Edit tour

Windows Analysis Report
1rjcA65eoG.exe

Overview

General Information

Sample name:	1rjcA65eoG.exe renamed because original name is a hash value
Original sample name:	3fee866de2ecef0d0fbaeb9297be4daf.exe
Analysis ID:	1646702
MD5:	3fee866de2ecef0d0fbaeb9297be4daf
SHA1:	582838d465cce216f7115db662827d47023f4519
SHA256:	7f360d2a3373811cb6fbe98bf8217db440b8a1f4c28e35462eded4d7b4b5b60b
Tags:	exeRedLineStealeruser-abuse_ch
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected RedLine Stealer

C2 URLs / IPs found in malware configuration

Joe Sandbox ML detected suspicious sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

1rjcA65eoG.exe (PID: 6484 cmdline: "C:\Users\user\Desktop\1rjcA65eoG.exe" MD5: 3FEE866DE2ECEF0D0FBAEB9297BE4DAF)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{
  "C2 url": [
    "185.153.198.36:1912"
  ],
  "Bot Id": "first",
  "Authorization Header": "c74790bd166600f1f665c8ce201776eb"
}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
1rjcA65eoG.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
1rjcA65eoG.exe	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x24cc3:$gen01: ChromeGetRoamingName 0x24ce8:$gen02: ChromeGetLocalName 0x24d2b:$gen03: get_UserDomainName 0x28bc4:$gen04: get_encrypted_key 0x27943:$gen05: browserPaths 0x27c19:$gen06: GetBrowsers 0x27501:$gen07: get_InstalledInputLanguages 0x239cc:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x3018:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x29006:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x290a4:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x296c2:$spe9: wallet 0x219ea:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x21f14:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x21fc1:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x21998:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x219c1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x21b92:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x21de5:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x220d4:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1045515269.0000000000462000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: 1rjcA65eoG.exe PID: 6484	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 1rjcA65eoG.exe PID: 6484	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.1rjcA65eoG.exe.460000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.0.1rjcA65eoG.exe.460000.0.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x24cc3:$gen01: ChromeGetRoamingName 0x24ce8:$gen02: ChromeGetLocalName 0x24d2b:$gen03: get_UserDomainName 0x28bc4:$gen04: get_encrypted_key 0x27943:$gen05: browserPaths 0x27c19:$gen06: GetBrowsers 0x27501:$gen07: get_InstalledInputLanguages 0x239cc:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x3018:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x29006:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x290a4:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x296c2:$spe9: wallet 0x219ea:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x21f14:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x21fc1:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x21998:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x219c1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x21b92:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x21de5:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x220d4:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13

Suricata Signatures

ET MALWARE Redline Stealer TCP CnC - Id1Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-24T08:30:49.165360+0100	2043234	1	A Network Trojan was detected	185.153.198.36	1912	192.168.2.10	49683	TCP

ET MALWARE Redline Stealer TCP CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-24T08:30:48.957019+0100	2043231	1	A Network Trojan was detected	192.168.2.10	49683	185.153.198.36	1912	TCP
2025-03-24T08:30:54.231043+0100	2043231	1	A Network Trojan was detected	192.168.2.10	49683	185.153.198.36	1912	TCP
2025-03-24T08:30:58.701236+0100	2043231	1	A Network Trojan was detected	192.168.2.10	49683	185.153.198.36	1912	TCP
2025-03-24T08:30:59.953209+0100	2043231	1	A Network Trojan was detected	192.168.2.10	49683	185.153.198.36	1912	TCP

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-24T08:30:56.830918+0100	2046056	1	A Network Trojan was detected	185.153.198.36	1912	192.168.2.10	49683	TCP

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-24T08:30:48.957019+0100	2046045	1	A Network Trojan was detected	192.168.2.10	49683	185.153.198.36	1912	TCP

Joe Sandbox Signatures

• AV Detection
• Compliance
• Software Vulnerabilities
• Networking
• System Summary
• Data Obfuscation
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• Language, Device and Operating System Detection
• Lowering of HIPS / PFW / Operating System Security Settings
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 1rjcA65eoG.exe

Malware Configuration Extractor: RedLine {"C2 url": ["185.153.198.36:1912"], "Bot Id": "first", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Multi AV Scanner detection for submitted file

Source: 1rjcA65eoG.exe	ReversingLabs: Detection: 75%
Source: 1rjcA65eoG.exe	Virustotal: Detection: 83%			Perma Link

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: 1rjcA65eoG.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1rjcA65eoG.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Code function: 4x nop then jmp 0602AA68h	0_2_0602A570
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Code function: 4x nop then jmp 06028533h	0_2_06028270
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Code function: 4x nop then jmp 060280FDh	0_2_06027D20
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Code function: 4x nop then jmp 060280FDh	0_2_06027D30
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Code function: 4x nop then jmp 060262BFh	0_2_06025B60

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2043231 - Severity 1 - ET MALWARE Redline Stealer TCP CnC Activity : 192.168.2.10:49683 -> 185.153.198.36:1912
Source: Network traffic	Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.10:49683 -> 185.153.198.36:1912
Source: Network traffic	Suricata IDS: 2043234 - Severity 1 - ET MALWARE Redline Stealer TCP CnC - Id1Response : 185.153.198.36:1912 -> 192.168.2.10:49683
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 185.153.198.36:1912 -> 192.168.2.10:49683

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 185.153.198.36:1912

Source: global traffic

TCP traffic: 192.168.2.10:49683 -> 185.153.198.36:1912

Source: Joe Sandbox View

ASN Name: RMINJINERINGRU RMINJINERINGRU

Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.198.36

Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: 1rjcA65eoG.exe, 00000000.00000002.1188920272.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://purl.oen
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp, 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002960000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp, 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002960000.00000004.00000800.00020000.00000000.sdmp, 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: 1rjcA65eoG.exe	String found in binary or memory: https://api.ip.sb/ip

System Summary

Malicious sample detected (through community Yara rule)

Source: 1rjcA65eoG.exe, type: SAMPLE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.0.1rjcA65eoG.exe.460000.0.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io

Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Code function: 0_2_00CFDC74	0_2_00CFDC74
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Code function: 0_2_0602C500	0_2_0602C500
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Code function: 0_2_0602A570	0_2_0602A570
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Code function: 0_2_0602D248	0_2_0602D248
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Code function: 0_2_06028DE0	0_2_06028DE0
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Code function: 0_2_06026770	0_2_06026770
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Code function: 0_2_0602740D	0_2_0602740D
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Code function: 0_2_0602742D	0_2_0602742D
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Code function: 0_2_06027488	0_2_06027488
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Code function: 0_2_0602220F	0_2_0602220F
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Code function: 0_2_06022248	0_2_06022248
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Code function: 0_2_06025190	0_2_06025190
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Code function: 0_2_06024C00	0_2_06024C00
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Code function: 0_2_06027D20	0_2_06027D20
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Code function: 0_2_06027D30	0_2_06027D30
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Code function: 0_2_06025B60	0_2_06025B60
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Code function: 0_2_06023BB0	0_2_06023BB0

Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs 1rjcA65eoG.exe
Source: 1rjcA65eoG.exe, 00000000.00000000.1045548463.00000000004A6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs 1rjcA65eoG.exe
Source: 1rjcA65eoG.exe, 00000000.00000002.1188131163.00000000009DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 1rjcA65eoG.exe
Source: 1rjcA65eoG.exe	Binary or memory string: OriginalFilenameSteanings.exe8 vs 1rjcA65eoG.exe

Source: 1rjcA65eoG.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1rjcA65eoG.exe, type: SAMPLE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.0.1rjcA65eoG.exe.460000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/1@0/1

Source: C:\Users\user\Desktop\1rjcA65eoG.exe

File created: C:\Users\user\AppData\Local\SystemCache

Jump to behavior

Source: C:\Users\user\Desktop\1rjcA65eoG.exe

Mutant created: NULL

Source: 1rjcA65eoG.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 1rjcA65eoG.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\1rjcA65eoG.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: C:\Users\user\Desktop\1rjcA65eoG.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002CAD000.00000004.00000800.00020000.00000000.sdmp, 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002C97000.00000004.00000800.00020000.00000000.sdmp, 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002D3C000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 1rjcA65eoG.exe	ReversingLabs: Detection: 75%
Source: 1rjcA65eoG.exe	Virustotal: Detection: 83%

Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Section loaded: ntasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\1rjcA65eoG.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: 1rjcA65eoG.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 1rjcA65eoG.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: 1rjcA65eoG.exe

Static PE information: 0xD22848DC [Tue Sep 23 12:17:32 2081 UTC]

Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\1rjcA65eoG.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\1rjcA65eoG.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Memory allocated: CF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Memory allocated: 27E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Memory allocated: 2610000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Window / User API: threadDelayed 2135			Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Window / User API: threadDelayed 5153			Jump to behavior

Source: C:\Users\user\Desktop\1rjcA65eoG.exe TID: 7036	Thread sleep time: -25825441703193356s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe TID: 6524	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\1rjcA65eoG.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.000000000391E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - NDCDYNVMware20,11696501413z
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.000000000391E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696501413o
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.000000000391E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696501413h
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.000000000391E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactiveuserers.co.inVMware20,11696501413~
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.000000000391E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696501413j
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.0000000003995000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696501413
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.000000000391E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - COM.HKVMware20,11696501413
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.0000000003995000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - EU East & CentralVMware20,11696501413
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.000000000391E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696501413
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.0000000003995000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696501413
Source: 1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002C21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.000000000391E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - non-EU EuropeVMware20,11696501413
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.000000000391E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696501413t
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.000000000391E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - HKVMware20,11696501413]
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.0000000003995000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - COM.HKVMware20,11696501413
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.0000000003995000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - HKVMware20,11696501413]
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.0000000003995000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696501413\|UE
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.0000000003995000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696501413j
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.0000000003995000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696501413x
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.000000000391E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696501413
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.000000000391E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactiveuserers.comVMware20,11696501413}
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.0000000003995000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696501413}
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.000000000391E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696501413x
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.000000000391E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696501413t
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.000000000391E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactiveuserers.comVMware20,11696501413
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.0000000003995000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696501413
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.000000000391E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696501413
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.0000000003995000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696501413
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.0000000003995000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696501413x
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.0000000003995000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696501413s
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.0000000003995000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696501413f
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.000000000391E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696501413
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.0000000003995000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactiveuserers.comVMware20,11696501413
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.000000000391E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696501413\|UE
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.0000000003995000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696501413^
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.000000000391E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696501413x
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.0000000003995000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696501413x
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.0000000003995000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696501413
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.0000000003995000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696501413h
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.000000000391E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696501413}
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.0000000003995000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696501413
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.0000000003995000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactiveuserers.co.inVMware20,11696501413d
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.000000000391E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696501413x
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.000000000391E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696501413s
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.000000000391E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - EU East & CentralVMware20,11696501413
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.0000000003995000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696501413t
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.0000000003995000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696501413t
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.0000000003995000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - EU WestVMware20,11696501413n
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.000000000391E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696501413u
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.0000000003995000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactiveuserers.comVMware20,11696501413}
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.000000000391E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - GDCDYNVMware20,11696501413p
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.000000000391E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - EU WestVMware20,11696501413n
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.0000000003995000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696501413u
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.0000000003995000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - NDCDYNVMware20,11696501413z
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.0000000003995000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - non-EU EuropeVMware20,11696501413
Source: 1rjcA65eoG.exe, 00000000.00000002.1188131163.0000000000AB9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllt
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.0000000003995000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactiveuserers.co.inVMware20,11696501413~
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.000000000391E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696501413
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.000000000391E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactiveuserers.co.inVMware20,11696501413d
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.0000000003995000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - GDCDYNVMware20,11696501413p
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.000000000391E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696501413
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.000000000391E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696501413^
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.0000000003995000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696501413o
Source: 1rjcA65eoG.exe, 00000000.00000002.1191863641.000000000391E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696501413f

Source: C:\Users\user\Desktop\1rjcA65eoG.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\1rjcA65eoG.exe

