbxd

Similarity

API ID:
String ID: $dq$$dq
API String ID: 0-2340669324
Opcode ID: e4cc0631988f81cd168f67fa5b9e1458cc6b4b998cc3e29f9b9c9846598d33c4
Instruction ID: d7fb21756e8ff4f2d90f7b987bac7d8b538fbb39e43f2b8851902c1fcc05dc58
Opcode Fuzzy Hash: e4cc0631988f81cd168f67fa5b9e1458cc6b4b998cc3e29f9b9c9846598d33c4
Instruction Fuzzy Hash: BB91D674D01218CFDB18DFA9D594AADBBF2FF89301F608469E409AB354DB359982CF50

Function 051E8718 Relevance: 2.6, APIs: 1, Instructions: 1088
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1838582680.00000000051E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_51e0000_uFVtW2gkkN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bff317eaeeed4dc052cb9fde5aea7544117bc28513b3a7382431922b102cedd
Instruction ID: 4c62187779d1c2c3581e782b0c3335555ef00c0678f27ddbc7532ddabb0e0971
Opcode Fuzzy Hash: 5bff317eaeeed4dc052cb9fde5aea7544117bc28513b3a7382431922b102cedd
Instruction Fuzzy Hash: 36C28D74A022298FCB65DF24D998B9DB7B2FB89301F1085E9D40DA7365DB34AE85CF40

Function 051ECE08 Relevance: .8, Instructions: 814COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1838582680.00000000051E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_51e0000_uFVtW2gkkN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bfaf1e6e6d8ae1353e95af347515bed7b1e9e052443365cc6636e749e2e0a1e
Instruction ID: 403b979e64544c6ac6e0df39f7a89e3488b8f9fe4e67b572c58be9d1b7b64312
Opcode Fuzzy Hash: 5bfaf1e6e6d8ae1353e95af347515bed7b1e9e052443365cc6636e749e2e0a1e
Instruction Fuzzy Hash: A1829074604616CFDB65EF24E944F797BB2BF44304F1840AAD80A9B366EB309D46DFA0

Function 051E6590 Relevance: .4, Instructions: 426COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1838582680.00000000051E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_51e0000_uFVtW2gkkN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b03c67736f654d32b3b0ba5c7fa6b8c18b30b9f111a428b863669b24891f5d6
Instruction ID: 8102f5ea00100c5e15fadbc7db82622edba7f296022f2e244c2c4014c0166989
Opcode Fuzzy Hash: 4b03c67736f654d32b3b0ba5c7fa6b8c18b30b9f111a428b863669b24891f5d6
Instruction Fuzzy Hash: 2A228D74E016298FDB64DF64C890BDDB7B2BF99300F5081EAD549AB250EB306E85CF40

Function 051E7880 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1838582680.00000000051E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_51e0000_uFVtW2gkkN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa79f7b82cb8f601fd781836a45002e80408d7b1a8a69ae34e7d8dedde18717a
Instruction ID: 3d549e13d11321a9a4574c558b3ffefdb07f47007af33f713a08d98c7bfaec13
Opcode Fuzzy Hash: aa79f7b82cb8f601fd781836a45002e80408d7b1a8a69ae34e7d8dedde18717a
Instruction Fuzzy Hash: 4D91E274E01229CFDB64DFA8D984B9DBBB2BF49300F1085A9D509B7355EB30AA85CF41

Function 051E7100 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1838582680.00000000051E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_51e0000_uFVtW2gkkN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4257f4a558b57927c96fa6081c1ca5b9e208cfc7970056e6dca004d3eecf8290
Instruction ID: 7055bde8b8454304e6299be80c8f8bba83251a555966c80675e13082061a2c5c
Opcode Fuzzy Hash: 4257f4a558b57927c96fa6081c1ca5b9e208cfc7970056e6dca004d3eecf8290
Instruction Fuzzy Hash: F441C3B1E01608CBEB18DFA6D95469EBBF2FF89300F24C52AD409AB254DB345946CB50

