Edit tour

Windows Analysis Report
GbZkRO8wav.exe

Overview

General Information

Sample name:	GbZkRO8wav.exe renamed because original name is a hash value
Original sample name:	5a2a3883dbb564b4ae87d05707d4cd5d.exe
Analysis ID:	1410598
MD5:	5a2a3883dbb564b4ae87d05707d4cd5d
SHA1:	b277cc5fd2358ba865e011fe9d8c2f89c40a0649
SHA256:	939bd5097a5a1c3d3ecae7d6f90194e47a6d20fa0e7c21d68679be9ea5c65f2f
Tags:	32exetrojan
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected RedLine Stealer

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to dynamically determine API calls

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

GbZkRO8wav.exe (PID: 6640 cmdline: C:\Users\user\Desktop\GbZkRO8wav.exe MD5: 5A2A3883DBB564B4AE87D05707D4CD5D)

conhost.exe (PID: 6672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["45.15.156.127:48665"], "Authorization Header": "e10fca6d250234006804955717161ae9"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.2820958513.0000000000AE4000.00000004.00000010.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.2821360432.0000000000D72000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: GbZkRO8wav.exe PID: 6640	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: GbZkRO8wav.exe PID: 6640	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.GbZkRO8wav.exe.ae5e58.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.GbZkRO8wav.exe.ae5e58.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.GbZkRO8wav.exe.d70000.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Snort Signatures

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 45.15.156.127 - Destination IP: 192.168.2.4

Timestamp:	03/18/24-07:31:04.775194
SID:	2043234
Source Port:	48665
Destination Port:	49729
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) - Source IP: 45.15.156.127 - Destination IP: 192.168.2.4

Timestamp:	03/18/24-07:31:10.484173
SID:	2046056
Source Port:	48665
Destination Port:	49729
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 45.15.156.127

Timestamp:	03/18/24-07:32:57.280683
SID:	2043231
Source Port:	49729
Destination Port:	48665
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.4 - Destination IP: 45.15.156.127

Timestamp:	03/18/24-07:31:04.561191
SID:	2046045
Source Port:	49729
Destination Port:	48665
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: 45.15.156.127:48665

Avira URL Cloud: Label: malware

Found malware configuration

Source: 0.2.GbZkRO8wav.exe.ae5e58.0.raw.unpack

Malware Configuration Extractor: RedLine {"C2 url": ["45.15.156.127:48665"], "Authorization Header": "e10fca6d250234006804955717161ae9"}

Multi AV Scanner detection for domain / URL

Source: 45.15.156.127:48665

Virustotal: Detection: 14%

Perma Link

Multi AV Scanner detection for submitted file

Source: GbZkRO8wav.exe	ReversingLabs: Detection: 73%
Source: GbZkRO8wav.exe	Virustotal: Detection: 78%			Perma Link

Machine Learning detection for sample

Source: GbZkRO8wav.exe

Joe Sandbox ML: detected

Source: GbZkRO8wav.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE

Source: GbZkRO8wav.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: ActionCenter.pdb source: GbZkRO8wav.exe
Source:	Binary string: ActionCenter.pdbUGP source: GbZkRO8wav.exe

Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 4x nop then jmp 078D844Dh	0_2_078D842C
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 4x nop then jmp 07E7959Bh	0_2_07E792D8
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 4x nop then jmp 07E765BAh	0_2_07E75D18
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 4x nop then jmp 07E7CEC8h	0_2_07E7C9D0
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 4x nop then jmp 07E7AAC3h	0_2_07E7A800
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 4x nop then jmp 07E78629h	0_2_07E78611
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 4x nop then jmp 07E7613Ah	0_2_07E76124
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 4x nop then jmp 07E7613Ah	0_2_07E76094

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) 192.168.2.4:49729 -> 45.15.156.127:48665
Source: Traffic	Snort IDS: 2043231 ET TROJAN Redline Stealer TCP CnC Activity 192.168.2.4:49729 -> 45.15.156.127:48665
Source: Traffic	Snort IDS: 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response 45.15.156.127:48665 -> 192.168.2.4:49729
Source: Traffic	Snort IDS: 2046056 ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) 45.15.156.127:48665 -> 192.168.2.4:49729

