Edit tour

Windows Analysis Report
EYve4TeHvZ.exe

Overview

General Information

Sample name:	EYve4TeHvZ.exe renamed because original name is a hash value
Original sample name:	d89407ff1c7e68212ea29e5d7da5fba9.exe
Analysis ID:	1636804
MD5:	d89407ff1c7e68212ea29e5d7da5fba9
SHA1:	8def9ed32436c34b27fcee48b9b10e4f4b519f74
SHA256:	af621a0196ca315b44e889e295e0b227a1ed3afc3e2f1b266875436874138fa3
Tags:	exeRedLineStealeruser-abuse_ch
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected RedLine Stealer

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Joe Sandbox ML detected suspicious sample

Maps a DLL or memory area into another process

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

EYve4TeHvZ.exe (PID: 7736 cmdline: "C:\Users\user\Desktop\EYve4TeHvZ.exe" MD5: D89407FF1C7E68212EA29E5D7DA5FBA9)

RegSvcs.exe (PID: 7752 cmdline: "C:\Users\user\Desktop\EYve4TeHvZ.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

EYve4TeHvZ.exe (PID: 7760 cmdline: "C:\Users\user\Desktop\EYve4TeHvZ.exe" MD5: D89407FF1C7E68212EA29E5D7DA5FBA9)

RegSvcs.exe (PID: 7808 cmdline: "C:\Users\user\Desktop\EYve4TeHvZ.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

EYve4TeHvZ.exe (PID: 7816 cmdline: "C:\Users\user\Desktop\EYve4TeHvZ.exe" MD5: D89407FF1C7E68212EA29E5D7DA5FBA9)

RegSvcs.exe (PID: 7832 cmdline: "C:\Users\user\Desktop\EYve4TeHvZ.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["45.144.212.192:1912"], "Bot Id": "GRACELOVELOG", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.1187752931.0000000003880000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 FD 88 44 24 2B 88 44 24 2F B0 70 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
00000005.00000002.1318277497.0000000000400000.00000040.80000000.00040000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 FD 88 44 24 2B 88 44 24 2F B0 70 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
00000005.00000002.1326564908.00000000057F0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000005.00000002.1326564908.00000000057F0000.00000004.08000000.00040000.00000000.sdmp	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x2d58b:$gen01: ChromeGetRoamingName 0x2d5a0:$gen02: ChromeGetLocalName 0x2b931:$gen03: get_UserDomainName 0x2d7f0:$gen04: get_encrypted_key 0x2bdb8:$gen05: browserPaths 0x2d0c4:$gen06: GetBrowsers 0x2d188:$gen07: get_InstalledInputLanguages 0x2d467:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x42592:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x3299a:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x32a38:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x33064:$spe9: wallet 0x31022:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x30bf8:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x30e0d:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x3077c:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x30ba6:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x3037b:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x30300:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x300c2:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
00000005.00000002.1319539106.0000000003008000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1171362184.0000000003DD0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 FD 88 44 24 2B 88 44 24 2F B0 70 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
00000004.00000002.1200576416.0000000003E40000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 FD 88 44 24 2B 88 44 24 2F B0 70 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
00000005.00000002.1327870923.0000000005BB0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000005.00000002.1327870923.0000000005BB0000.00000004.08000000.00040000.00000000.sdmp	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x2c6a3:$gen01: ChromeGetRoamingName 0x2c6b8:$gen02: ChromeGetLocalName 0x2aa49:$gen03: get_UserDomainName 0x2c908:$gen04: get_encrypted_key 0x2aed0:$gen05: browserPaths 0x2c1dc:$gen06: GetBrowsers 0x2c2a0:$gen07: get_InstalledInputLanguages 0x2c57f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x416aa:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x31ab2:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x31b50:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x3217c:$spe9: wallet 0x3013a:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x2fd10:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x2ff25:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x2f894:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x2fcbe:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x2f493:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x2f418:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x2f1da:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
Process Memory Space: RegSvcs.exe PID: 7832	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 7832	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.EYve4TeHvZ.exe.3e40000.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 FD 88 44 24 2B 88 44 24 2F B0 70 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
5.2.RegSvcs.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 FD 88 44 24 2B 88 44 24 2F B0 70 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
5.2.RegSvcs.exe.3049886.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
5.2.RegSvcs.exe.3049886.1.raw.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x2c6a3:$gen01: ChromeGetRoamingName 0x2c6b8:$gen02: ChromeGetLocalName 0x2aa49:$gen03: get_UserDomainName 0x2c908:$gen04: get_encrypted_key 0x2aed0:$gen05: browserPaths 0x2c1dc:$gen06: GetBrowsers 0x2c2a0:$gen07: get_InstalledInputLanguages 0x2c57f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x416aa:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x31ab2:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x31b50:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x3217c:$spe9: wallet 0x3013a:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x2fd10:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x2ff25:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x2f894:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x2fcbe:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x2f493:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x2f418:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x2f1da:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
5.2.RegSvcs.exe.3049886.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
5.2.RegSvcs.exe.3049886.1.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x2a8a3:$gen01: ChromeGetRoamingName 0x2a8b8:$gen02: ChromeGetLocalName 0x28c49:$gen03: get_UserDomainName 0x2ab08:$gen04: get_encrypted_key 0x290d0:$gen05: browserPaths 0x2a3dc:$gen06: GetBrowsers 0x2a4a0:$gen07: get_InstalledInputLanguages 0x2a77f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x3f8aa:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x2fcb2:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x2fd50:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x3037c:$spe9: wallet 0x2e33a:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x2df10:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x2e125:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x2da94:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x2debe:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x2d693:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x2d618:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x2d3da:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
5.2.RegSvcs.exe.57f0ee8.3.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
5.2.RegSvcs.exe.57f0ee8.3.raw.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x2c6a3:$gen01: ChromeGetRoamingName 0x2c6b8:$gen02: ChromeGetLocalName 0x2aa49:$gen03: get_UserDomainName 0x2c908:$gen04: get_encrypted_key 0x2aed0:$gen05: browserPaths 0x2c1dc:$gen06: GetBrowsers 0x2c2a0:$gen07: get_InstalledInputLanguages 0x2c57f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x416aa:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x31ab2:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x31b50:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x3217c:$spe9: wallet 0x3013a:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x2fd10:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x2ff25:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x2f894:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x2fcbe:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x2f493:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x2f418:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x2f1da:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
2.2.EYve4TeHvZ.exe.3880000.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 FD 88 44 24 2B 88 44 24 2F B0 70 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
5.2.RegSvcs.exe.57f0000.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
5.2.RegSvcs.exe.57f0000.4.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x2b78b:$gen01: ChromeGetRoamingName 0x2b7a0:$gen02: ChromeGetLocalName 0x29b31:$gen03: get_UserDomainName 0x2b9f0:$gen04: get_encrypted_key 0x29fb8:$gen05: browserPaths 0x2b2c4:$gen06: GetBrowsers 0x2b388:$gen07: get_InstalledInputLanguages 0x2b667:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x40792:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x30b9a:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x30c38:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x31264:$spe9: wallet 0x2f222:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x2edf8:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x2f00d:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x2e97c:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x2eda6:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x2e57b:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x2e500:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x2e2c2:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
5.2.RegSvcs.exe.5bb0000.5.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
5.2.RegSvcs.exe.5bb0000.5.raw.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x2c6a3:$gen01: ChromeGetRoamingName 0x2c6b8:$gen02: ChromeGetLocalName 0x2aa49:$gen03: get_UserDomainName 0x2c908:$gen04: get_encrypted_key 0x2aed0:$gen05: browserPaths 0x2c1dc:$gen06: GetBrowsers 0x2c2a0:$gen07: get_InstalledInputLanguages 0x2c57f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x416aa:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x31ab2:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x31b50:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x3217c:$spe9: wallet 0x3013a:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x2fd10:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x2ff25:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x2f894:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x2fcbe:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x2f493:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x2f418:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x2f1da:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
5.2.RegSvcs.exe.5bb0000.5.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
5.2.RegSvcs.exe.5bb0000.5.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x2a8a3:$gen01: ChromeGetRoamingName 0x2a8b8:$gen02: ChromeGetLocalName 0x28c49:$gen03: get_UserDomainName 0x2ab08:$gen04: get_encrypted_key 0x290d0:$gen05: browserPaths 0x2a3dc:$gen06: GetBrowsers 0x2a4a0:$gen07: get_InstalledInputLanguages 0x2a77f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x3f8aa:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x2fcb2:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x2fd50:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x3037c:$spe9: wallet 0x2e33a:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x2df10:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x2e125:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x2da94:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x2debe:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x2d693:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x2d618:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x2d3da:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
5.2.RegSvcs.exe.57f0000.4.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
5.2.RegSvcs.exe.57f0000.4.raw.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x2d58b:$gen01: ChromeGetRoamingName 0x2d5a0:$gen02: ChromeGetLocalName 0x2b931:$gen03: get_UserDomainName 0x2d7f0:$gen04: get_encrypted_key 0x2bdb8:$gen05: browserPaths 0x2d0c4:$gen06: GetBrowsers 0x2d188:$gen07: get_InstalledInputLanguages 0x2d467:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x42592:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x3299a:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x32a38:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x33064:$spe9: wallet 0x31022:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x30bf8:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x30e0d:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x3077c:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x30ba6:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x3037b:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x30300:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x300c2:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
5.2.RegSvcs.exe.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 FD 88 44 24 2B 88 44 24 2F B0 70 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
5.2.RegSvcs.exe.57f0ee8.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
5.2.RegSvcs.exe.57f0ee8.3.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x2a8a3:$gen01: ChromeGetRoamingName 0x2a8b8:$gen02: ChromeGetLocalName 0x28c49:$gen03: get_UserDomainName 0x2ab08:$gen04: get_encrypted_key 0x290d0:$gen05: browserPaths 0x2a3dc:$gen06: GetBrowsers 0x2a4a0:$gen07: get_InstalledInputLanguages 0x2a77f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x3f8aa:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x2fcb2:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x2fd50:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x3037c:$spe9: wallet 0x2e33a:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x2df10:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x2e125:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x2da94:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x2debe:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x2d693:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x2d618:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x2d3da:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
0.2.EYve4TeHvZ.exe.3dd0000.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 FD 88 44 24 2B 88 44 24 2F B0 70 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
5.2.RegSvcs.exe.304899e.2.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
5.2.RegSvcs.exe.304899e.2.raw.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x2d58b:$gen01: ChromeGetRoamingName 0x2d5a0:$gen02: ChromeGetLocalName 0x2b931:$gen03: get_UserDomainName 0x2d7f0:$gen04: get_encrypted_key 0x2bdb8:$gen05: browserPaths 0x2d0c4:$gen06: GetBrowsers 0x2d188:$gen07: get_InstalledInputLanguages 0x2d467:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x42592:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x3299a:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x32a38:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x33064:$spe9: wallet 0x31022:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x30bf8:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x30e0d:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x3077c:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x30ba6:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x3037b:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x30300:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x300c2:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
5.2.RegSvcs.exe.304899e.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
5.2.RegSvcs.exe.304899e.2.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x2b78b:$gen01: ChromeGetRoamingName 0x2b7a0:$gen02: ChromeGetLocalName 0x29b31:$gen03: get_UserDomainName 0x2b9f0:$gen04: get_encrypted_key 0x29fb8:$gen05: browserPaths 0x2b2c4:$gen06: GetBrowsers 0x2b388:$gen07: get_InstalledInputLanguages 0x2b667:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x40792:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x30b9a:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x30c38:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x31264:$spe9: wallet 0x2f222:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x2edf8:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x2f00d:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x2e97c:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x2eda6:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x2e57b:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x2e500:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x2e2c2:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
Click to see the 20 entries