Function 00ACD0A8 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00ACD136
GetCurrentThread.KERNEL32 ref: 00ACD173
GetCurrentProcess.KERNEL32 ref: 00ACD1B0
GetCurrentThreadId.KERNEL32 ref: 00ACD209

Memory Dump Source

Source File: 00000000.00000002.1831090541.0000000000AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_uFVtW2gkkN.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 81839c0fd4e5b9edd9478f17c1dcad43de0891c72677bdcf2954d92722a5b7f9
Instruction ID: 7a9d5adec451e0a5160d7afce1aaa07c599f2fb65e734ef13648fa66de6490d0
Opcode Fuzzy Hash: 81839c0fd4e5b9edd9478f17c1dcad43de0891c72677bdcf2954d92722a5b7f9
Instruction Fuzzy Hash: 355175B09003498FDB18DFAAD548B9EBFF1EF88310F24845DE009A73A0DB745988CB65

Function 00ACD0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00ACD136
GetCurrentThread.KERNEL32 ref: 00ACD173
GetCurrentProcess.KERNEL32 ref: 00ACD1B0
GetCurrentThreadId.KERNEL32 ref: 00ACD209

Memory Dump Source

Source File: 00000000.00000002.1831090541.0000000000AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_uFVtW2gkkN.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 184456fe6be141b9318f562a9dea6995272bd38f0b5a1ab0154f320712dc29af
Instruction ID: b043ee8f643e6f615e4b91ab06ecbdd13438be983b46439aab6f3262316d1d9d
Opcode Fuzzy Hash: 184456fe6be141b9318f562a9dea6995272bd38f0b5a1ab0154f320712dc29af
Instruction Fuzzy Hash: 935147B09003098FDB14DFAAD548B9EBBF1EF88310F25845DE419A73A0DB745988CF65

Function 00ACAE30 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00ACB086

Strings

0V}, xrefs: 00ACAFBE
0V}, xrefs: 00ACAFE3

Memory Dump Source

Source File: 00000000.00000002.1831090541.0000000000AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_uFVtW2gkkN.jbxd

Similarity

API ID: HandleModule
String ID: 0V}$0V}
API String ID: 4139908857-670342930
Opcode ID: 71ba27be3c39c040191ad5a6ca5e17a20f0dd6d208df488941e14e94295b5629
Instruction ID: 24ad38e050f3b3f3a237a89b352bdb16d47c62c63c09b3c06cece283767f0b03
Opcode Fuzzy Hash: 71ba27be3c39c040191ad5a6ca5e17a20f0dd6d208df488941e14e94295b5629
Instruction Fuzzy Hash: B9815AB0A00B098FD724DF29D145B6ABBF1FF98304F01892DE48AD7A50DB75E949CB91

Function 00AC5935 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00AC59F1

Memory Dump Source

Source File: 00000000.00000002.1831090541.0000000000AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_uFVtW2gkkN.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: c41dd19a5d90cfcd00f1d88f14f53b2c2c81abe4f1798f659c423542e6dd0433
Instruction ID: b5e31fbc8f8c29a47239d3add372c6406d29cfb97b752880c19f2bad22a490f5
Opcode Fuzzy Hash: c41dd19a5d90cfcd00f1d88f14f53b2c2c81abe4f1798f659c423542e6dd0433
Instruction Fuzzy Hash: D841F2B0C00659CADB24CFAAC884BDDBBF5FF45314F20815AD409AB251DB75298ACF50

Function 00AC4248 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00AC59F1

Memory Dump Source

Source File: 00000000.00000002.1831090541.0000000000AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_uFVtW2gkkN.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 9c5685b7add06ef5b8a491cef50dae59e1c660105ab9e7b93b9148eb69eb9b5a
Instruction ID: 0459ba966e45c78d7c81640ddeb3c21c37dfc961aea9cc65ddf4eb71301cc883
Opcode Fuzzy Hash: 9c5685b7add06ef5b8a491cef50dae59e1c660105ab9e7b93b9148eb69eb9b5a
Instruction Fuzzy Hash: DE41D2B0C00719CADB24DFAAC844B9EBBF5FF44314F21815AD409AB251DB756989CF90