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 45.15.156.127:48665

Source: global traffic

TCP traffic: 192.168.2.4:49729 -> 45.15.156.127:48665

Source: Joe Sandbox View

IP Address: 45.15.156.127 45.15.156.127

Source: Joe Sandbox View

ASN Name: RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU

Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127

Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.000000000373E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003736000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.000000000373E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003942000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.000000000373E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003942000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003942000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14V
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.000000000373E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.000000000373E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.000000000373E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.000000000373E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.000000000373E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.000000000373E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.000000000373E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003942000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.000000000373E000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003942000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.000000000373E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.000000000373E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.000000000373E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.000000000373E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.000000000373E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: GbZkRO8wav.exe, 00000000.00000003.2808721570.0000000004B4A000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003B6B000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000003.2808721570.0000000004B30000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003C02000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003BA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2820958513.0000000000AE4000.00000004.00000010.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2821360432.0000000000D72000.00000020.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: GbZkRO8wav.exe, 00000000.00000003.2808721570.0000000004B4A000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003B6B000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000003.2808721570.0000000004B30000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003C02000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003BA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: GbZkRO8wav.exe, 00000000.00000003.2808721570.0000000004B4A000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003B6B000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000003.2808721570.0000000004B30000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003C02000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003BA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: GbZkRO8wav.exe, 00000000.00000003.2808721570.0000000004B4A000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003B6B000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000003.2808721570.0000000004B30000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003C02000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003BA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: GbZkRO8wav.exe, 00000000.00000003.2808721570.0000000004B4A000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003B6B000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000003.2808721570.0000000004B30000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003C02000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003BA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: GbZkRO8wav.exe, 00000000.00000003.2808721570.0000000004B4A000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003BA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003B6B000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000003.2808721570.0000000004B30000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003C02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabS
Source: GbZkRO8wav.exe, 00000000.00000003.2808721570.0000000004B4A000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003B6B000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000003.2808721570.0000000004B30000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003C02000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003BA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: GbZkRO8wav.exe, 00000000.00000003.2808721570.0000000004B4A000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003B6B000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000003.2808721570.0000000004B30000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003C02000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003BA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: GbZkRO8wav.exe, 00000000.00000003.2808721570.0000000004B4A000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003B6B000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000003.2808721570.0000000004B30000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003C02000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003BA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_0115DC74	0_2_0115DC74
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_078D7780	0_2_078D7780
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_078D47F0	0_2_078D47F0
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_078DA6C0	0_2_078DA6C0
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_078D4E49	0_2_078D4E49
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_078D84E0	0_2_078D84E0
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_078D63D8	0_2_078D63D8
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_078D6B22	0_2_078D6B22
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_078D52C9	0_2_078D52C9
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_078D0980	0_2_078D0980
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_078D59D0	0_2_078D59D0
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_078D4018	0_2_078D4018
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_078D378F	0_2_078D378F
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_078D37A0	0_2_078D37A0
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_078D84D1	0_2_078D84D1
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_078D33E0	0_2_078D33E0
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_078D1289	0_2_078D1289
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_078D1298	0_2_078D1298
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_078D59C0	0_2_078D59C0
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_078D0970	0_2_078D0970
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_07E775C0	0_2_07E775C0
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_07E792D8	0_2_07E792D8
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_07E7B230	0_2_07E7B230
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_07E76F80	0_2_07E76F80
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_07E77D28	0_2_07E77D28
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_07E75D18	0_2_07E75D18
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_07E78BE1	0_2_07E78BE1
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_07E7EA60	0_2_07E7EA60
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_07E7C9D0	0_2_07E7C9D0
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_07E74248	0_2_07E74248
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_07E74238	0_2_07E74238
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_07E76F70	0_2_07E76F70
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_07E79DD0	0_2_07E79DD0
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_07E75D09	0_2_07E75D09

Source: GbZkRO8wav.exe

Static PE information: Number of sections : 16 > 10

Source: GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs GbZkRO8wav.exe
Source: GbZkRO8wav.exe, 00000000.00000002.2820958513.0000000000AE4000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWitloofs.exe8 vs GbZkRO8wav.exe
Source: GbZkRO8wav.exe, 00000000.00000000.1633068499.0000000000BF9000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameACTIONCENTER.DLLj% vs GbZkRO8wav.exe
Source: GbZkRO8wav.exe, 00000000.00000002.2822248292.000000000116E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs GbZkRO8wav.exe
Source: GbZkRO8wav.exe, 00000000.00000002.2821155073.0000000000BFA000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameACTIONCENTER.DLLj% vs GbZkRO8wav.exe
Source: GbZkRO8wav.exe, 00000000.00000002.2821393374.0000000000DB4000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWitloofs.exe8 vs GbZkRO8wav.exe
Source: GbZkRO8wav.exe	Binary or memory string: OriginalFilenameACTIONCENTER.DLLj% vs GbZkRO8wav.exe

Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Section loaded: ntasn1.dll	Jump to behavior

Source: GbZkRO8wav.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@2/1@0/1

Source: C:\Users\user\Desktop\GbZkRO8wav.exe

File created: C:\Users\user\AppData\Local\SystemCache

Jump to behavior

Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6672:120:WilError_03

Source: GbZkRO8wav.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\GbZkRO8wav.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: C:\Users\user\Desktop\GbZkRO8wav.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: GbZkRO8wav.exe	ReversingLabs: Detection: 73%
Source: GbZkRO8wav.exe	Virustotal: Detection: 78%

Source: unknown	Process created: C:\Users\user\Desktop\GbZkRO8wav.exe C:\Users\user\Desktop\GbZkRO8wav.exe
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\GbZkRO8wav.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: GbZkRO8wav.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: ActionCenter.pdb source: GbZkRO8wav.exe
Source:	Binary string: ActionCenter.pdbUGP source: GbZkRO8wav.exe