Code function: 0_2_0602A570 LdrInitializeThunk,

0_2_0602A570

Source: C:\Users\user\Desktop\1rjcA65eoG.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\1rjcA65eoG.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Queries volume information: C:\Users\user\Desktop\1rjcA65eoG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\1rjcA65eoG.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: 1rjcA65eoG.exe, 00000000.00000002.1188131163.0000000000A7F000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\1rjcA65eoG.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 1rjcA65eoG.exe, type: SAMPLE
Source: Yara match	File source: 0.0.1rjcA65eoG.exe.460000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1045515269.0000000000462000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1rjcA65eoG.exe PID: 6484, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\1rjcA65eoG.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\1rjcA65eoG.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\1rjcA65eoG.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1rjcA65eoG.exe PID: 6484, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 1rjcA65eoG.exe, type: SAMPLE
Source: Yara match	File source: 0.0.1rjcA65eoG.exe.460000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1045515269.0000000000462000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1rjcA65eoG.exe PID: 6484, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Masquerading	1 OS Credential Dumping	231 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	113 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1rjcA65eoG.exe	75%	ReversingLabs	ByteCode-MSIL.Trojan.RedLineStealz
1rjcA65eoG.exe	84%	Virustotal		Browse

Name	Source	Malicious	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id23ResponseD	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002960000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id12Response	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id2Response	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp, 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id21Response	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id9	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id8	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id5	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id4	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id7	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://purl.oen	1rjcA65eoG.exe, 00000000.00000002.1188920272.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id6	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id19Response	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id15Response	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id6Response	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.ip.sb/ip	1rjcA65eoG.exe	false	high
http://schemas.xmlsoap.org/ws/2004/04/sc	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id1ResponseD	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id9Response	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id20	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id21	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id22	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id23	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id24	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id24Response	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id1Response	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/08/addressing	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/trust	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id10	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id11	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id12	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id16Response	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id13	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id14	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id15	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id16	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id17	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id18	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id5Response	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id19	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id10Response	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id8Response	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/soap/envelope/	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id23Response	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp, 1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/D	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/06/addressingex	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wscoor	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/08/addressing/fault	1rjcA65eoG.exe, 00000000.00000002.1189062404.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew	1rjcA65eoG.exe, 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.153.198.36	unknown	Russian Federation		49877	RMINJINERINGRU	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1646702
Start date and time:	2025-03-24 08:29:51 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1rjcA65eoG.exe renamed because original name is a hash value
Original Sample Name:	3fee866de2ecef0d0fbaeb9297be4daf.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/1@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 18 Number of non-executed functions: 14
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, SIHClient.exe, Sgrmuserer.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.12.23.50, 23.204.23.20, 20.109.210.53
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, c.pki.goog, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:30:54	API Interceptor	37x Sleep call for process: 1rjcA65eoG.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RMINJINERINGRU	sotema_7.txt.exe	Get hash	malicious	RedLine	Browse	87.251.71.195
	HEUR-Trojan.Win32.Agent.gen-7a4df2fc82c0b553d.exe	Get hash	malicious	Amadey, PrivateLoader, Raccoon Stealer v2, RedLine, SmokeLoader, Vidar	Browse	87.251.71.195
	14jxqkI8dt.exe	Get hash	malicious	Backstage Stealer, ManusCrypt, PrivateLoader, RedLine, Vidar	Browse	87.251.71.195
	1ULY9wkde4.exe	Get hash	malicious	ManusCrypt, PrivateLoader, RedLine, SmokeLoader, Vidar	Browse	87.251.71.195
	1DCAB4CDFFDF269EA33719990AC81C515345B50FE1C60.exe	Get hash	malicious	PrivateLoader, RedLine, Vidar	Browse	87.251.71.195
	5GBK05PTFO.dll	Get hash	malicious	Wannacry	Browse	185.153.199.225
	e8k60omgBH.exe	Get hash	malicious	Unknown	Browse	185.153.198.216

Process:	C:\Users\user\Desktop\1rjcA65eoG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3094
Entropy (8bit):	5.33145931749415
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0atTqdqlq7qV
MD5:	3FD5C0634443FB2EF2796B9636159CB6
SHA1:	366DDE94AEFCFFFAB8E03AD8B448E05D7489EB48
SHA-256:	58307E94C67E2348F5A838DE4FF668983B38B7E9A3B1D61535D3A392814A57D6
SHA-512:	8535E7C0777C6B0876936D84BDE2BDC59963CF0954D4E50D65808E6E806E8B131DF5DB8FA0E030FAE2702143A7C3A70698A2B9A80519C9E2FFC286A71F0B797C
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.0813148099825485
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	1rjcA65eoG.exe
File size:	307'712 bytes
MD5:	3fee866de2ecef0d0fbaeb9297be4daf
SHA1:	582838d465cce216f7115db662827d47023f4519
SHA256:	7f360d2a3373811cb6fbe98bf8217db440b8a1f4c28e35462eded4d7b4b5b60b
SHA512:	ad5c05546a15cb2e70c5af7463b7cf58d456f447d7538d0fdf5d75f470b72a3f4a29532bf5c6a3d06ee2ac0ea78922e77687caeb355b1222eb48778bb9ec8c70
SSDEEP:	3072:GcZqf7D34cp/0+mAYkygYdQ0ghnB1fA0PuTVAtkxzA3R4eqiOL2bBOA:GcZqf7DIknGapB1fA0GTV8kKYL
TLSH:	31645A5833E8C910DA7F4775D861D67093B0BCA3A552E70B4FC4ACAB3D32740EA51AB6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....H(...............0.................. ... ....@.. ....................... ............@................................