Function 00ACD2F9 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00ACD387

Memory Dump Source

Source File: 00000000.00000002.1831090541.0000000000AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_uFVtW2gkkN.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5570d34a10296766b4ae20206375a6e00e407619f30d6c26e5b5c07725b84018
Instruction ID: 52d35d8f84a6d6c0c3e79a3c871d555e059a87b7890e69a274a4fa5be98c42ea
Opcode Fuzzy Hash: 5570d34a10296766b4ae20206375a6e00e407619f30d6c26e5b5c07725b84018
Instruction Fuzzy Hash: EC2103B59002499FDB10CFAAD885AEEBFF5EB48320F14801AE958A3310C374A944CFA1

Function 00ACD300 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00ACD387

Memory Dump Source

Source File: 00000000.00000002.1831090541.0000000000AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_uFVtW2gkkN.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7f990107c749446ac247de49b9a12866e4e0da2cba24575c645ae56fa75f407e
Instruction ID: 5ae6d3861689800819189379fcb008c8608ab7f4fe0378a1385abc0e5b96ac07
Opcode Fuzzy Hash: 7f990107c749446ac247de49b9a12866e4e0da2cba24575c645ae56fa75f407e
Instruction Fuzzy Hash: 7321E4B59003499FDB10CF9AD985ADEFBF4EB48310F14801AE918A7350C374A954CFA5

Function 051EF6DC Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000,?,?,?,?,00000000,00000E20,?,?,051EFA46), ref: 051EFB4E

Memory Dump Source

Source File: 00000000.00000002.1838582680.00000000051E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_51e0000_uFVtW2gkkN.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: dff95334234ca3364113cece6672380cc069089388c9f88d9dfef5186705a126
Instruction ID: 80df513283a0e583a8d5d42d4f1c472c69e40aff324f07cb937a71e65c14b4fa
Opcode Fuzzy Hash: dff95334234ca3364113cece6672380cc069089388c9f88d9dfef5186705a126
Instruction Fuzzy Hash: 751123B1C007098BDB20DF9AC444A9EFBF5EF88310F10845AD829A7210C379A546CFA4

Function 051EFAE7 Relevance: 1.6, APIs: 1, Instructions: 51libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000,?,?,?,?,00000000,00000E20,?,?,051EFA46), ref: 051EFB4E

Memory Dump Source

Source File: 00000000.00000002.1838582680.00000000051E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_51e0000_uFVtW2gkkN.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1eb0b71d19784d1f7549ade53473b2893b0e18629a3a99b81a03787a4c02db41
Instruction ID: 70e9109fadd65854dc23f9d82ef20260fae6a165bd63eac6474a4b285effc129
Opcode Fuzzy Hash: 1eb0b71d19784d1f7549ade53473b2893b0e18629a3a99b81a03787a4c02db41
Instruction Fuzzy Hash: 971104B5C007498FDB10DF9AC444ADEFBF5EF88314F14841AD829A7210C779A546CFA5

Function 00ACB020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00ACB086

Memory Dump Source

Source File: 00000000.00000002.1831090541.0000000000AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_uFVtW2gkkN.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2a96fd7511362a3d033c7c988c2306baf853c72f223a1b27ad592617a5eb4f0e
Instruction ID: a9941d0d85e64b28a0ff3155c55d7a998e9fea4d0d14207de30f8958d0f29ccb
Opcode Fuzzy Hash: 2a96fd7511362a3d033c7c988c2306baf853c72f223a1b27ad592617a5eb4f0e
Instruction Fuzzy Hash: 1911D2B5C003498FDB10DF9AC445B9EFBF4AB88310F11845ED429B7610C376A545CFA5

Function 007CD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1830506664.00000000007CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7cd000_uFVtW2gkkN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02f3e8b7b2ce76a6e693d6d440606d1f80152fc2679c2c03ac3f8584a5e5311b
Instruction ID: aeb38e50f1578b01d60bb8f48b8e10edf86060a3a5127c066d785a257033a382
Opcode Fuzzy Hash: 02f3e8b7b2ce76a6e693d6d440606d1f80152fc2679c2c03ac3f8584a5e5311b
Instruction Fuzzy Hash: 392102B1500280DFCB19DF04C9C0F26BB65FB94324F20C56CDE0A0A246C33AEC16C6A1