Source: C:\Users\user\Desktop\GbZkRO8wav.exe

Code function: 0_2_00BF25C9 memcpy,VirtualAlloc,VirtualAlloc,memcpy,memcpy,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,memcpy,lstrlenW,CreateThread,CreateThread,Sleep,Sleep,memcpy,WaitForSingleObject,

0_2_00BF25C9

Source: GbZkRO8wav.exe	Static PE information: section name: /4
Source: GbZkRO8wav.exe	Static PE information: section name: /14
Source: GbZkRO8wav.exe	Static PE information: section name: /29
Source: GbZkRO8wav.exe	Static PE information: section name: /41
Source: GbZkRO8wav.exe	Static PE information: section name: /55
Source: GbZkRO8wav.exe	Static PE information: section name: /67
Source: GbZkRO8wav.exe	Static PE information: section name: /80
Source: GbZkRO8wav.exe	Static PE information: section name: /91

Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_00C49A9B push edi; retf	0_2_00C49A9D
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_00C49A4E push ecx; iretd	0_2_00C49A51
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_00C4C67B push 00000045h; iretd	0_2_00C4C681
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_00C4CBE2 pushfd ; retf	0_2_00C4CBEB
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_00C4D5B5 push esp; ret	0_2_00C4D5B9
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_00C4A12D push ebx; ret	0_2_00C4A133
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_00C4993C push eax; iretd	0_2_00C4993D
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_07E750C0 push 00000059h; ret	0_2_07E750CE
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_07E71B00 pushad ; ret	0_2_07E71B01
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_07E71A58 push esp; ret	0_2_07E71A59

Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\GbZkRO8wav.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\GbZkRO8wav.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Memory allocated: 1150000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Memory allocated: 3660000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Memory allocated: 3320000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Window / User API: threadDelayed 695			Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Window / User API: threadDelayed 2074			Jump to behavior

Source: C:\Users\user\Desktop\GbZkRO8wav.exe TID: 7080	Thread sleep time: -5534023222112862s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe TID: 6836	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\GbZkRO8wav.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: GbZkRO8wav.exe, 00000000.00000003.2820149822.0000000001245000.00000004.00000020.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2822248292.0000000001245000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\GbZkRO8wav.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\GbZkRO8wav.exe

Code function: 0_2_07E7B230 LdrInitializeThunk,

0_2_07E7B230

Source: C:\Users\user\Desktop\GbZkRO8wav.exe

0_2_00BF25C9

Source: C:\Users\user\Desktop\GbZkRO8wav.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_00BF1160 Sleep,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm,_cexit,exit,		0_2_00BF1160
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Code function: 0_2_00BF1187 SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,__initenv,		0_2_00BF1187