Suricata Signatures

ET MALWARE Redline Stealer TCP CnC - Id1Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-13T06:17:18.061900+0100	2043234	1	A Network Trojan was detected	45.144.212.192	1912	192.168.2.4	49712	TCP

ET MALWARE Redline Stealer TCP CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-13T06:17:17.879285+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49712	45.144.212.192	1912	TCP
2025-03-13T06:17:23.350751+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49712	45.144.212.192	1912	TCP
2025-03-13T06:17:25.545844+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49712	45.144.212.192	1912	TCP
2025-03-13T06:17:25.782649+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49712	45.144.212.192	1912	TCP

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-13T06:17:23.543075+0100	2046056	1	A Network Trojan was detected	45.144.212.192	1912	192.168.2.4	49712	TCP

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-13T06:17:17.879285+0100	2046045	1	A Network Trojan was detected	192.168.2.4	49712	45.144.212.192	1912	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: EYve4TeHvZ.exe

Avira: detected

Found malware configuration

Source: 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": ["45.144.212.192:1912"], "Bot Id": "GRACELOVELOG", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Multi AV Scanner detection for submitted file

Source: EYve4TeHvZ.exe	Virustotal: Detection: 54%			Perma Link
Source: EYve4TeHvZ.exe	ReversingLabs: Detection: 71%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: EYve4TeHvZ.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: _.pdb source: RegSvcs.exe, 00000005.00000002.1326564908.00000000057F0000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.1319539106.00000000030A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: EYve4TeHvZ.exe, 00000000.00000003.1169552575.0000000003E40000.00000004.00001000.00020000.00000000.sdmp, EYve4TeHvZ.exe, 00000000.00000003.1170034021.0000000003FE0000.00000004.00001000.00020000.00000000.sdmp, EYve4TeHvZ.exe, 00000002.00000003.1185930899.0000000003A90000.00000004.00001000.00020000.00000000.sdmp, EYve4TeHvZ.exe, 00000002.00000003.1185751372.00000000038F0000.00000004.00001000.00020000.00000000.sdmp, EYve4TeHvZ.exe, 00000004.00000003.1197356727.0000000003EB0000.00000004.00001000.00020000.00000000.sdmp, EYve4TeHvZ.exe, 00000004.00000003.1198075652.00000000040C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: EYve4TeHvZ.exe, 00000000.00000003.1169552575.0000000003E40000.00000004.00001000.00020000.00000000.sdmp, EYve4TeHvZ.exe, 00000000.00000003.1170034021.0000000003FE0000.00000004.00001000.00020000.00000000.sdmp, EYve4TeHvZ.exe, 00000002.00000003.1185930899.0000000003A90000.00000004.00001000.00020000.00000000.sdmp, EYve4TeHvZ.exe, 00000002.00000003.1185751372.00000000038F0000.00000004.00001000.00020000.00000000.sdmp, EYve4TeHvZ.exe, 00000004.00000003.1197356727.0000000003EB0000.00000004.00001000.00020000.00000000.sdmp, EYve4TeHvZ.exe, 00000004.00000003.1198075652.00000000040C0000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B7445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00B7445A
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B7C6D1 FindFirstFileW,FindClose,	0_2_00B7C6D1
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B7C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00B7C75C
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B7EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00B7EF95
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B7F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00B7F0F2
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B7F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00B7F3F3
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B737EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00B737EF
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B73B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00B73B12
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B7BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00B7BCBC

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	5_2_068D267C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	5_2_068D1F68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	5_2_068ECDC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 076FB5DAh	5_2_076FB529
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 076FB5DAh	5_2_076FB530

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2043231 - Severity 1 - ET MALWARE Redline Stealer TCP CnC Activity : 192.168.2.4:49712 -> 45.144.212.192:1912
Source: Network traffic	Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.4:49712 -> 45.144.212.192:1912
Source: Network traffic	Suricata IDS: 2043234 - Severity 1 - ET MALWARE Redline Stealer TCP CnC - Id1Response : 45.144.212.192:1912 -> 192.168.2.4:49712
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 45.144.212.192:1912 -> 192.168.2.4:49712

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 45.144.212.192:1912

Source: global traffic

TCP traffic: 192.168.2.4:49712 -> 45.144.212.192:1912

Source: Joe Sandbox View

ASN Name: HPC-MVM-ASHU HPC-MVM-ASHU

Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.192

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe

Code function: 0_2_00B822EE InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_00B822EE

Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmH
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000036B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000036B2000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000036B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3ResponseD
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.1326564908.00000000057F0000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.1319539106.0000000003008000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.1327870923.0000000005BB0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe

Code function: 0_2_00B84164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00B84164