Function 007DD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1830556062.00000000007DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7dd000_uFVtW2gkkN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74f7f49eacb5c972d8f8cf3561263450863402ae6b5faa8d3c3586c126540379
Instruction ID: 48fc40c13522400507135b40bb8a3f5a72b671c9dd55bf1eb90a6e5833b25682
Opcode Fuzzy Hash: 74f7f49eacb5c972d8f8cf3561263450863402ae6b5faa8d3c3586c126540379
Instruction Fuzzy Hash: 3C21D0B5604204DFCB24DF24D9C4B26BBB5EB98314F24C96AD80A4B386C33ADC07CA61

Function 007DD005 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1830556062.00000000007DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7dd000_uFVtW2gkkN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5839eb26ba60bae6474dfd4d161bd2afd46eb70c569dfe668760f5391aa7fd46
Instruction ID: 5d1613cc98bbbcafa04be5de29f9bd158519bcaad0e548433d4e70c5947de011
Opcode Fuzzy Hash: 5839eb26ba60bae6474dfd4d161bd2afd46eb70c569dfe668760f5391aa7fd46
Instruction Fuzzy Hash: FA2150755083849FCB12CF24D994715BF71EB86314F28C5EAD8498F2A7C33A9C5ACB62

Function 007CD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1830506664.00000000007CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7cd000_uFVtW2gkkN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
Instruction ID: ca253c78c1021e3c333240b8ea89ca7d66056c2634cada1c0c1c3450f60ab414
Opcode Fuzzy Hash: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
Instruction Fuzzy Hash: B911CA76504280DFCB16CF00D9C4B16BF72FB94324F24C2ADDD090A256C33AE95ACBA2

Function 007CD99D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1830506664.00000000007CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7cd000_uFVtW2gkkN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bb5426a307e5d21ea1aba009925edb881a09bbb8345fa426c123cf7fe7bde54
Instruction ID: 154a5f547a51b5bd9ce6d4795bb16b90ac659b65217a28a2b52c06a538178337
Opcode Fuzzy Hash: 7bb5426a307e5d21ea1aba009925edb881a09bbb8345fa426c123cf7fe7bde54
Instruction Fuzzy Hash: D401A7710093449AE7304A2ADC84F67FFD8DF55365F18C56DED090A282C77DAC40CAB1

Function 007CD99C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1830506664.00000000007CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7cd000_uFVtW2gkkN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b6b1f40a145554685bc3a3794c3dad233fbfc76d67b772417b70931a83a5d70
Instruction ID: a5d6f82d9cd57f3c0a327b95ff433e7582ee7a6d14141cf0abfb13c4a8814c0e
Opcode Fuzzy Hash: 3b6b1f40a145554685bc3a3794c3dad233fbfc76d67b772417b70931a83a5d70
Instruction Fuzzy Hash: 4EF0C272009340AAEB208A16CC84B67FFD8EB51374F18C05EED490A286C378AC44CAB0

Non-executed Functions

Function 051E48A0 Relevance: 1.8, Strings: 1, Instructions: 528COMMON

Download Yara Rule

Strings

0oAp, xrefs: 051E4CD7

Memory Dump Source

Source File: 00000000.00000002.1838582680.00000000051E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_51e0000_uFVtW2gkkN.jbxd

Similarity

API ID:
String ID: 0oAp
API String ID: 0-730047704
Opcode ID: a82c5477974a4cd37f755c9db5feda6fac64387e95caf6291d3408c6c3febd57
Instruction ID: f9ba4ae017205ea3d279bfc6de7e06289f3f9e4922680313b65ab5152304f499
Opcode Fuzzy Hash: a82c5477974a4cd37f755c9db5feda6fac64387e95caf6291d3408c6c3febd57
Instruction Fuzzy Hash: CB429D74E012288FDB64DF65C994BEDBBB2BF89300F1085E9D509AB264DB349E85CF50