Source: C:\Users\user\Desktop\GbZkRO8wav.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\GbZkRO8wav.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: GbZkRO8wav.exe, 00000000.00000003.2807560130.0000000006071000.00000004.00000020.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000003.2807513453.0000000006023000.00000004.00000020.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000003.2818802933.000000000607C000.00000004.00000020.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000003.2807981939.0000000005FEC000.00000004.00000020.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000003.2807654772.000000000607B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\GbZkRO8wav.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.GbZkRO8wav.exe.ae5e58.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.GbZkRO8wav.exe.ae5e58.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.GbZkRO8wav.exe.d70000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2820958513.0000000000AE4000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2821360432.0000000000D72000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: GbZkRO8wav.exe PID: 6640, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\GbZkRO8wav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\GbZkRO8wav.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\GbZkRO8wav.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: GbZkRO8wav.exe PID: 6640, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.GbZkRO8wav.exe.ae5e58.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.GbZkRO8wav.exe.ae5e58.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.GbZkRO8wav.exe.d70000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2820958513.0000000000AE4000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2821360432.0000000000D72000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: GbZkRO8wav.exe PID: 6640, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	1 OS Credential Dumping	231 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	113 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
GbZkRO8wav.exe	74%	ReversingLabs	Win32.Trojan.RedLine
GbZkRO8wav.exe	78%	Virustotal		Browse
GbZkRO8wav.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
https://api.ip.sb/ip	0%	URL Reputation	safe
http://tempuri.org/Entity/Id23ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12Response	0%	Avira URL Cloud	safe
http://tempuri.org/	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id2Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id2Response	2%	Virustotal		Browse
http://tempuri.org/	1%	Virustotal		Browse
45.15.156.127:48665	100%	Avira URL Cloud	malware
http://tempuri.org/Entity/Id14ResponseD	2%	Virustotal		Browse
http://tempuri.org/Entity/Id9	1%	Virustotal		Browse
http://tempuri.org/Entity/Id8	1%	Virustotal		Browse
http://tempuri.org/Entity/Id21Response	4%	Virustotal		Browse
http://tempuri.org/Entity/Id12Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id6ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id4	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id7	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6	0%	Avira URL Cloud	safe
45.15.156.127:48665	14%	Virustotal		Browse
http://tempuri.org/Entity/Id19Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id4	1%	Virustotal		Browse
http://tempuri.org/Entity/Id13ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id5	1%	Virustotal		Browse
http://tempuri.org/Entity/Id7	1%	Virustotal		Browse
http://tempuri.org/Entity/Id15Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14V	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6	1%	Virustotal		Browse
http://tempuri.org/Entity/Id13ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id6Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id6Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id5ResponseD	2%	Virustotal		Browse
http://tempuri.org/Entity/Id15Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id1ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id14V	1%	Virustotal		Browse
http://tempuri.org/Entity/Id1ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id20	1%	Virustotal		Browse
http://tempuri.org/Entity/Id9Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id9Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id20	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21	1%	Virustotal		Browse
http://tempuri.org/Entity/Id24Response	1%	Virustotal		Browse
http://tempuri.org/Entity/Id1Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id11	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23	1%	Virustotal		Browse
http://tempuri.org/Entity/Id10ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id16Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10	1%	Virustotal		Browse
http://tempuri.org/Entity/Id13	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24	1%	Virustotal		Browse
http://tempuri.org/Entity/Id11	1%	Virustotal		Browse
http://tempuri.org/Entity/Id14	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12	1%	Virustotal		Browse
http://tempuri.org/Entity/Id16Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id17	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id18	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22	1%	Virustotal		Browse
http://tempuri.org/Entity/Id19	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17ResponseD	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