File Icon


Icon Hash:	4d8ea38d85a38e6d

Static PE Info

General

Entrypoint:	0x43028e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xD22848DC [Tue Sep 23 12:17:32 2081 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x30240	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x32000	0x1c9c6	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x50000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x2e294	0x2e400	935272b593c1ff27c92a8d07d61251ce	False	0.4747730152027027	data	6.186111692978325	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x32000	0x1c9c6	0x1ca00	a8cf3f8ff27a4a736ba8fb433d91107f	False	0.2380765556768559	data	2.615031395625776	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x50000	0xc	0x200	21472a05bd31cf3b960b3bcc0808216b	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x32220	0x3d04	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9934058898847631
RT_ICON	0x35f24	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2835 x 2835 px/m	0.09013072282030049
RT_ICON	0x4674c	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2835 x 2835 px/m	0.13905290505432216
RT_ICON	0x4a974	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2835 x 2835 px/m	0.17033195020746889
RT_ICON	0x4cf1c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2835 x 2835 px/m	0.2045028142589118
RT_ICON	0x4dfc4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2835 x 2835 px/m	0.24645390070921985
RT_GROUP_ICON	0x4e42c	0x5a	data	0.7666666666666667
RT_VERSION	0x4e488	0x352	data	0.4447058823529412
RT_MANIFEST	0x4e7dc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
Comments	XHP Booster
CompanyName
FileDescription	XHP
FileVersion	12.9.1.22
InternalName	Steanings.exe
LegalCopyright	XHP Corporation Copyright 2021
LegalTrademarks
OriginalFilename	Steanings.exe
ProductName	XHP booster
ProductVersion	12.9.1.22
Assembly Version	1.1.21.1

Network Behavior

Download Network PCAP: filtered – full

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-24T08:30:48.957019+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.10	49683	185.153.198.36	1912	TCP
2025-03-24T08:30:48.957019+0100	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	1	192.168.2.10	49683	185.153.198.36	1912	TCP
2025-03-24T08:30:49.165360+0100	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	1	185.153.198.36	1912	192.168.2.10	49683	TCP
2025-03-24T08:30:54.231043+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.10	49683	185.153.198.36	1912	TCP
2025-03-24T08:30:56.830918+0100	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	185.153.198.36	1912	192.168.2.10	49683	TCP
2025-03-24T08:30:58.701236+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.10	49683	185.153.198.36	1912	TCP
2025-03-24T08:30:59.953209+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.10	49683	185.153.198.36	1912	TCP

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 24, 2025 08:30:48.460108995 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:48.666666031 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:48.666770935 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:48.687295914 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:48.893078089 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:48.944261074 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:48.957019091 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:49.165359974 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:49.209870100 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:54.231043100 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:54.437673092 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:54.437690973 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:54.437722921 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:54.437781096 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:54.437793016 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:54.437813044 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:54.437855005 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:56.625428915 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:56.830918074 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:56.830956936 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:56.831047058 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:56.831104994 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:56.831356049 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:56.831413031 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:56.831512928 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:56.831588030 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:56.831795931 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:56.831845045 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.036997080 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.037033081 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.037162066 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.037209988 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.037317038 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.037398100 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.037430048 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.037511110 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.037631989 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.037679911 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.037821054 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.037889957 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.038193941 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.038271904 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.038289070 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.038347006 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.038603067 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.038652897 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.039140940 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.039189100 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.243220091 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.243243933 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.243338108 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.243343115 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.243453979 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.243876934 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.243920088 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.243937969 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.243963003 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.244021893 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.244151115 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.244221926 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.244591951 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.244646072 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.245052099 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.245112896 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.245218992 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.245273113 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.245475054 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.245536089 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.245665073 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.245726109 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.245862007 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.245863914 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.245923996 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.246318102 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.246382952 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.246457100 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.246524096 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.246911049 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.246965885 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.247340918 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.247358084 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.247459888 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.247996092 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.248053074 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.248656034 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.248718977 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.450098038 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.450122118 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.450229883 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.450366974 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.450392962 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.450427055 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.450464010 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.450706959 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.450786114 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.451009989 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.451137066 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.451333046 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.451531887 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.451899052 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.452363968 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.452563047 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.452574968 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.453150034 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.453226089 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.453876019 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.454106092 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.454406977 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.454513073 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.454987049 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.455192089 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.455208063 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.455830097 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.456259966 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.456696033 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.457241058 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.457257032 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.457268953 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.457279921 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.457340002 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.457807064 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.458025932 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.458039999 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.458323002 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.458636999 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.459048986 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.459103107 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.655694962 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.656008959 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.656316042 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.656598091 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.656610966 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.656977892 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.657187939 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.658046007 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.658493042 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.658802986 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.658890009 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.664676905 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.665113926 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.665316105 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.665638924 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.665994883 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.666007042 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.666368961 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.666794062 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.667058945 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.667380095 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.667454958 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.667561054 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.668250084 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.668708086 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.668719053 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.668987036 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.669243097 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.669433117 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.670147896 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.670166016 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.670217991 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.670934916 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.671181917 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.671467066 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.671678066 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.671993971 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.722361088 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.722666979 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.722781897 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.864267111 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.864289045 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.864489079 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.864905119 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.865039110 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.865241051 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.865653992 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.865952015 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.866260052 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.866833925 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.866847992 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.867022991 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.867419958 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.867749929 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.868119955 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.868416071 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.868628025 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.869107008 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.869323969 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.869534016 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.869765997 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.870125055 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.870392084 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.870852947 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.871081114 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.871407032 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.912748098 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.913048029 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.913151979 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.928071022 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.928545952 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.928941011 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.929462910 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.929558039 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.929853916 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.930269957 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.930496931 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.930862904 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.931103945 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.931267977 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.931377888 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.931879997 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.932944059 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.932955027 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.932966948 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.932976007 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.933264017 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.933274984 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.933712959 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.934403896 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.934673071 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.935098886 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.935333014 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.935522079 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.935683966 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.975944996 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:57.976260900 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:57.976372957 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:58.118760109 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.118781090 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.118809938 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.118966103 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.119641066 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.119736910 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.120086908 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.120168924 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.120614052 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.120954037 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.121212959 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.121606112 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.122001886 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.122212887 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.122447014 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.122798920 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.122994900 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.123212099 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.123470068 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.123862028 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.123991013 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.124628067 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.124891996 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.125052929 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.125432968 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.125576973 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.166790009 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.167104006 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:58.167198896 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:58.182622910 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.182643890 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.182732105 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.182951927 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.182993889 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.183092117 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.183803082 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.183826923 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.184145927 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.184377909 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.185581923 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.185610056 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.185621977 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.185663939 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.185710907 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.186163902 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.186609983 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.187259912 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.187659025 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.188175917 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.188363075 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.188399076 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.188756943 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.188858986 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.189202070 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.189522982 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.230494022 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.230856895 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:58.230973959 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:58.372857094 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.372952938 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.373258114 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.373699903 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.373781919 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.374118090 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.374629974 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.374644995 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.374855995 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.374954939 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.375271082 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.375358105 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.375926018 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.376569986 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.376703024 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.377109051 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.377460957 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.377649069 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.377960920 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.378345013 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.378432989 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.378508091 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.378906965 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.379219055 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.379499912 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.379874945 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.421031952 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.421386003 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:58.436047077 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.436384916 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.436697960 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.436908960 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.437205076 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.437374115 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.438107014 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.438435078 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.438523054 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.438891888 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.439069033 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.439524889 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.439578056 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.439985037 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.441006899 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.441021919 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.441036940 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.441184998 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.441471100 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.441871881 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.442528963 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.442893982 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.443336964 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.443813086 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.443829060 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.443916082 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.485101938 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.626667023 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.626847982 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.627547026 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.627598047 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.627695084 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.627938986 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.628381968 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.628591061 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.628901005 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.629312992 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.629666090 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.629704952 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.630227089 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.630244017 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.630615950 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.630810022 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.631508112 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.676465988 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.700365067 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:58.701236010 CET	49683	1912	192.168.2.10	185.153.198.36
Mar 24, 2025 08:30:58.963169098 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:59.907150030 CET	1912	49683	185.153.198.36	192.168.2.10
Mar 24, 2025 08:30:59.953208923 CET	49683	1912	192.168.2.10	185.153.198.36