Function 051E5BC0 Relevance: .4, Instructions: 363COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1838582680.00000000051E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_51e0000_uFVtW2gkkN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5798f3e33a995fffa6a6ce356b83ca9d34f1b30bdeca638de67e55220819cee
Instruction ID: 79e407234fd059889d74f6511da28d6b836f72db79240251a74c2cb1471f1658
Opcode Fuzzy Hash: b5798f3e33a995fffa6a6ce356b83ca9d34f1b30bdeca638de67e55220819cee
Instruction Fuzzy Hash: 1002D174A01229CFDB64DF64C990B9DBBB2BF89300F5085E9D509AB354DB31AE85CF50

Function 051E2D59 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1838582680.00000000051E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_51e0000_uFVtW2gkkN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d15f61bd9a1b4178e3b7c49507ee4e70906226f2d0c5c9671729aa73b4de292
Instruction ID: ea1ba6fdc7edb218f6dc0b84c142ecc66cdcdd0abf534c632e2fbb3a21de4c2e
Opcode Fuzzy Hash: 0d15f61bd9a1b4178e3b7c49507ee4e70906226f2d0c5c9671729aa73b4de292
Instruction Fuzzy Hash: CCD11A31D2075ACACB01EB64D994A99B7B1FF95300F10CB9AE4093B225FB706AC9CB51

Function 051E2D2F Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1838582680.00000000051E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_51e0000_uFVtW2gkkN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb34e72aa1d6aee156628bbfd84edd10955c697d3ecd4af451a9d3db25f2d42f
Instruction ID: 3bf7ae11d897d76d3c56832f6b87e0bef0021b26807256598b1caf870e685e96
Opcode Fuzzy Hash: bb34e72aa1d6aee156628bbfd84edd10955c697d3ecd4af451a9d3db25f2d42f
Instruction Fuzzy Hash: F1D10A3592075ACACB01EB64D994AD9B7B1FF95300F10CB9AE4093B225FB706AC9CF51

Function 051E2D68 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1838582680.00000000051E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_51e0000_uFVtW2gkkN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 766b8f0c222bb492a39e7430a712ac877a2664eabf5d381e300589089d7dbc73
Instruction ID: c68a2d309642b167ec7fb6c161436cb49f78cdd0820cf515127bae0f4c096514
Opcode Fuzzy Hash: 766b8f0c222bb492a39e7430a712ac877a2664eabf5d381e300589089d7dbc73
Instruction Fuzzy Hash: FFD10A3192075ACACB01EB64D994A99B7B1FF95300F10CB9AE4093B225FF706AC9CF51

Function 00ACDC74 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1831090541.0000000000AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_uFVtW2gkkN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c162ac41008f226c0bfb8c65f7e1fbc3d6489487383c630fa75a19da0341945
Instruction ID: 9bc9a920f42f990f3b4aa0ce3541b35a472ff1b62ededd4281041ff76380a50d
Opcode Fuzzy Hash: 6c162ac41008f226c0bfb8c65f7e1fbc3d6489487383c630fa75a19da0341945
Instruction Fuzzy Hash: 34A14B36E002158FCF19DFB5C944A9EB7B2FF84300B16857EE806AB265DB71E955CB80

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report uFVtW2gkkN.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\uFVtW2gkkN.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
uFVtW2gkkN.exe

Function 051EBCB8 Relevance: 6.6, Strings: 5, Instructions: 388
COMMON

Function 051E7110 Relevance: 5.3, Strings: 4, Instructions: 271
COMMON

Function 07130778 Relevance: 3.1, Strings: 2, Instructions: 626
COMMON

Function 051E9EA8 Relevance: 2.9, Strings: 2, Instructions: 364
COMMON

Function 051E7C98 Relevance: 2.7, Strings: 2, Instructions: 203
COMMON

Function 051E8718 Relevance: 2.6, APIs: 1, Instructions: 1088
COMMON

Function 00ACD0A8 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Function 00ACD0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 00ACAE30 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 198
COMMON