45.15.156.127:48665	true	14%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	GbZkRO8wav.exe, 00000000.00000003.2808721570.0000000004B4A000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003BA4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	GbZkRO8wav.exe, 00000000.00000003.2808721570.0000000004B4A000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003B6B000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000003.2808721570.0000000004B30000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003C02000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003BA4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id14ResponseD	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003942000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003942000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id12Response	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id2Response	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21Response	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6ResponseD	GbZkRO8wav.exe, 00000000.00000002.2824151021.000000000373E000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id4	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id7	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id19Response	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13ResponseD	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15Response	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5ResponseD	GbZkRO8wav.exe, 00000000.00000002.2824151021.000000000373E000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14V	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003942000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	GbZkRO8wav.exe, 00000000.00000002.2824151021.000000000373E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id6Response	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/ip	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2820958513.0000000000AE4000.00000004.00000010.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2821360432.0000000000D72000.00000020.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id1ResponseD	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9Response	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	GbZkRO8wav.exe, 00000000.00000003.2808721570.0000000004B4A000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003B6B000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000003.2808721570.0000000004B30000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003C02000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003BA4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id20	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id22	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id23	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24Response	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	GbZkRO8wav.exe, 00000000.00000003.2808721570.0000000004B4A000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003B6B000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000003.2808721570.0000000004B30000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003C02000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003BA4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id1Response	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21ResponseD	GbZkRO8wav.exe, 00000000.00000002.2824151021.000000000373E000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003736000.00000004.00000800.00020000.00000000.sdmp, GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id11	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10ResponseD	GbZkRO8wav.exe, 00000000.00000002.2824151021.000000000373E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16Response	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id17	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id18	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5Response	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15ResponseD	GbZkRO8wav.exe, 00000000.00000002.2824151021.000000000373E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10Response	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id11ResponseD	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003942000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8Response	GbZkRO8wav.exe, 00000000.00000002.2824151021.0000000003661000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	GbZkRO8wav.exe, 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id17ResponseD	GbZkRO8wav.exe, 00000000.00000002.2824151021.000000000373E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.15.156.127	unknown	Russian Federation		39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1410598
Start date and time:	2024-03-18 07:30:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	GbZkRO8wav.exe renamed because original name is a hash value
Original Sample Name:	5a2a3883dbb564b4ae87d05707d4cd5d.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@2/1@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 48 Number of non-executed functions: 23
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
07:32:55	API Interceptor	15x Sleep call for process: GbZkRO8wav.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
45.15.156.127	lnker.lnk	Get hash	malicious	RedLine	Browse
	driver.exe	Get hash	malicious	RedLine	Browse
	Eclipse.exe	Get hash	malicious	AsyncRAT, PureLog Stealer, RHADAMANTHYS, RedLine, XWorm, zgRAT	Browse
	7bXVSwc9dp.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse
	SecuriteInfo.com.Trojan.Agent.446.6903.exe	Get hash	malicious	RedLine	Browse
	axfdj9gfw.exe	Get hash	malicious	RedLine	Browse
	last.exe	Get hash	malicious	RedLine, Xmrig	Browse
	edgag365.exe	Get hash	malicious	RedLine	Browse
	Shxdow.exe	Get hash	malicious	RedLine	Browse
	GLP3Q0PFY4.exe	Get hash	malicious	RedLine	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	1nj V2.exe	Get hash	malicious	RedLine	Browse	45.15.156.142
	Setup.exe	Get hash	malicious	LummaC, PureLog Stealer, Xmrig	Browse	45.15.156.43
	tUQhE2rI9a.exe	Get hash	malicious	PureLog Stealer	Browse	45.15.156.43
	hQmSR2hm9z.elf	Get hash	malicious	Mirai, Gafgyt	Browse	5.42.35.254
	ld7ipzWnHE.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse	5.42.65.117
	QN1omDissd.exe	Get hash	malicious	Amadey, Glupteba, Mars Stealer, Stealc, Vidar	Browse	5.42.64.44
	AwV2hldmu0.exe	Get hash	malicious	Amadey, Glupteba, Mars Stealer, Stealc, Vidar	Browse	5.42.64.44
	BIG BASE 50,000 CC LEAKED FOR FREE --- VALID RATE 30% .txt.pif.exe	Get hash	malicious	RedLine	Browse	5.42.65.15
	jKiqguIdjl.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, PureLog Stealer, RedLine	Browse	5.42.65.31
	file.exe	Get hash	malicious	Amadey, Glupteba	Browse	5.42.64.44