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe

Code function: 0_2_00B84164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00B84164

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe

Code function: 0_2_00B83F66 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00B83F66

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe

Code function: 0_2_00B7001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00B7001C

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe

Code function: 0_2_00B9CABC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00B9CABC

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.2.EYve4TeHvZ.exe.3e40000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 5.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 5.2.RegSvcs.exe.3049886.1.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 5.2.RegSvcs.exe.3049886.1.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 5.2.RegSvcs.exe.57f0ee8.3.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 2.2.EYve4TeHvZ.exe.3880000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 5.2.RegSvcs.exe.57f0000.4.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 5.2.RegSvcs.exe.5bb0000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 5.2.RegSvcs.exe.5bb0000.5.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 5.2.RegSvcs.exe.57f0000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 5.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 5.2.RegSvcs.exe.57f0ee8.3.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.2.EYve4TeHvZ.exe.3dd0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 5.2.RegSvcs.exe.304899e.2.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 5.2.RegSvcs.exe.304899e.2.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 00000002.00000002.1187752931.0000000003880000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000005.00000002.1318277497.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000005.00000002.1326564908.00000000057F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 00000000.00000002.1171362184.0000000003DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000004.00000002.1200576416.0000000003E40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000005.00000002.1327870923.0000000005BB0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00B13B3A
Source: EYve4TeHvZ.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: EYve4TeHvZ.exe, 00000000.00000002.1170737258.0000000000BC4000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_42192206-a
Source: EYve4TeHvZ.exe, 00000000.00000002.1170737258.0000000000BC4000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_c7e9a417-f
Source: EYve4TeHvZ.exe, 00000002.00000000.1170329729.0000000000BC4000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_22d844c8-4
Source: EYve4TeHvZ.exe, 00000002.00000000.1170329729.0000000000BC4000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_b6979cc1-6
Source: EYve4TeHvZ.exe, 00000004.00000000.1186533768.0000000000BC4000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_bd0cf1f2-7
Source: EYve4TeHvZ.exe, 00000004.00000000.1186533768.0000000000BC4000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_31165787-3
Source: EYve4TeHvZ.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_c42b5786-0
Source: EYve4TeHvZ.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_e1c0392a-a

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe

Code function: 0_2_00B7A1EF: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_00B7A1EF

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe

Code function: 0_2_00B68310 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00B68310

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe

Code function: 0_2_00B751BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00B751BD

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B3D975	0_2_00B3D975
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B321C5	0_2_00B321C5
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B462D2	0_2_00B462D2
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B903DA	0_2_00B903DA
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B4242E	0_2_00B4242E
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B325FA	0_2_00B325FA
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B1E6A0	0_2_00B1E6A0
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B266E1	0_2_00B266E1
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B6E616	0_2_00B6E616
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B4878F	0_2_00B4878F
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B78889	0_2_00B78889
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B28808	0_2_00B28808
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B90857	0_2_00B90857
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B46844	0_2_00B46844
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B3CB21	0_2_00B3CB21
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B46DB6	0_2_00B46DB6
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B26F9E	0_2_00B26F9E
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B23030	0_2_00B23030
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B33187	0_2_00B33187
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B3F1D9	0_2_00B3F1D9
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B11287	0_2_00B11287
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B31484	0_2_00B31484
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B25520	0_2_00B25520
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B37696	0_2_00B37696
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B25760	0_2_00B25760
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B31978	0_2_00B31978
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B1FCE0	0_2_00B1FCE0
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B3BDA6	0_2_00B3BDA6
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B31D90	0_2_00B31D90
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B97DDB	0_2_00B97DDB
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B23FE0	0_2_00B23FE0
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B1DF00	0_2_00B1DF00
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_014435B0	0_2_014435B0
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 2_2_010F2628	2_2_010F2628
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 4_2_0153FC6D	4_2_0153FC6D
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 4_2_01543608	4_2_01543608
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_00408C60	5_2_00408C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_0040DC11	5_2_0040DC11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_00407C3F	5_2_00407C3F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_00418CCC	5_2_00418CCC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_00406CA0	5_2_00406CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_004028B0	5_2_004028B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_0041A4BE	5_2_0041A4BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_00418244	5_2_00418244
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_00401650	5_2_00401650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_00402F20	5_2_00402F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_004193C4	5_2_004193C4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_00418788	5_2_00418788
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_00402F89	5_2_00402F89
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_00402B90	5_2_00402B90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_004073A0	5_2_004073A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_02FB7740	5_2_02FB7740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_02FB7733	5_2_02FB7733
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_06889C48	5_2_06889C48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_0688BD90	5_2_0688BD90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_06887BE0	5_2_06887BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_0688B810	5_2_0688B810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_0688C0C0	5_2_0688C0C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_06886EA8	5_2_06886EA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_068D5608	5_2_068D5608
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_068DF460	5_2_068DF460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_068D0848	5_2_068D0848
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_068DD9E8	5_2_068DD9E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_068E0033	5_2_068E0033
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_068E0040	5_2_068E0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_068E5565	5_2_068E5565
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_076F8F20	5_2_076F8F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_076FDFA8	5_2_076FDFA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_076FE428	5_2_076FE428
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_076FF308	5_2_076FF308
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_076FC3E8	5_2_076FC3E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_076FEBC0	5_2_076FEBC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_076F12E8	5_2_076F12E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_076FAA90	5_2_076FAA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_076FD179	5_2_076FD179
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_076FD953	5_2_076FD953
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_076F58D8	5_2_076F58D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_076F942B	5_2_076F942B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_076FC3D8	5_2_076FC3D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_076FEBB1	5_2_076FEBB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_076FAA80	5_2_076FAA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_076F5100	5_2_076F5100

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 0040E1D8 appears 44 times
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: String function: 00B17DE1 appears 36 times
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: String function: 00B38900 appears 42 times
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: String function: 00B30AE3 appears 70 times

Source: EYve4TeHvZ.exe, 00000000.00000003.1170034021.000000000410D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs EYve4TeHvZ.exe
Source: EYve4TeHvZ.exe, 00000000.00000002.1171362184.0000000003E06000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs EYve4TeHvZ.exe
Source: EYve4TeHvZ.exe, 00000000.00000003.1169919643.0000000003F63000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs EYve4TeHvZ.exe
Source: EYve4TeHvZ.exe, 00000002.00000003.1184843198.0000000003A13000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs EYve4TeHvZ.exe
Source: EYve4TeHvZ.exe, 00000002.00000002.1187752931.00000000038B6000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs EYve4TeHvZ.exe
Source: EYve4TeHvZ.exe, 00000002.00000003.1185930899.0000000003BBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs EYve4TeHvZ.exe
Source: EYve4TeHvZ.exe, 00000004.00000003.1197887459.0000000004043000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs EYve4TeHvZ.exe
Source: EYve4TeHvZ.exe, 00000004.00000003.1196971848.000000000417D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs EYve4TeHvZ.exe
Source: EYve4TeHvZ.exe, 00000004.00000002.1200576416.0000000003E76000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs EYve4TeHvZ.exe

Source: EYve4TeHvZ.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 4.2.EYve4TeHvZ.exe.3e40000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 5.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 5.2.RegSvcs.exe.3049886.1.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 5.2.RegSvcs.exe.3049886.1.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 5.2.RegSvcs.exe.57f0ee8.3.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 2.2.EYve4TeHvZ.exe.3880000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 5.2.RegSvcs.exe.57f0000.4.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 5.2.RegSvcs.exe.5bb0000.5.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 5.2.RegSvcs.exe.5bb0000.5.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 5.2.RegSvcs.exe.57f0000.4.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 5.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 5.2.RegSvcs.exe.57f0ee8.3.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.2.EYve4TeHvZ.exe.3dd0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 5.2.RegSvcs.exe.304899e.2.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 5.2.RegSvcs.exe.304899e.2.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 00000002.00000002.1187752931.0000000003880000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000005.00000002.1318277497.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000005.00000002.1326564908.00000000057F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 00000000.00000002.1171362184.0000000003DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000004.00000002.1200576416.0000000003E40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000005.00000002.1327870923.0000000005BB0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e