Statistics

CPU Usage

• 1rjcA65eoG.exe

Click to jump to process

Memory Usage

• 1rjcA65eoG.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry
• Network

Click to dive into process behavior distribution

Target ID:	0
Start time:	03:30:44
Start date:	24/03/2025
Path:	C:\Users\user\Desktop\1rjcA65eoG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\1rjcA65eoG.exe"
Imagebase:	0x460000
File size:	307'712 bytes
MD5 hash:	3FEE866DE2ECEF0D0FBAEB9297BE4DAF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000000.1045515269.0000000000462000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1189062404.0000000002876000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	7.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	68
Total number of Limit Nodes:	8

Executed Functions

Function 0602C500 Relevance: 6.6, Strings: 5, Instructions: 397
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hzq, xrefs: 0602C959
Hzq, xrefs: 0602C9A0
Hzq, xrefs: 0602C912
Hzq, xrefs: 0602C8E1
Hzq, xrefs: 0602C8B0

Memory Dump Source

Source File: 00000000.00000002.1200601506.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6020000_1rjcA65eoG.jbxd

Similarity

API ID:
String ID: Hzq$Hzq$Hzq$Hzq$Hzq
API String ID: 0-714681391
Opcode ID: 0de4141ca6b2670e19291165995ef7bcdc1955615de4ad50190805e5d01171ec
Instruction ID: 19c9f40e3bc6efa8850a270ebee38182e400b562c49936e0c1cb276c329c4e72
Opcode Fuzzy Hash: 0de4141ca6b2670e19291165995ef7bcdc1955615de4ad50190805e5d01171ec
Instruction Fuzzy Hash: 72F1AF31E04266CFDB99DF74D4502BDFBF2BF85300F24866AD416AB241DB789A85CB90

Function 0602A570 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

., xrefs: 0602A7F0
1, xrefs: 0602A875

Memory Dump Source

Source File: 00000000.00000002.1200601506.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6020000_1rjcA65eoG.jbxd

Similarity

API ID:
String ID: .$1
API String ID: 0-1839485796
Opcode ID: 4b599e75d703e658c03058b116489e01f8201a243eb30e08dd5d101427d233b0
Instruction ID: f0b68cdc3398dda8a474768582077ab2a388206164e075661913731f8ea20162
Opcode Fuzzy Hash: 4b599e75d703e658c03058b116489e01f8201a243eb30e08dd5d101427d233b0
Instruction Fuzzy Hash: 2CF1DC74E01229CFDB68DF65D984B9DBBB2FF89301F1081AAD509A7290DB359E81CF50

Function 06028DE0 Relevance: 3.6, Strings: 2, Instructions: 1088
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

s/, xrefs: 06028EC0, 06028EC5
k7, xrefs: 060294A2, 060294A7

Memory Dump Source

Source File: 00000000.00000002.1200601506.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6020000_1rjcA65eoG.jbxd

Similarity

API ID:
String ID: k7$s/
API String ID: 0-3895723279
Opcode ID: 9e79f8609b26fe484a89df31c86d567f48a17d47b5466cb7d3ad42dacf169f6b
Instruction ID: 235d3d6bc3e5fc8e0a98ca8be585217bcb4ef5738fbdb5c0f16d1d9eab0a7254
Opcode Fuzzy Hash: 9e79f8609b26fe484a89df31c86d567f48a17d47b5466cb7d3ad42dacf169f6b
Instruction Fuzzy Hash: AAC29EB4A012299FDBA4EF24D998B9DBBB1FF89301F1085E9D409A7354DB346E81CF50

Function 0602D248 Relevance: .8, Instructions: 814COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1200601506.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6020000_1rjcA65eoG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e911e75eae34b65855251f8dbe1039a34c2ac70896c1757597b4b2592ff0a7ec
Instruction ID: c8721af2ce2584dacf2b49ea017b2a69064e2c1ef7de574a11595a13e04ae8d7
Opcode Fuzzy Hash: e911e75eae34b65855251f8dbe1039a34c2ac70896c1757597b4b2592ff0a7ec
Instruction Fuzzy Hash: 9F826C74A502268FDBE5EB28D858B697BF2FF44304F1081E9E8099B396E7709D45CF60