Process:	C:\Users\user\Desktop\GbZkRO8wav.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3094
Entropy (8bit):	5.33145931749415
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0atTqdqlq7qV
MD5:	3FD5C0634443FB2EF2796B9636159CB6
SHA1:	366DDE94AEFCFFFAB8E03AD8B448E05D7489EB48
SHA-256:	58307E94C67E2348F5A838DE4FF668983B38B7E9A3B1D61535D3A392814A57D6
SHA-512:	8535E7C0777C6B0876936D84BDE2BDC59963CF0954D4E50D65808E6E806E8B131DF5DB8FA0E030FAE2702143A7C3A70698A2B9A80519C9E2FFC286A71F0B797C
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	6.549680372656925
TrID:	Win32 Executable (generic) a (10002005/4) 99.53% InstallShield setup (43055/19) 0.43% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	GbZkRO8wav.exe
File size:	693'494 bytes
MD5:	5a2a3883dbb564b4ae87d05707d4cd5d
SHA1:	b277cc5fd2358ba865e011fe9d8c2f89c40a0649
SHA256:	939bd5097a5a1c3d3ecae7d6f90194e47a6d20fa0e7c21d68679be9ea5c65f2f
SHA512:	6445528d36370335ee6d9ef7a8424e970e49730689d576755e23c83d603bbf6a09e2a1ebceee42149c0d16424a7256525cff478d5b352241ce65a4b0950c88aa
SSDEEP:	12288:2txcN49VQbkeWL/+wdxc38oZrYu1Oi2hZABT5gsMAE:2g4DUOL/+k5u1FaWgsMAE
TLSH:	8EE41AA4B25940BAF8E5D2B8F4730B419BF0E52E53879FD71329D25EAC33A81417931B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...8..e.@.............'.t... ....................@.......................................@... ............................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4013f0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x65E9FC38 [Thu Mar 7 17:41:12 2024 UTC]
TLS Callbacks:	0x407350, 0x407300
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e7d857a6b1d7de1b6c756d2d381fe554

Entrypoint Preview

Instruction
mov dword ptr [004A4060h], 00000000h
jmp 00007FCEAD2A4916h
nop
sub esp, 1Ch
mov eax, dword ptr [esp+20h]
mov dword ptr [esp], eax
call 00007FCEAD2AB9F6h
cmp eax, 01h
sbb eax, eax
add esp, 1Ch
ret
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 1Ch
mov dword ptr [esp], 00458000h
call dword ptr [004A5104h]
sub esp, 04h
test eax, eax
je 00007FCEAD2A4C25h
mov ebx, eax
mov dword ptr [esp], 00458000h
call dword ptr [004A5114h]
mov edi, dword ptr [004A5108h]
sub esp, 04h
mov dword ptr [004A4020h], eax
mov dword ptr [esp+04h], 00458013h
mov dword ptr [esp], ebx
call edi
sub esp, 08h
mov esi, eax
mov dword ptr [esp+04h], 00458029h
mov dword ptr [esp], ebx
call edi
sub esp, 08h
mov dword ptr [00409000h], eax
test esi, esi
je 00007FCEAD2A4BC3h
mov dword ptr [esp+04h], 004A4024h
mov dword ptr [esp], 004A3104h
call esi
mov dword ptr [esp], 004014C0h
call 00007FCEAD2A4B13h
lea esp, dword ptr [ebp-0Ch]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esi, dword ptr [esi+00000000h]
mov eax, 00000000h
mov esi, 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa5000	0x4c8	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa8000	0x6cc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xa2100	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xa50ec	0xb0	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x72e4	0x7400	74e8f805ccf168279ff04614e2badd51	False	0.5823006465517241	data	6.214582780953433	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x9000	0x4eae4	0x4ec00	2d46c115442f8e9a6808ad5dfd812d01	False	0.38394097222222223	data	5.699285244984914	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x58000	0x4a3dc	0x4a400	417921427580e042424ae3ff71c66fa2	False	0.5672052556818182	data	6.554379885183367	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
/4	0xa3000	0x878	0xa00	b7b716b8d04a9cc1f78ee95f6896cbc8	False	0.381640625	data	4.2115834067786615	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0xa4000	0xb4	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xa5000	0x4c8	0x600	cb918f4f46d758adf1f6582eb0bef404	False	0.3821614583333333	data	4.268630174129219	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0xa6000	0x30	0x200	6db04e43bbf2d0296bc3733768940703	False	0.060546875	data	0.2005819074398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xa7000	0x8	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0xa8000	0x6cc	0x800	bdb694af8a5572396a8bd7b110049f7b	False	0.7626953125	data	6.174888764366186	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/14	0xa9000	0x38	0x200	d72390d2be68565b7713b67658653429	False	0.068359375	Matlab v4 mat-file (little endian) *, rows 2, columns 262144	0.2162069074398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/29	0xaa000	0xf90	0x1000	ea5221ef583a767121f372cffacca545	False	0.385009765625	data	5.207600460490483	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/41	0xab000	0xaf	0x200	559a85e909e773073b8b6d2f9bb39a3a	False	0.294921875	data	2.128627013155538	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/55	0xac000	0xa0	0x200	86772e0acc535194b34c9872681f3a71	False	0.216796875	data	1.4730559609214668	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/67	0xad000	0x38	0x200	d347abad98891986aa5e8bdd56b59062	False	0.1171875	data	0.6745765448489234	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/80	0xae000	0xa3	0x200	1bc45059f0d7f969b315a0a3952c1460	False	0.279296875	data	2.4397345742604513	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/91	0xaf000	0x1f8	0x200	9c35e75102ba33cda78bcb75595d04e4	False	0.330078125	data	4.770094291751421	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	CreateThread, DeleteCriticalSection, EnterCriticalSection, FreeConsole, FreeLibrary, GetLastError, GetModuleHandleA, GetProcAddress, InitializeCriticalSection, LeaveCriticalSection, LoadLibraryA, SetUnhandledExceptionFilter, Sleep, TlsGetValue, VirtualAlloc, VirtualProtect, VirtualQuery, WaitForSingleObject, lstrlenW
msvcrt.dll	__getmainargs, __initenv, __p__commode, __p__fmode, __set_app_type, __setusermatherr, _amsg_exit, _cexit, _initterm, _iob, _onexit, abort, calloc, exit, fprintf, free, fwrite, malloc, memcpy, signal, strlen, strncmp, vfprintf