Source: 5.2.RegSvcs.exe.5bb0000.5.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 5.2.RegSvcs.exe.5bb0000.5.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 5.2.RegSvcs.exe.57f0ee8.3.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 5.2.RegSvcs.exe.57f0ee8.3.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 5.2.RegSvcs.exe.3049886.1.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 5.2.RegSvcs.exe.3049886.1.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@11/5@0/1

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe

Code function: 0_2_00B7A06A GetLastError,FormatMessageW,

0_2_00B7A06A

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B681CB AdjustTokenPrivileges,CloseHandle,		0_2_00B681CB
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B687E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00B687E1

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe

Code function: 0_2_00B7B3FB SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00B7B3FB

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe

Code function: 0_2_00B8EE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00B8EE0D

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe

Code function: 0_2_00B883BB CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

0_2_00B883BB

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe

Code function: 0_2_00B14E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00B14E89

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File created: C:\Users\user\AppData\Local\SystemCache

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe

File created: C:\Users\user\AppData\Local\Temp\autC8A4.tmp

Jump to behavior

Source: EYve4TeHvZ.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegSvcs.exe, 00000005.00000002.1320108351.0000000003A62000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.1320108351.0000000003A3D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.1320108351.0000000003A54000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.1320108351.00000000039BB000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.1320108351.00000000039CA000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: EYve4TeHvZ.exe	Virustotal: Detection: 54%
Source: EYve4TeHvZ.exe	ReversingLabs: Detection: 71%

Source: unknown	Process created: C:\Users\user\Desktop\EYve4TeHvZ.exe "C:\Users\user\Desktop\EYve4TeHvZ.exe"
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\EYve4TeHvZ.exe"
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Process created: C:\Users\user\Desktop\EYve4TeHvZ.exe "C:\Users\user\Desktop\EYve4TeHvZ.exe"
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\EYve4TeHvZ.exe"
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Process created: C:\Users\user\Desktop\EYve4TeHvZ.exe "C:\Users\user\Desktop\EYve4TeHvZ.exe"
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\EYve4TeHvZ.exe"
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\EYve4TeHvZ.exe"	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Process created: C:\Users\user\Desktop\EYve4TeHvZ.exe "C:\Users\user\Desktop\EYve4TeHvZ.exe"	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\EYve4TeHvZ.exe"	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Process created: C:\Users\user\Desktop\EYve4TeHvZ.exe "C:\Users\user\Desktop\EYve4TeHvZ.exe"	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\EYve4TeHvZ.exe"	Jump to behavior

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: EYve4TeHvZ.exe

Static file information: File size 1247232 > 1048576

Source: EYve4TeHvZ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: EYve4TeHvZ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: EYve4TeHvZ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: EYve4TeHvZ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: EYve4TeHvZ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: EYve4TeHvZ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: EYve4TeHvZ.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: _.pdb source: RegSvcs.exe, 00000005.00000002.1326564908.00000000057F0000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.1319539106.00000000030A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: EYve4TeHvZ.exe, 00000000.00000003.1169552575.0000000003E40000.00000004.00001000.00020000.00000000.sdmp, EYve4TeHvZ.exe, 00000000.00000003.1170034021.0000000003FE0000.00000004.00001000.00020000.00000000.sdmp, EYve4TeHvZ.exe, 00000002.00000003.1185930899.0000000003A90000.00000004.00001000.00020000.00000000.sdmp, EYve4TeHvZ.exe, 00000002.00000003.1185751372.00000000038F0000.00000004.00001000.00020000.00000000.sdmp, EYve4TeHvZ.exe, 00000004.00000003.1197356727.0000000003EB0000.00000004.00001000.00020000.00000000.sdmp, EYve4TeHvZ.exe, 00000004.00000003.1198075652.00000000040C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: EYve4TeHvZ.exe, 00000000.00000003.1169552575.0000000003E40000.00000004.00001000.00020000.00000000.sdmp, EYve4TeHvZ.exe, 00000000.00000003.1170034021.0000000003FE0000.00000004.00001000.00020000.00000000.sdmp, EYve4TeHvZ.exe, 00000002.00000003.1185930899.0000000003A90000.00000004.00001000.00020000.00000000.sdmp, EYve4TeHvZ.exe, 00000002.00000003.1185751372.00000000038F0000.00000004.00001000.00020000.00000000.sdmp, EYve4TeHvZ.exe, 00000004.00000003.1197356727.0000000003EB0000.00000004.00001000.00020000.00000000.sdmp, EYve4TeHvZ.exe, 00000004.00000003.1198075652.00000000040C0000.00000004.00001000.00020000.00000000.sdmp

Source: EYve4TeHvZ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: EYve4TeHvZ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: EYve4TeHvZ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: EYve4TeHvZ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: EYve4TeHvZ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 5.2.RegSvcs.exe.5bb0000.5.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 5.2.RegSvcs.exe.57f0ee8.3.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 5.2.RegSvcs.exe.3049886.1.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: 5.2.RegSvcs.exe.57f0000.4.raw.unpack, _.cs

.Net Code: ___ System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe

Code function: 0_2_00B14B37 LoadLibraryA,GetProcAddress,

0_2_00B14B37

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B38945 push ecx; ret	0_2_00B38958
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_0041C40C push cs; iretd	5_2_0041C4E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_00423149 push eax; ret	5_2_00423179
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_0041C50E push cs; iretd	5_2_0041C4E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_004231C8 push eax; ret	5_2_00423179
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_0040E21D push ecx; ret	5_2_0040E230
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_0041C6BE push ebx; ret	5_2_0041C6BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_068846D0 push es; ret	5_2_068846EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_06884650 push es; ret	5_2_0688466C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_06889431 push edx; retf	5_2_068893C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_068862DF push es; ret	5_2_068862E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_0688CD00 push es; ret	5_2_0688CD10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_068D96C2 push es; retn 0008h	5_2_068D96D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_068D2431 push es; ret	5_2_068D2440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_068D4211 push es; retn 0004h	5_2_068D4220
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_068D9810 push es; retn 0004h	5_2_068D9820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_068D9830 push es; retn 0004h	5_2_068D9840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_068D985C push es; retn 0004h	5_2_068D9840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_076FB241 push edi; retf 006Bh	5_2_076FB297

Source: 5.2.RegSvcs.exe.5bb0000.5.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'LreS1JrVDD5YW', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 5.2.RegSvcs.exe.57f0ee8.3.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'LreS1JrVDD5YW', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 5.2.RegSvcs.exe.3049886.1.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'LreS1JrVDD5YW', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B148D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00B148D7
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B95376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00B95376

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe

Code function: 0_2_00B33187 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00B33187

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	API/Special instruction interceptor: Address: 14431D4
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	API/Special instruction interceptor: Address: 10F224C
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	API/Special instruction interceptor: Address: 154322C

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 5_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,

5_2_004019F0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 361			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 2202			Jump to behavior

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-105786

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe

API coverage: 4.4 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B7445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00B7445A
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B7C6D1 FindFirstFileW,FindClose,	0_2_00B7C6D1
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B7C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00B7C75C
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B7EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00B7EF95
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B7F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00B7F0F2
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B7F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00B7F3F3
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B737EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00B737EF
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B73B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00B73B12
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B7BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00B7BCBC

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe

Code function: 0_2_00B149A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00B149A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: RegSvcs.exe, 00000005.00000002.1327409402.0000000005B0C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll\Um

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

API call chain: ExitProcess graph end node

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 5_2_02FB0890 LdrInitializeThunk,

5_2_02FB0890

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe

Code function: 0_2_00B83F09 BlockInput,

0_2_00B83F09

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe

Code function: 0_2_00B13B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00B13B3A

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe

Code function: 0_2_00B45A7C EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00B45A7C

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

5_2_004019F0

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe

Code function: 0_2_00B14B37 LoadLibraryA,GetProcAddress,

0_2_00B14B37

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_01443440 mov eax, dword ptr fs:[00000030h]	0_2_01443440
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_014434A0 mov eax, dword ptr fs:[00000030h]	0_2_014434A0
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_01441E00 mov eax, dword ptr fs:[00000030h]	0_2_01441E00
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 2_2_010F2518 mov eax, dword ptr fs:[00000030h]	2_2_010F2518
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 2_2_010F24B8 mov eax, dword ptr fs:[00000030h]	2_2_010F24B8
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 2_2_010F0E78 mov eax, dword ptr fs:[00000030h]	2_2_010F0E78
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 4_2_01541E58 mov eax, dword ptr fs:[00000030h]	4_2_01541E58
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 4_2_015434F8 mov eax, dword ptr fs:[00000030h]	4_2_015434F8
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 4_2_01543498 mov eax, dword ptr fs:[00000030h]	4_2_01543498