Function 00CFAE30 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00CFB086

Memory Dump Source

Source File: 00000000.00000002.1188761419.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf0000_1rjcA65eoG.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 0185f7a5ed1b64ea4e07ba00a7b65dd3049a46f60475432deeddfe8b48819a23
Instruction ID: 2b08b1d043278bfb4676b924103663492e9ac17c3daed8c22d931afd9667fa88
Opcode Fuzzy Hash: 0185f7a5ed1b64ea4e07ba00a7b65dd3049a46f60475432deeddfe8b48819a23
Instruction Fuzzy Hash: E07156B0A00B098FD764DF69C0407AABBF1FF88304F10892DE15ADBA50DB75E905CB92

Function 00CF5935 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00CF59F1

Memory Dump Source

Source File: 00000000.00000002.1188761419.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf0000_1rjcA65eoG.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 77535f4c9feda11eaae987c5930ebd494fc8e0f8c3fa2534da4fddcf2bd894cf
Instruction ID: d61515440d204d1b5203e1a68c791e174464bddb02f7ba5ba9e41ca893ed4512
Opcode Fuzzy Hash: 77535f4c9feda11eaae987c5930ebd494fc8e0f8c3fa2534da4fddcf2bd894cf
Instruction Fuzzy Hash: BE4102B0D0061CCFDB24DFA9C984B9DBBB5BF48304F20856AD208BB251DBB56946CF91

Function 00CF4248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00CF59F1

Memory Dump Source

Source File: 00000000.00000002.1188761419.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf0000_1rjcA65eoG.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 442fac95f519c7623413bc26169f703d976fd3bb8f89257dccf81bb3df2cc49e
Instruction ID: 1e972311afc50c0819fc0ceebd1a94ffbb16a437754db089079ca240452052b1
Opcode Fuzzy Hash: 442fac95f519c7623413bc26169f703d976fd3bb8f89257dccf81bb3df2cc49e
Instruction Fuzzy Hash: 9541E0B0D0061CCBDB24DFA9C984B9DBBB5FF49304F20816AD608BB251DBB56945CF91

Function 00CFC9A0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00CFD2C6,?,?,?,?,?), ref: 00CFD387

Memory Dump Source

Source File: 00000000.00000002.1188761419.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf0000_1rjcA65eoG.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e0ff5ab792b0c2fa19034acf8e60a00b89a2fb10017bb6b6aa6f8405637b5c8e
Instruction ID: 53961ff614365bd9743c76c2a9d19c0d95780393803005c226b78a261810f0d4
Opcode Fuzzy Hash: e0ff5ab792b0c2fa19034acf8e60a00b89a2fb10017bb6b6aa6f8405637b5c8e
Instruction Fuzzy Hash: C821E6B59002489FDB10CF9AD984AEEBFF5EB48314F14801AEA15B3350D374A954CFA5

Function 00CFD2F9 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00CFD2C6,?,?,?,?,?), ref: 00CFD387

Memory Dump Source

Source File: 00000000.00000002.1188761419.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf0000_1rjcA65eoG.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2e63ca8aff4de773336c6b1d98418885a327f8cf49c1156c03b7cef2370be468
Instruction ID: 30d64a8f31005553b192cf6f0643045fbbf44c6b46fd23a965c1938314b1962d
Opcode Fuzzy Hash: 2e63ca8aff4de773336c6b1d98418885a327f8cf49c1156c03b7cef2370be468
Instruction Fuzzy Hash: B621E3B59002499FDB00CFA9D580AEEBBF5AB48314F14801AE958A3250C374A954CF65

Function 0602F998 Relevance: 1.6, APIs: 1, Instructions: 53
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(00000000,?,?,?,?,00000000,00000E20,?,?,0602FE76), ref: 0602FF7E

Memory Dump Source

Source File: 00000000.00000002.1200601506.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6020000_1rjcA65eoG.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e04b3045b84ea25e035c1a0089e01d337d3fd93837d104c4f26923f40c83071a
Instruction ID: 1f66f853146c28eb3700a766816a70894b65af19042add3d3e86d3b38d79b7cd
Opcode Fuzzy Hash: e04b3045b84ea25e035c1a0089e01d337d3fd93837d104c4f26923f40c83071a
Instruction Fuzzy Hash: DD1142B1C4021A8FCB50CF9AC504B9FFBF4EF88264F10801AE419A7210C3B9A541CFA0

Function 0602FF17 Relevance: 1.6, APIs: 1, Instructions: 51libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000,?,?,?,?,00000000,00000E20,?,?,0602FE76), ref: 0602FF7E

Memory Dump Source

Source File: 00000000.00000002.1200601506.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6020000_1rjcA65eoG.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a1ae2abdade29958aed012f35f5f58145dcd8864540c19a9f47aa9eda47eac9d
Instruction ID: 1a8cec574bb99d49a8570ba54cacff906cc0976168fa9bed269a7f558b78fe18
Opcode Fuzzy Hash: a1ae2abdade29958aed012f35f5f58145dcd8864540c19a9f47aa9eda47eac9d
Instruction Fuzzy Hash: 661123B5C0020A8FCB10CFAAC944B8FFBF4AF88224F10841AD419A7610C379A545CFA1

Function 00CFB020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00CFB086

Memory Dump Source

Source File: 00000000.00000002.1188761419.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf0000_1rjcA65eoG.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2f53fa1c614caaa83ef6b803425005a0f6c7faa4b6d29aef58483a0a9385639b
Instruction ID: 1f05bdb81266f97abca9c42250773342d556b030daa8a9c38214b43e8414369e
Opcode Fuzzy Hash: 2f53fa1c614caaa83ef6b803425005a0f6c7faa4b6d29aef58483a0a9385639b
Instruction Fuzzy Hash: 5611DFB5C007498FCB20CF9AD544B9EFBF4AB88324F10845AD569B7610C7B9AA45CFA1

Function 009BD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1188069442.00000000009BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bd000_1rjcA65eoG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abaa2b913b6fb63b561173e26f08edb5e074389f76453a5a59d962f8e46f9590
Instruction ID: 310cacaeb89d07149b2ceae3326a7d9b44f03f27d70ff2cf6683438f8eb55446
Opcode Fuzzy Hash: abaa2b913b6fb63b561173e26f08edb5e074389f76453a5a59d962f8e46f9590
Instruction Fuzzy Hash: E7216771504244DFDB25DF14DAC0F66BF65FBC8328F20C569E9090B25AD37AD806CBA2