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
03/18/24-07:31:04.775194	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	48665	49729	45.15.156.127	192.168.2.4
03/18/24-07:31:10.484173	TCP	2046056	ET TROJAN Redline Stealer/MetaStealer Family Activity (Response)	48665	49729	45.15.156.127	192.168.2.4
03/18/24-07:32:57.280683	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49729	48665	192.168.2.4	45.15.156.127
03/18/24-07:31:04.561191	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	49729	48665	192.168.2.4	45.15.156.127

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 18, 2024 07:31:03.588308096 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:03.799721003 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:03.799822092 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:03.921761036 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:04.134156942 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:04.186094999 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:04.561191082 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:04.775193930 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:04.824403048 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:10.265126944 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:10.484173059 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:10.484558105 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:10.484637976 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:10.484694004 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:10.484725952 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:10.484745026 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:10.484770060 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:10.527504921 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:10.837644100 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:10.922801971 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:10.922929049 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:11.055530071 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:11.069320917 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:11.433756113 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:11.581829071 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:11.581923008 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:11.657836914 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:11.699496984 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:11.739195108 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:12.105809927 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:12.196201086 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:12.196269989 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:12.716007948 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:12.716208935 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:12.855745077 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:13.110392094 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:13.111326933 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:15.702147007 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:20.871287107 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:21.125497103 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:39.214989901 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:39.466913939 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:39.467175961 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:39.678945065 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:39.679136038 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:39.891180992 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:39.891196012 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:39.891370058 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:40.103285074 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:40.104759932 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:40.110657930 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:40.322565079 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:40.332055092 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:40.543895960 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:40.589984894 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:40.667032957 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:40.878707886 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:40.911165953 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:41.123130083 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:41.137324095 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:41.350245953 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:41.367131948 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:41.579025030 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:41.585689068 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:41.797580004 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:41.798724890 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:42.010241032 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:42.058762074 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:42.202424049 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:42.414499044 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:42.414664984 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:42.414931059 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:42.415015936 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:42.455147982 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:42.455334902 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:42.626359940 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:42.626429081 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:42.626805067 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:42.626859903 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:42.626950979 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:42.627046108 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:42.666690111 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:42.666867971 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:42.706969976 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:42.707272053 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:42.837718010 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:42.838484049 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:42.838618040 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:42.838710070 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:42.878149986 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:42.878235102 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:42.959487915 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:42.959566116 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:43.051635981 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:43.051695108 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:43.051724911 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:43.051762104 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:43.051827908 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:43.051868916 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:43.051899910 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:43.051919937 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:43.089910030 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:43.090214014 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:43.170912027 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:43.171000957 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:43.263348103 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:43.263380051 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:43.263422966 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:43.263464928 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:43.263582945 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:43.263648033 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:43.263890982 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:43.263958931 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:43.301727057 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:43.301825047 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:43.382756948 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:43.382847071 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:43.474884033 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:43.474997997 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:43.475578070 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:43.475589991 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:43.475662947 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:43.475667000 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:43.475692034 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:43.475739956 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:43.475774050 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:43.513113976 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:43.513127089 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:43.513238907 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:43.664853096 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:43.665090084 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:43.665097952 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:43.665185928 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:43.665314913 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:43.691318035 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:43.691514015 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:43.876388073 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:43.876492023 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:43.876532078 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:43.876540899 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:43.876609087 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:43.876629114 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:43.876966953 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:43.877027035 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:43.904649019 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:43.904839993 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:44.087991953 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:44.088025093 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:44.088083982 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:44.088118076 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:44.088309050 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:44.088325024 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:44.088340044 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:44.088504076 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:44.116067886 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:44.116102934 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:44.116312027 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:44.299576044 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:44.299655914 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:44.327662945 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:44.327750921 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:44.327927113 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:44.327991962 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:44.328443050 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:44.328526020 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:44.511069059 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:44.511281967 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:44.539665937 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:44.539683104 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:44.539890051 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:44.539891005 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:44.539917946 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:44.539966106 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:44.540009975 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:44.540009975 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:44.540056944 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:44.723017931 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:44.723227024 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:44.751310110 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:44.751537085 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:44.751991034 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:44.752007961 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:44.752073050 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:44.754400969 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:44.754482985 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:44.754869938 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:44.754934072 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:44.934833050 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:44.934932947 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:44.973268986 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:44.973359108 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:44.973464012 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:44.973521948 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:44.973602057 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:44.973663092 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:44.973989010 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:44.974034071 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:44.974147081 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:44.974220037 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:45.009871006 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:45.009965897 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:45.149430037 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:45.149604082 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:45.185935020 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:45.186059952 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:45.186121941 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:45.186187983 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:45.186687946 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:45.186774015 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:45.186871052 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:45.186928034 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:45.187657118 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:45.187697887 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:45.187712908 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:45.187722921 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:45.187733889 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:45.187751055 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:45.187813997 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:45.300287962 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:45.300448895 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:45.369098902 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:45.369316101 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:45.402358055 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:45.402370930 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:45.402379990 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:45.402385950 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:45.402513981 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:45.406632900 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:45.406680107 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:45.406689882 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:45.406717062 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:45.406763077 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:45.442457914 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:45.442526102 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:45.552972078 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:45.553056955 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:45.592989922 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:45.593291044 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:45.623049974 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:45.623060942 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:45.623136997 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:45.623155117 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:45.623214006 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:45.623220921 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:45.623306990 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:45.654850006 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:45.654942036 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:45.814626932 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:45.814640045 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:45.814846992 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:45.843656063 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:45.843812943 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:45.843842983 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:45.843854904 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:45.843872070 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:45.843913078 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:45.843986988 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:45.843986988 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:45.887986898 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:45.888062000 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:46.060205936 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:46.060225010 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:46.060235023 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:46.060245037 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:46.060256004 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:46.060266018 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:46.060286045 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:46.060317039 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:46.060338974 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:46.060360909 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:46.060395002 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:46.107213974 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:46.107296944 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:46.334811926 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:46.334922075 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:46.334939957 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:46.335000038 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:46.335011959 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:46.335089922 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:46.365804911 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:46.366013050 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:46.546396971 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:46.546511889 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:46.546756983 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:46.546768904 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:46.546777964 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:46.546842098 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:46.643768072 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:46.643835068 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:46.758920908 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:46.759067059 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:46.759171009 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:46.759233952 