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe

Code function: 0_2_00B680A9 GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,

0_2_00B680A9

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B3A124 SetUnhandledExceptionFilter,	0_2_00B3A124
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B3A155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00B3A155
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_0040CE09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_0040E61C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00416F6A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_004123F1 SetUnhandledExceptionFilter,	5_2_004123F1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 1157008

Jump to behavior

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe

Code function: 0_2_00B687B1 LogonUserW,

0_2_00B687B1

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe

Code function: 0_2_00B13B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00B13B3A

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe

Code function: 0_2_00B148D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00B148D7

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe

Code function: 0_2_00B74C27 mouse_event,

0_2_00B74C27

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\EYve4TeHvZ.exe"	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\EYve4TeHvZ.exe"	Jump to behavior
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\EYve4TeHvZ.exe"	Jump to behavior

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe

Code function: 0_2_00B67CAF GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00B67CAF

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe

Code function: 0_2_00B6874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00B6874B

Source: EYve4TeHvZ.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: EYve4TeHvZ.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe

Code function: 0_2_00B3862B cpuid

0_2_00B3862B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: GetLocaleInfoA,

5_2_00417A20

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe

Code function: 0_2_00B44E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00B44E87

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe

Code function: 0_2_00B51E06 GetUserNameW,

0_2_00B51E06

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe

Code function: 0_2_00B43F3A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00B43F3A

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe

Code function: 0_2_00B149A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00B149A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: RegSvcs.exe, 00000005.00000002.1331812398.000000000828E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 5.2.RegSvcs.exe.3049886.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegSvcs.exe.3049886.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegSvcs.exe.57f0ee8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegSvcs.exe.57f0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegSvcs.exe.5bb0000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegSvcs.exe.5bb0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegSvcs.exe.57f0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegSvcs.exe.57f0ee8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegSvcs.exe.304899e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegSvcs.exe.304899e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1326564908.00000000057F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1319539106.0000000003008000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1327870923.0000000005BB0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7832, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ElectrumE#
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: JaxxE#
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ExodusE#
Source: RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: EthereumE#
Source: RegSvcs.exe, 00000005.00000002.1326564908.00000000057F0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: set_UseMachineKeyStore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: EYve4TeHvZ.exe	Binary or memory string: WIN_81
Source: EYve4TeHvZ.exe	Binary or memory string: WIN_XP
Source: EYve4TeHvZ.exe	Binary or memory string: WIN_XPe
Source: EYve4TeHvZ.exe	Binary or memory string: WIN_VISTA
Source: EYve4TeHvZ.exe	Binary or memory string: WIN_7
Source: EYve4TeHvZ.exe	Binary or memory string: WIN_8
Source: EYve4TeHvZ.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: Yara match	File source: 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7832, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 5.2.RegSvcs.exe.3049886.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegSvcs.exe.3049886.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegSvcs.exe.57f0ee8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegSvcs.exe.57f0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegSvcs.exe.5bb0000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegSvcs.exe.5bb0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegSvcs.exe.57f0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegSvcs.exe.57f0ee8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegSvcs.exe.304899e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegSvcs.exe.304899e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1326564908.00000000057F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1319539106.0000000003008000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1327870923.0000000005BB0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7832, type: MEMORYSTR

Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B86283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00B86283
Source: C:\Users\user\Desktop\EYve4TeHvZ.exe	Code function: 0_2_00B86747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00B86747

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	3 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	3 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	21 Input Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	2 Software Packing	NTDS	237 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	1 DLL Side-Loading	LSA Secrets	371 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	221 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Valid Accounts	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	221 Virtualization/Sandbox Evasion	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	212 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
EYve4TeHvZ.exe	54%	Virustotal		Browse
EYve4TeHvZ.exe	71%	ReversingLabs	Win32.Trojan.AutoitInject
EYve4TeHvZ.exe	100%	Avira	TR/AD.RedLineSteal.xsmpg

Name	Source	Malicious	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id23ResponseD	RegSvcs.exe, 00000005.00000002.1320108351.00000000036B2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id12Response	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id2Response	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id21Response	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id9	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id8	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id5	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id4	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id7	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id6	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id19Response	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id15Response	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id6Response	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.ip.sb/ip	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.1326564908.00000000057F0000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.1319539106.0000000003008000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.1327870923.0000000005BB0000.00000004.08000000.00040000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/sc	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id1ResponseD	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id9Response	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id20	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id21	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id22	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id23	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id24	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id24Response	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id1Response	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/08/addressing	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/trust	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id10	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id11	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id12	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id16Response	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id13	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id14	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id15	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id16	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id17	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id18	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id5Response	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id19	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id10Response	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id8Response	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/soap/envelope/	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id3ResponseD	RegSvcs.exe, 00000005.00000002.1320108351.00000000036B2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id23Response	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/D	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/06/addressingex	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wscoor	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/08/addressing/fault	RegSvcs.exe, 00000005.00000002.1320108351.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew	RegSvcs.exe, 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.144.212.192	unknown	Ukraine		47169	HPC-MVM-ASHU	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1636804
Start date and time:	2025-03-13 06:16:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	EYve4TeHvZ.exe renamed because original name is a hash value
Original Sample Name:	d89407ff1c7e68212ea29e5d7da5fba9.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@11/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 50 Number of non-executed functions: 278
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.60.203.209, 52.149.20.212
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, c.pki.goog, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:17:23	API Interceptor	14x Sleep call for process: RegSvcs.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HPC-MVM-ASHU	RMBUDGSD23ED PO.exe	Get hash	malicious	Remcos	Browse	45.144.212.83
	PO-M4590 LIST ALL.exe	Get hash	malicious	XWorm	Browse	45.144.214.104
	COHC INVOI NO 2500385 .exe	Get hash	malicious	XWorm	Browse	45.144.214.104
	jklx86.elf	Get hash	malicious	Unknown	Browse	45.131.150.222
	esFK2gm.exe	Get hash	malicious	Fallen Miner, Xmrig	Browse	45.144.212.77
	yjYJ8QncaF.exe	Get hash	malicious	Fallen Miner, Xmrig	Browse	45.144.212.77
	cbr.ppc.elf	Get hash	malicious	Mirai	Browse	45.131.150.227
	PO#GREEN AURA.exe	Get hash	malicious	XWorm	Browse	45.144.214.104
	pictures and specifications.exe	Get hash	malicious	XWorm	Browse	45.144.214.104
	Bestellbest#U00e4tigung.exe	Get hash	malicious	XWorm	Browse	45.144.214.104

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3094
Entropy (8bit):	5.33145931749415
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0atTqdqlq7qV
MD5:	3FD5C0634443FB2EF2796B9636159CB6
SHA1:	366DDE94AEFCFFFAB8E03AD8B448E05D7489EB48
SHA-256:	58307E94C67E2348F5A838DE4FF668983B38B7E9A3B1D61535D3A392814A57D6
SHA-512:	8535E7C0777C6B0876936D84BDE2BDC59963CF0954D4E50D65808E6E806E8B131DF5DB8FA0E030FAE2702143A7C3A70698A2B9A80519C9E2FFC286A71F0B797C
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Temp\autC8A4.tmp