Function 00CAD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1188534164.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cad000_1rjcA65eoG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebbac4dc0c143f4373501b88592fe7214cb0b519ca713e6653f0a237a86cf71d
Instruction ID: ea89b75fed12dc3eb65df28500e94c367ac64dde1cbfd12a3741f111c1ae3e4f
Opcode Fuzzy Hash: ebbac4dc0c143f4373501b88592fe7214cb0b519ca713e6653f0a237a86cf71d
Instruction Fuzzy Hash: 46212271604205DFDB14DF24D9C0B26BFA1FB89318F20C5A9E90B4B692C33AD807CA62

Function 00CAD005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1188534164.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cad000_1rjcA65eoG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61ab3165298c262fde8062bdda8729c6461ed84fa4d0c605c26d16fe3c6bff73
Instruction ID: 095db502f171e9f6f44e5e010b67192ad08193cb164d09c009e464332e91b7ae
Opcode Fuzzy Hash: 61ab3165298c262fde8062bdda8729c6461ed84fa4d0c605c26d16fe3c6bff73
Instruction Fuzzy Hash: 062183755093808FCB02CF24D590715BF71EB46318F28C5DAD84A8F6A7C33A990ACB62

Function 009BD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1188069442.00000000009BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bd000_1rjcA65eoG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da316f5fb5fcf084e9b5f44e6eb1c7c573228ef550d80c07cc5ac7d33c5d7b24
Instruction ID: fe330b88cd23553b7920456d3b36143e54c73733289f06246d6804e2c08803fb
Opcode Fuzzy Hash: da316f5fb5fcf084e9b5f44e6eb1c7c573228ef550d80c07cc5ac7d33c5d7b24
Instruction Fuzzy Hash: CE112972504240CFCB15CF10D6C4B56BF71FB84324F24C5A9E8050B25AC336D45ACBA1

Function 009BDA15 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1188069442.00000000009BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bd000_1rjcA65eoG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f465f180864d566802ffa59b4566deae7f83d93f5104644be47d0ac02c2e271a
Instruction ID: 993ec5bd314c547fad14bff5c21f4ed1cc0a433d5204a46121b76255d011f1b9
Opcode Fuzzy Hash: f465f180864d566802ffa59b4566deae7f83d93f5104644be47d0ac02c2e271a
Instruction Fuzzy Hash: 7F01267110E740AAE7108F29CE80BA7BFDCDF51374F18C45AED084A282E6799940CAB1

Function 009BDA14 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1188069442.00000000009BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bd000_1rjcA65eoG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07944607f44d19e24c6ff53ee2423a49d9f906af94eb0144e8aa98027d5dfa8d
Instruction ID: 67f18c0f769989834c02ed666025a4aec1c1c994dca0aa0b15552a5593360782
Opcode Fuzzy Hash: 07944607f44d19e24c6ff53ee2423a49d9f906af94eb0144e8aa98027d5dfa8d
Instruction Fuzzy Hash: B9F0C271509340AEE7108E15CD84BA2FFDCEB51338F18C05AED081A296D2799840CAB0

Non-executed Functions

Function 06024C00 Relevance: 2.7, Strings: 2, Instructions: 203COMMON

Download Yara Rule

Strings

$vq, xrefs: 06024D52
$vq, xrefs: 06024D62

Memory Dump Source

Source File: 00000000.00000002.1200601506.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6020000_1rjcA65eoG.jbxd

Similarity

API ID:
String ID: $vq$$vq
API String ID: 0-1900141992
Opcode ID: 253c15e1dc8a5292168ffc53af1c5e2ce570784b4b6a760e058852757f9313e7
Instruction ID: cb6faed3ac6e1ed0bf83d246e66cac15b858b6de343cba59d4d790f3862535ca
Opcode Fuzzy Hash: 253c15e1dc8a5292168ffc53af1c5e2ce570784b4b6a760e058852757f9313e7
Instruction Fuzzy Hash: B791E374E01228CFDB58DFA9D584A9DBBF2FF89305F608469E409AB354DB359986CF00

Function 06023BB0 Relevance: .5, Instructions: 528COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1200601506.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6020000_1rjcA65eoG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18031a969b0e91c88f8bf5f47ccc164af0889475fabeb65ef8f24b223898cfc2
Instruction ID: 30ece121095f7d70498f68c8bc559865d560c3d39c9dbaa53e43d67f7921b9d1
Opcode Fuzzy Hash: 18031a969b0e91c88f8bf5f47ccc164af0889475fabeb65ef8f24b223898cfc2
Instruction Fuzzy Hash: 8F428F74E012298FDB68DF65C994BDEBBB2BF49301F1085E9D409AB261DB349E81CF50

Function 06025B60 Relevance: .4, Instructions: 426COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1200601506.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6020000_1rjcA65eoG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a493efbcdf390b82a02c06ecd6ba6f0071936d119f44d291fde3f8483b18d79d
Instruction ID: edfe5f454fa3c33451284adc71591ebf1e3a61638cffeecd5351e4d4e0b5a2fd
Opcode Fuzzy Hash: a493efbcdf390b82a02c06ecd6ba6f0071936d119f44d291fde3f8483b18d79d
Instruction Fuzzy Hash: 1F227E74E012298FDBA5DF64C994BDDBBB1AF89300F1085EAD509A7250EB319EC5CF90

Function 06026770 Relevance: .4, Instructions: 400COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1200601506.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6020000_1rjcA65eoG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3d2932539fbd1c0c41539252c57d9ec9b1e9037410abcc8e8ac342b71df85fc
Instruction ID: 41dd74aab853f5f1e040d1da9f2c9e68a9703658509e798dbd4e8b62e3f2df52
Opcode Fuzzy Hash: d3d2932539fbd1c0c41539252c57d9ec9b1e9037410abcc8e8ac342b71df85fc
Instruction Fuzzy Hash: B2224974E012298FDB64DF68C994BDEBBB2AF49300F1085EAD509AB350DB319E85CF51