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:46.759947062 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:46.760015965 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:46.760109901 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:46.760169029 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:47.032383919 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:47.032470942 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:47.496330976 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:47.623536110 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:48.418101072 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:48.634287119 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:48.634393930 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:48.846443892 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:48.846462011 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:48.846571922 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:48.846571922 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:49.128182888 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:49.128200054 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:49.130911112 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:49.343931913 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:49.344139099 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:49.555890083 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:49.555907965 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:49.555953979 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:49.555985928 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:49.556699038 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:49.556746006 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:49.767343998 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:49.767365932 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:49.767432928 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:49.768558979 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:50.001435995 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:50.001534939 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:50.237291098 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:50.237382889 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:50.450737953 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:50.450830936 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:50.665019989 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:50.665111065 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:50.666327953 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:50.666389942 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:50.879409075 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:50.879612923 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:50.959943056 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:50.960015059 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:51.094302893 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:51.094387054 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:51.358191013 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:51.358254910 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:51.358661890 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:51.358715057 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:51.641239882 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:51.641321898 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:51.641343117 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:51.641376019 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:52.058929920 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:52.886918068 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:53.141688108 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:53.141786098 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:53.375157118 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:53.375261068 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:53.377393007 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:54.148467064 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:54.148479939 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:54.148756027 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:54.372827053 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:57.027538061 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:59.789401054 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:31:59.789782047 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:31:59.789901018 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:01.209300995 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:01.209330082 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:01.209409952 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:02.209651947 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:02.209749937 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:03.158480883 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:03.158603907 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:03.159280062 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:03.159337044 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:03.371937990 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:03.372033119 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:03.372807026 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:03.372881889 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:04.239518881 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:04.239532948 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:04.239545107 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:04.239641905 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:05.985035896 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:05.985142946 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:05.985312939 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:05.985402107 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:05.986654043 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:05.986718893 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:05.986885071 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:05.986946106 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:06.209939957 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:06.209953070 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:06.209964991 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:06.209995031 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:06.210037947 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:06.210078955 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:06.210078955 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:09.902468920 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:17.261948109 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:17.473222017 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:17.473443031 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:17.685055017 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:17.685101032 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:17.685133934 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:17.896997929 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:17.897011995 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:17.897054911 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:17.897106886 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:17.897161961 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:18.108517885 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:18.108562946 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:18.108603001 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:18.108747005 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:18.109314919 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:18.320147038 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:18.320358992 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:18.320606947 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:18.320662975 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:18.320686102 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:18.320734978 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:19.464032888 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:19.464063883 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:19.464099884 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:19.464122057 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:19.464159966 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:19.464169979 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:19.679725885 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:22.949341059 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:23.180197001 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:23.180320024 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:26.668090105 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:33.636854887 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:33.848392963 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:33.848494053 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:35.324352026 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:35.601385117 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:35.601459026 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:35.814150095 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:39.011950016 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:39.223371029 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:39.223496914 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:39.223560095 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:39.438628912 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:39.438747883 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:39.438822985 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:39.654038906 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:39.654057980 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:39.654170036 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:39.654222965 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:39.654309034 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:39.871134996 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:39.871151924 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:39.871243954 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:39.871771097 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:43.074382067 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:43.296618938 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:43.296719074 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:43.517313004 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:43.517374992 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:43.517416954 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:43.731254101 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:43.731354952 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:43.947072029 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:43.947148085 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:46.933697939 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:47.185825109 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:47.185887098 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:47.186113119 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:47.397448063 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:47.397556067 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:47.400856018 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:47.610934019 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:47.610949993 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:47.611085892 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:47.829504013 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:47.829569101 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:50.339946032 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:50.592194080 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:50.592272043 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:50.803819895 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:50.803913116 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:51.015497923 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:51.015512943 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:51.015604973 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:51.227093935 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:51.227361917 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:51.267513037 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:51.267577887 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:51.438819885 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:51.438981056 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:51.518866062 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:51.518985987 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:51.651021957 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:51.651165962 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:51.770860910 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:51.770924091 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:51.862715006 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:51.862776995 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:52.022737980 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:52.022800922 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:52.074136019 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:52.074208021 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:52.274518967 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:52.274609089 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:52.285751104 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:52.285823107 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:52.497071028 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:52.497149944 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:52.537493944 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:52.537583113 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:52.708626032 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:52.708705902 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:52.749335051 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:52.749413013 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:52.920198917 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:52.920268059 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:52.960711002 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:52.960777998 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:53.132225990 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:53.132287025 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:53.172162056 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:53.172255039 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:53.172369003 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:53.172422886 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:53.343866110 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:53.343949080 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:53.383454084 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:53.383522034 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:53.383780956 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:53.383843899 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:53.555629969 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:53.555722952 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:53.597223997 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:53.597312927 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:53.635812044 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:53.635987043 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:53.767107964 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:53.767179012 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:53.767384052 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:53.767446041 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:53.810657024 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:53.810730934 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:53.847603083 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:53.847680092 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:53.982851982 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:53.982925892 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:54.019368887 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:54.019438982 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:54.022149086 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:54.022208929 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:54.059102058 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:54.059149981 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:54.194472075 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:54.194675922 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:54.230813980 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:54.233530045 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:54.233689070 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:54.270818949 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:54.406341076 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:54.407792091 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:54.449296951 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:54.677125931 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:54.889743090 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:54.933732986 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:55.083364964 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:55.295264959 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:55.307131052 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:55.519145012 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:55.526309967 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:55.738198042 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:55.793057919 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:56.622344971 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:56.833893061 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:56.835222960 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:56.853283882 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:57.064783096 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:57.065140963 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:57.065160036 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:57.066227913 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:57.066783905 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:57.279584885 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:57.280683041 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:57.496053934 CET	48665	49729	45.15.156.127	192.168.2.4
Mar 18, 2024 07:32:57.543064117 CET	49729	48665	192.168.2.4	45.15.156.127
Mar 18, 2024 07:32:57.648565054 CET	49729	48665	192.168.2.4	45.15.156.127

Target ID:	0
Start time:	07:30:58
Start date:	18/03/2024
Path:	C:\Users\user\Desktop\GbZkRO8wav.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\GbZkRO8wav.exe
Imagebase:	0xbf0000
File size:	693'494 bytes
MD5 hash:	5A2A3883DBB564B4AE87D05707D4CD5D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.2824151021.00000000036F4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.2820958513.0000000000AE4000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.2821360432.0000000000D72000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:30:58
Start date:	18/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report GbZkRO8wav.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

Statistics

CPU Usage

Windows Analysis Report
GbZkRO8wav.exe