Download File

Process:	C:\Users\user\Desktop\EYve4TeHvZ.exe
File Type:	data
Category:	dropped
Size (bytes):	343860
Entropy (8bit):	7.9741965699148
Encrypted:	false
SSDEEP:	6144:i6GMXMIuzcCQ1gvEjUrvsUxUgPY8tFpmyxRkaO0pjSGcoTDztdRkUXZ578zY5oF0:pGMbuzcC5qwEUxUf8zpPS90pjqoTXr9Z
MD5:	DBA9D554429778EAB4B3D6987DF301A5
SHA1:	0D31965E7FAABD1A4FD07999AC99957A4D8D80BC
SHA-256:	1E68D3D7C0B8A766A11A8CE596345716A90BE688C1149C9AB9C633EB7870D939
SHA-512:	E7D4AE0F63B897CD8F8E46299854712937839C47BDA69E77EF86F1938DEF95E9A8C4782E3969BB029736DC37B95E2F4A65C97601450797E38E63E420B85BEE64
Malicious:	false
Reputation:	low
Preview:	EA06..t..G.....cB..&..v.E..&.....w.Ti..,..;3p....R.x.%G.F.E=.h?....W.7...UR.U.....EY..m...VEB..er.e.....U..f.<.X@..].l....e....69.~]..S....viZ.w.q..vk...V....f..s....o.M>s.,..s.Mc....G2... .....m...1...{.MhS.L.4.9....M.R....viP........8P......8....P...1.P..30....O..f..e.gB..&...>..q..V.7..1bN.....kK...2..>g....}....+.l...i....9...gK...c3..v..K.......8u..Y.P.....2+\..+......d...fh...]j.x\~M$.U.....k......M.~.!.Y.B39.L$...9K..f.Z\.,..Z.`.......Z.@......R'O.S(.....%.....#.D.V........Qf........<.'.......fg..S.XZ]j%..P.......pz.F....{P;]....\|g .E.....>tM\|.....<.UG.6._k.}.;{...ou..>...)s......v......L).<d..t..6....yB.l.....}G.y...t..J).zD.....p.....:.F..I.......3S9.R....2...W.X.......y...O......>+b._.\8.....wo.Mt.(..f.JV.I......X..g^o-#.A.sz.Z.?.<......u....X..f...U&4..*.n.S....O.q...,.....6. Cc.0..n4....y.K.[5Z.2.~).n.F....5.......b.....f.......u.UA..&.n..q.1.$.S.p-.HdS....t...O`v(.>..lGlYK..y$...\=6.oJ....l.y.qmv.-....&.....i..r..UjkP....6.

C:\Users\user\AppData\Local\Temp\autCD38.tmp

Download File

Process:	C:\Users\user\Desktop\EYve4TeHvZ.exe
File Type:	data
Category:	dropped
Size (bytes):	343860
Entropy (8bit):	7.9741965699148
Encrypted:	false
SSDEEP:	6144:i6GMXMIuzcCQ1gvEjUrvsUxUgPY8tFpmyxRkaO0pjSGcoTDztdRkUXZ578zY5oF0:pGMbuzcC5qwEUxUf8zpPS90pjqoTXr9Z
MD5:	DBA9D554429778EAB4B3D6987DF301A5
SHA1:	0D31965E7FAABD1A4FD07999AC99957A4D8D80BC
SHA-256:	1E68D3D7C0B8A766A11A8CE596345716A90BE688C1149C9AB9C633EB7870D939
SHA-512:	E7D4AE0F63B897CD8F8E46299854712937839C47BDA69E77EF86F1938DEF95E9A8C4782E3969BB029736DC37B95E2F4A65C97601450797E38E63E420B85BEE64
Malicious:	false
Reputation:	low
Preview:	EA06..t..G.....cB..&..v.E..&.....w.Ti..,..;3p....R.x.%G.F.E=.h?....W.7...UR.U.....EY..m...VEB..er.e.....U..f.<.X@..].l....e....69.~]..S....viZ.w.q..vk...V....f..s....o.M>s.,..s.Mc....G2... .....m...1...{.MhS.L.4.9....M.R....viP........8P......8....P...1.P..30....O..f..e.gB..&...>..q..V.7..1bN.....kK...2..>g....}....+.l...i....9...gK...c3..v..K.......8u..Y.P.....2+\..+......d...fh...]j.x\~M$.U.....k......M.~.!.Y.B39.L$...9K..f.Z\.,..Z.`.......Z.@......R'O.S(.....%.....#.D.V........Qf........<.'.......fg..S.XZ]j%..P.......pz.F....{P;]....\|g .E.....>tM\|.....<.UG.6._k.}.;{...ou..>...)s......v......L).<d..t..6....yB.l.....}G.y...t..J).zD.....p.....:.F..I.......3S9.R....2...W.X.......y...O......>+b._.\8.....wo.Mt.(..f.JV.I......X..g^o-#.A.sz.Z.?.<......u....X..f...U&4..*.n.S....O.q...,.....6. Cc.0..n4....y.K.[5Z.2.~).n.F....5.......b.....f.......u.UA..&.n..q.1.$.S.p-.HdS....t...O`v(.>..lGlYK..y$...\=6.oJ....l.y.qmv.-....&.....i..r..UjkP....6.

C:\Users\user\AppData\Local\Temp\autD2E5.tmp

Download File

Process:	C:\Users\user\Desktop\EYve4TeHvZ.exe
File Type:	data
Category:	dropped
Size (bytes):	343860
Entropy (8bit):	7.9741965699148
Encrypted:	false
SSDEEP:	6144:i6GMXMIuzcCQ1gvEjUrvsUxUgPY8tFpmyxRkaO0pjSGcoTDztdRkUXZ578zY5oF0:pGMbuzcC5qwEUxUf8zpPS90pjqoTXr9Z
MD5:	DBA9D554429778EAB4B3D6987DF301A5
SHA1:	0D31965E7FAABD1A4FD07999AC99957A4D8D80BC
SHA-256:	1E68D3D7C0B8A766A11A8CE596345716A90BE688C1149C9AB9C633EB7870D939
SHA-512:	E7D4AE0F63B897CD8F8E46299854712937839C47BDA69E77EF86F1938DEF95E9A8C4782E3969BB029736DC37B95E2F4A65C97601450797E38E63E420B85BEE64
Malicious:	false
Reputation:	low
Preview:	EA06..t..G.....cB..&..v.E..&.....w.Ti..,..;3p....R.x.%G.F.E=.h?....W.7...UR.U.....EY..m...VEB..er.e.....U..f.<.X@..].l....e....69.~]..S....viZ.w.q..vk...V....f..s....o.M>s.,..s.Mc....G2... .....m...1...{.MhS.L.4.9....M.R....viP........8P......8....P...1.P..30....O..f..e.gB..&...>..q..V.7..1bN.....kK...2..>g....}....+.l...i....9...gK...c3..v..K.......8u..Y.P.....2+\..+......d...fh...]j.x\~M$.U.....k......M.~.!.Y.B39.L$...9K..f.Z\.,..Z.`.......Z.@......R'O.S(.....%.....#.D.V........Qf........<.'.......fg..S.XZ]j%..P.......pz.F....{P;]....\|g .E.....>tM\|.....<.UG.6._k.}.;{...ou..>...)s......v......L).<d..t..6....yB.l.....}G.y...t..J).zD.....p.....:.F..I.......3S9.R....2...W.X.......y...O......>+b._.\8.....wo.Mt.(..f.JV.I......X..g^o-#.A.sz.Z.?.<......u....X..f...U&4..*.n.S....O.q...,.....6. Cc.0..n4....y.K.[5Z.2.~).n.F....5.......b.....f.......u.UA..&.n..q.1.$.S.p-.HdS....t...O`v(.>..lGlYK..y$...\=6.oJ....l.y.qmv.-....&.....i..r..UjkP....6.