Function 06025190 Relevance: .4, Instructions: 363COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1200601506.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6020000_1rjcA65eoG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e83bd303cc239d7f0bd1b488840b40da95a31676ba764375c6293ef9e24f93f5
Instruction ID: f87173a89c71b1fcb97628ed7047933704518c0aa518a890711179008d7d1a7d
Opcode Fuzzy Hash: e83bd303cc239d7f0bd1b488840b40da95a31676ba764375c6293ef9e24f93f5
Instruction Fuzzy Hash: C102A074A01229CFDB69DF64C994B9EBBB2BF89300F1085E9D409A7350DB71AE85CF50

Function 06027D20 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1200601506.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6020000_1rjcA65eoG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c33b2397c9b77e7755e25d44e4bbefd80e9890dee670bad7fccac73c18b7a279
Instruction ID: cb1d3aac0133cfad04ec16930becdfad62e9008f2d64ba071fb6aae1eafd7845
Opcode Fuzzy Hash: c33b2397c9b77e7755e25d44e4bbefd80e9890dee670bad7fccac73c18b7a279
Instruction Fuzzy Hash: B9C171B4E01218CFDB58DFA9D890ADDBBB2BF89300F2085AAD419AB354DB345D85CF50

Function 00CFDC74 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1188761419.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf0000_1rjcA65eoG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9aa2d164eae876bbd42100bb655b0a0406cf064dca7544b60e7ba4788061f5d
Instruction ID: d5e5806433e559306136c4d1d530e1656e21f6c4b06a976234f77e85ccb0f40e
Opcode Fuzzy Hash: d9aa2d164eae876bbd42100bb655b0a0406cf064dca7544b60e7ba4788061f5d
Instruction Fuzzy Hash: 60A18D36E002098FCF05DFA4D8405EEB7B2FF84300B15457AEA06AB265DB71EE16DB91

Function 06022248 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1200601506.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6020000_1rjcA65eoG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1db4c9f1a204f85d9f466603849df640253ff409329b751f7999b8312d68ab
Instruction ID: ea28161a7810b8a346530ee69a92c029d5e178f6a2c5f235d83df96baf0003ca
Opcode Fuzzy Hash: 0e1db4c9f1a204f85d9f466603849df640253ff409329b751f7999b8312d68ab
Instruction Fuzzy Hash: 3DD1F531D2075A8ACB14EBA4D994A99B771FF95300F50CB9AE10A7B254FF706AC4CB81

Function 0602220F Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1200601506.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6020000_1rjcA65eoG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c878b3a40d0ebd20c5a79019279889c3956e907274abcd86de3c845fdfc3708e
Instruction ID: 7091ee529dc10b970ca1c16e36d7e36b912de68d54b228b4c68c260303087d49
Opcode Fuzzy Hash: c878b3a40d0ebd20c5a79019279889c3956e907274abcd86de3c845fdfc3708e
Instruction Fuzzy Hash: 00D11531D2075ACACB04EBA4D994699B771FF95300F60CB9AE14A7B215EF706EC4CB81

Function 06027D30 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1200601506.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6020000_1rjcA65eoG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ca037a1afee16659eeda6be7689d9d8d97b53421e5a885aaed0e49423af830e
Instruction ID: ec5f1c0e8c2e5e170cdf2cf09e603755bf263744245ad857ae1b1864336ca383
Opcode Fuzzy Hash: 7ca037a1afee16659eeda6be7689d9d8d97b53421e5a885aaed0e49423af830e
Instruction Fuzzy Hash: 67C17374E01219CFDB58DFA9D890B9DBBB2BF89300F1085AAD419AB354DB345D85CF50

Function 06027488 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1200601506.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6020000_1rjcA65eoG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e39853263f6b24851ff989ec8db9f2af82bc8fa246cd7a85161b3b1e626134de
Instruction ID: a1f6e7dc274e8624e66a3f1b4c248a151936b3eeab1f357494c0e862f52f9473
Opcode Fuzzy Hash: e39853263f6b24851ff989ec8db9f2af82bc8fa246cd7a85161b3b1e626134de
Instruction Fuzzy Hash: 83B1B474E01229CFDB64DF69C984B9DBBB2BF89300F1085AAD409A7351DB309D85CF50

Function 06028270 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1200601506.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6020000_1rjcA65eoG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34d1c373d010eb7a70057e5e498e27b13f931a1c8272befee88c365c0416fbf6
Instruction ID: cebd6f4aea55bf28e1810a3b7073e4f2fa20e5ab382f639455d0d4843f9ca126
Opcode Fuzzy Hash: 34d1c373d010eb7a70057e5e498e27b13f931a1c8272befee88c365c0416fbf6
Instruction Fuzzy Hash: 9491D574D01229DFDBA4DF69D990B9DBBB2BF49304F1081A9D409A7351DB306E89CF50

Function 0602740D Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1200601506.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6020000_1rjcA65eoG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 857518c39feadad4ad097142771746da49720acb311870ba4b90fa7a4fbc1c8d
Instruction ID: d1a41812618f031102e289192cf13d6dc44ab1e25b496cae363f6152d786c834
Opcode Fuzzy Hash: 857518c39feadad4ad097142771746da49720acb311870ba4b90fa7a4fbc1c8d
Instruction Fuzzy Hash: 8B416F71D053658FEB1ACF6AC8503DEBFB2AF86310F14C0AAC458AB252DB745949CF51

Function 0602742D Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1200601506.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6020000_1rjcA65eoG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2f9d28bbe872c279fa1edbe21941e529f433fafac524e9aefaeabf39b2776fa
Instruction ID: 83403d1de9cd290079041c4fa724481eebe1c9ca7b0904a9704081934b488c6d
Opcode Fuzzy Hash: e2f9d28bbe872c279fa1edbe21941e529f433fafac524e9aefaeabf39b2776fa
Instruction Fuzzy Hash: BA414D71D053698FEB19DF7AC8503DEBFB2AF86210F14C0AAC858AB252DB744949CF51

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1rjcA65eoG.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1rjcA65eoG.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Suricata IDS Alerts

TCP Packets

Statistics

Windows Analysis Report
1rjcA65eoG.exe