C:\Users\user\AppData\Local\Temp\unbarricadoed

Download File

Process:	C:\Users\user\Desktop\EYve4TeHvZ.exe
File Type:	data
Category:	dropped
Size (bytes):	422912
Entropy (8bit):	7.439584686925007
Encrypted:	false
SSDEEP:	12288:8dwTnkh9Np4aZzdqSGRzedbFmyXU8SZ2fCcT9oW9:8Zp4aXoRzedbFmyXUxZ2IW9
MD5:	75B8CBE941586F299068B1731C7965B1
SHA1:	D38EBB6A058C88CDEF6D9D87EDB16CF5A2DD6A01
SHA-256:	70D29D248FD0FC70C43940E4D9BB78A02D35E841FEE8EDE4F6352B296CC3D828
SHA-512:	4A77822EC5A44E54FDB41C9A1131FC7151DFB7E4A5F043C5F598F408BD2A48E9B8CD2E3AA01698CBBAEE8A2E8BC7EC8E25C2EE825B8DB663DCD6F6E5FF2C5AC5
Malicious:	false
Reputation:	low
Preview:	...P4K1BAL7J..OE.P7K1BELwJQOOE5P7K1BEL7JQOOE5P7K1BEL7JQOOE5P.K1BKS.DQ.F...6..c.$^9q?=R"V&.!$"Y%%o- ."B%.++ls..o"Q5.F<HaL7JQOOE]@.f.3.2.;.1c4...hN<z=.4Z..;.!.5.3.2k;.1}f[.+:.<wo^4.>.;.sL5.3.2e#2'c4..7K1BEL7JQOOE5P7K..m.7JQO..5P{J5B1.7.QOOE5P7K.BfM<KXOO.4P7.5BEL7J~.OE5@7K1.DL7J.OOU5P7I1B@L7JQOOE0P7K1BEL7.WOOA5P.p3BGL7.QO_E5@7K1BUL7ZQOOE5P'K1BEL7JQOOE.E5KaBEL7*SO3.1P7K1BEL7JQOOE5P7K1BEL7JQO..4P+K1BEL7JQOOE5P7K1BEL7JQOOE5P.F3B.L7JQOOE5P7K1.DL.KQOOE5P7K1BEL7JQOOE5P7K1BEL.>47;E5P/.0BE\7JQ.NE5T7K1BEL7JQOOE5P.K1"k>S+%.OE.=7K1.DL7$QOO.4P7K1BEL7JQOOEuP7..&$8VJQO.u5P7k3BEZ7JQEME5P7K1BEL7JQO.E5..9B0&L7J-.KE505K1.AL7jSOOE5P7K1BEL7J.OO.5P7K1BEL7JQOOE5P7K1BEL7JQOOE5P7K1BEL7JQOOE5P7K1BEL7JQOOE5P7K1BEL7JQOOE5P7K1BEL7JQOOE5P7K1BEL7JQOOE5P7K1BEL7JQOOE5P7K1BEL7JQOOE5P7K1BEL7JQOOE5P7K1BEL7JQOOE5P7K1BEL7JQOOE5P7K1BEL7JQOOE5P7K1BEL7JQOOE5P7K1BEL7JQOOE5P7K1BEL7JQOOE5P7K1BEL7JQOOE5P7K1BEL7JQOOE5P7K1BEL7JQOOE5P7K1BEL7JQOOE5P7K1BEL7JQOOE5P7K1BEL7JQOOE5P7K1BEL7JQOOE5P7K1BEL7JQOOE5P7K1BEL7JQOOE5P7K1BEL7JQOOE5P7K

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.229023307471796
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	EYve4TeHvZ.exe
File size:	1'247'232 bytes
MD5:	d89407ff1c7e68212ea29e5d7da5fba9
SHA1:	8def9ed32436c34b27fcee48b9b10e4f4b519f74
SHA256:	af621a0196ca315b44e889e295e0b227a1ed3afc3e2f1b266875436874138fa3
SHA512:	8f7fe44749ce7259dc8279a0a764a9fafd4ce9beae16cc50aeaabab756243a8c1ac881e5a3a37912821c5a2cfbd15e69431aae11770d1c42309517dd212f70fb
SSDEEP:	24576:vu6J33O0c+JY5UZ+XC0kGso6Fa/IkNPfDkQJMJP2WY:Zu0c++OCvkGs9Fa/ZwbfY
TLSH:	DD45CF22B3DDC360CB669173BF69B7056EBF7C214630B85B2F880D7DA950162262D763
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}..r}..r}..4,".p}......s}.../..A}.../#..}.../".G}..{.@.{}..{.P.W}..r}..R.....)."}......s}.../..s}..r}T.s}......s}..Richr}.

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x427dcd
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67CE2D0E [Mon Mar 10 00:06:38 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007FA0E87D363Ah
jmp 00007FA0E87C6404h
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FA0E87C658Ah
cmp edi, eax
jc 00007FA0E87C68EEh
bt dword ptr [004C31FCh], 01h
jnc 00007FA0E87C6589h
rep movsb
jmp 00007FA0E87C689Ch
cmp ecx, 00000080h
jc 00007FA0E87C6754h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007FA0E87C6590h
bt dword ptr [004BE324h], 01h
jc 00007FA0E87C6A60h
bt dword ptr [004C31FCh], 00000000h
jnc 00007FA0E87C672Dh
test edi, 00000003h
jne 00007FA0E87C673Eh
test esi, 00000003h
jne 00007FA0E87C671Dh
bt edi, 02h
jnc 00007FA0E87C658Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007FA0E87C6593h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007FA0E87C65E5h
bt esi, 03h
jnc 00007FA0E87C6638h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD4 build 31101
[RES] VS2013 build 21005
[LNK] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xba44c	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x67f88	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x12f000	0x711c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4870	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dcc4	0x8de00	d28a820a1d9ff26cda02d12b888ba4b4	False	0.5728679102422908	data	6.676118058520316	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2e10e	0x2e200	79b14b254506b0dbc8cd0ad67fb70ad9	False	0.33535526761517614	OpenPGP Public Key	5.76010872795207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbe000	0x8f74	0x5200	9f9d6f746f1a415a63de45f8b7983d33	False	0.1017530487804878	data	1.198745897703538	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc7000	0x67f88	0x68000	993e811e2e88e94b511ffb1c8906dc4e	False	0.9370164137620193	data	7.913874925931253	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x12f000	0x711c	0x7200	6fcae3cbbf6bfbabf5ec5bbe7cf612c3	False	0.7650767543859649	data	6.779031650454199	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc75a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc76d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc77f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc7920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc7c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc7d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc8bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xc9480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xc99e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xcbf90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xcd038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xcd4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xcd4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcda84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xce110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xce5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xceb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcf1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcf660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcf7b8	0x5f24f	data			1.0003233165089003
RT_GROUP_ICON	0x12ea08	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x12ea80	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x12ea94	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x12eaa8	0x14	data	English	Great Britain	1.25
RT_VERSION	0x12eabc	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x12eb98	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Version Infos

Description	Data
Translation	0x0809 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-13T06:17:17.879285+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49712	45.144.212.192	1912	TCP
2025-03-13T06:17:17.879285+0100	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	1	192.168.2.4	49712	45.144.212.192	1912	TCP
2025-03-13T06:17:18.061900+0100	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	1	45.144.212.192	1912	192.168.2.4	49712	TCP
2025-03-13T06:17:23.350751+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49712	45.144.212.192	1912	TCP
2025-03-13T06:17:23.543075+0100	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	45.144.212.192	1912	192.168.2.4	49712	TCP
2025-03-13T06:17:25.545844+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49712	45.144.212.192	1912	TCP
2025-03-13T06:17:25.782649+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49712	45.144.212.192	1912	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 13, 2025 06:17:17.184657097 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:17.189533949 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:17.189606905 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:17.200844049 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:17.205553055 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:17.811148882 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:17.877578974 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:17.879285097 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:17.883920908 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:18.061899900 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:18.112071991 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:23.350750923 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:23.355398893 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:23.542956114 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:23.542968988 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:23.542979002 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:23.543039083 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:23.543075085 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:23.543087006 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:23.543114901 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:23.596415997 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.539463043 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.544234991 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.544246912 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.544276953 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.544286966 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.544320107 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.544329882 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.544336081 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.544341087 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.544349909 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.544362068 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.544367075 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.544419050 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.544482946 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.544552088 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.549133062 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.549149036 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.549190044 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.549221039 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.549257994 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.549266100 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.549274921 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.549284935 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.549293995 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.549312115 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.549320936 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.549326897 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.549340963 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.549370050 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.549412012 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.549422979 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.549427986 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.549474955 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.553935051 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.554064035 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.554073095 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.554084063 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.554115057 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.554126024 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.554172039 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.554192066 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.554290056 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.554299116 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.554356098 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.554363966 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.554462910 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.554476023 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.554502964 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.554519892 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.554544926 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.554548025 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.554578066 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.554595947 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.554604053 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.554634094 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.554694891 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.554703951 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.554713011 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.554716110 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.554721117 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.554738998 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.554749966 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.554770947 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.554799080 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.554800034 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.554809093 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.554817915 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.554826021 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.554848909 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.554852009 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.554860115 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.554863930 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.554867983 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.554903030 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.554929018 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.558789968 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.558799028 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.558832884 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.558841944 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.558851957 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.558861017 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.558875084 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.558887959 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.558895111 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.558903933 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.558919907 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.558927059 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.558928967 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.558950901 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.558959007 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.558959007 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.558988094 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.559005976 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559012890 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.559015036 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559019089 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559026957 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559047937 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559056997 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559087038 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559093952 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559134007 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559143066 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559149981 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559159040 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559174061 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559181929 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559196949 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559205055 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559221029 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559274912 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559283018 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559287071 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559308052 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559315920 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559330940 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559339046 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559421062 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559429884 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559432983 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559464931 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559473038 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559484959 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559494019 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559509039 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559519053 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559556961 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559643030 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559652090 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.559653044 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559719086 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.559751987 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559761047 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559768915 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559777975 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559787035 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559794903 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559899092 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559909105 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559916019 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559926033 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559932947 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559942007 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559951067 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559961081 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559968948 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559992075 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.559998989 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.560003996 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.560012102 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.560020924 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.560029030 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.563592911 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.563620090 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.563631058 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.563667059 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.563714027 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.563723087 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.563766003 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.563787937 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.563798904 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.563848972 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.563858986 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.563868046 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.563904047 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.563919067 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.563958883 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.563963890 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.563971043 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.563987970 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.564007044 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.564016104 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.564090014 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.564099073 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.564107895 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.564116955 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.564313889 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.564369917 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.564378977 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.564467907 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.564476013 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.564533949 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.564543009 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.564546108 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.564553976 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.564564943 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.564574003 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.564609051 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.564618111 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.564640999 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.564649105 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.564718962 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.564727068 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.564740896 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.564755917 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.564764977 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.564774036 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.564825058 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.564834118 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.564841032 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.564851046 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.564863920 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.564872026 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.564888000 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.564897060 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.564949036 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.564958096 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.564965963 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.564975023 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.564990997 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.564999104 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.565013885 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.565022945 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.565058947 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.565068007 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.565095901 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.565104008 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.565124989 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.565134048 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.565220118 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.565227032 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.565244913 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.565253973 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.565260887 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.565269947 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.565294981 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.565304995 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.565320015 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.565327883 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.565339088 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.565345049 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569127083 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569135904 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569139004 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569147110 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569154978 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569161892 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569200039 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569209099 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569217920 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569226027 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569278955 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569287062 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569289923 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569298983 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569350004 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.569394112 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569401979 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.569403887 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569411993 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569421053 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569428921 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569437027 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569446087 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569454908 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569475889 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569484949 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569494009 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569503069 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569524050 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569533110 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569536924 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569540024 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569621086 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569629908 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569634914 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569643974 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569659948 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569669008 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569684029 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569752932 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569761038 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569768906 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569792032 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569801092 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569946051 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569955111 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569962025 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569971085 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569978952 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569991112 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.569998980 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.570008039 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.570024014 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.570030928 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.570039988 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.574474096 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.574481964 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.574520111 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.574528933 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.574532986 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.574549913 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.574634075 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.574642897 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.574697971 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.574707985 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.574708939 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.574716091 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.574732065 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.574748039 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.574757099 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.574769974 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.574794054 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.574801922 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.574809074 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.574819088 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.574835062 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.574842930 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.574851990 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.574862003 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.574942112 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.574950933 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.574959993 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.574969053 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.574978113 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.575025082 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.575033903 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.575120926 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.575130939 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.575138092 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.575146914 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.575161934 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.575198889 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.575208902 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.575221062 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.575337887 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.575346947 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.575350046 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.575354099 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.575361967 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.575371027 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.575403929 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.575412035 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.575416088 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.575423956 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.575439930 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.575448036 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.575458050 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.575500011 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.575509071 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.575544119 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.579675913 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.579684973 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.579693079 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.579701900 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.579720020 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.579729080 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.579737902 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.579747915 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.579822063 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.579830885 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.579838037 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.579847097 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.579855919 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.579865932 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.579902887 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.579911947 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.579916954 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.579925060 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.579930067 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.579994917 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.580018044 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.580028057 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.580111980 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.580121994 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.580125093 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.580127954 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.580146074 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.580154896 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.580178022 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.580187082 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.580208063 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.580215931 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.580241919 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.580250978 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.580272913 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.580281973 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.580365896 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.580374002 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.580380917 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.580390930 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.580501080 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.580508947 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.580518007 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.580527067 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.580534935 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.580544949 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.580560923 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.580569983 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.580585003 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.580593109 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.580600023 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.580610037 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.580626965 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.580636978 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.580643892 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.585125923 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.585134983 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.585180044 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.585187912 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.585197926 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.585208893 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.585223913 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.585232973 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.585268021 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.585277081 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.585290909 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.585315943 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.585324049 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.585331917 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.585340977 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.585534096 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.585541964 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.585542917 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.585558891 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.585570097 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.585602999 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.585613012 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.585622072 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.585629940 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.585638046 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.585695028 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.585752010 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.585761070 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.585782051 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.585789919 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.585901976 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.585910082 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.585912943 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.585922003 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.585930109 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.585937977 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.612071037 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.616784096 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.616995096 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.617063999 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.617063999 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.617108107 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.621721983 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.621748924 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.621822119 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.621836901 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.621942997 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.621959925 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.622052908 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.622061014 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.622144938 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.622153997 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.622205973 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.622255087 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.622342110 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.622350931 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.622376919 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:24.643301964 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:24.647981882 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:25.545008898 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:25.545844078 CET	49712	1912	192.168.2.4	45.144.212.192
Mar 13, 2025 06:17:25.550518990 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:25.754959106 CET	1912	49712	45.144.212.192	192.168.2.4
Mar 13, 2025 06:17:25.782649040 CET	49712	1912	192.168.2.4	45.144.212.192

Target ID:	0
Start time:	01:17:08
Start date:	13/03/2025
Path:	C:\Users\user\Desktop\EYve4TeHvZ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\EYve4TeHvZ.exe"
Imagebase:	0xb10000
File size:	1'247'232 bytes
MD5 hash:	D89407FF1C7E68212EA29E5D7DA5FBA9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000000.00000002.1171362184.0000000003DD0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	01:17:09
Start date:	13/03/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\EYve4TeHvZ.exe"
Imagebase:	0x380000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:17:09
Start date:	13/03/2025
Path:	C:\Users\user\Desktop\EYve4TeHvZ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\EYve4TeHvZ.exe"
Imagebase:	0xb10000
File size:	1'247'232 bytes
MD5 hash:	D89407FF1C7E68212EA29E5D7DA5FBA9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000002.00000002.1187752931.0000000003880000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:17:11
Start date:	13/03/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\EYve4TeHvZ.exe"
Imagebase:	0x50000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:17:11
Start date:	13/03/2025
Path:	C:\Users\user\Desktop\EYve4TeHvZ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\EYve4TeHvZ.exe"
Imagebase:	0xb10000
File size:	1'247'232 bytes
MD5 hash:	D89407FF1C7E68212EA29E5D7DA5FBA9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000004.00000002.1200576416.0000000003E40000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:17:12
Start date:	13/03/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\EYve4TeHvZ.exe"
Imagebase:	0xe80000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000005.00000002.1320108351.000000000344B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000005.00000002.1318277497.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000005.00000002.1326564908.00000000057F0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: infostealer_win_redline_strings, Description: Finds Redline samples based on characteristic strings, Source: 00000005.00000002.1326564908.00000000057F0000.00000004.08000000.00040000.00000000.sdmp, Author: Sekoia.io Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000005.00000002.1319539106.0000000003008000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000005.00000002.1327870923.0000000005BB0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: infostealer_win_redline_strings, Description: Finds Redline samples based on characteristic strings, Source: 00000005.00000002.1327870923.0000000005BB0000.00000004.08000000.00040000.00000000.sdmp, Author: Sekoia.io
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report EYve4TeHvZ.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.log

C:\Users\user\AppData\Local\Temp\autC8A4.tmp

C:\Users\user\AppData\Local\Temp\autCD38.tmp

C:\Users\user\AppData\Local\Temp\autD2E5.tmp

C:\Users\user\AppData\Local\Temp\unbarricadoed

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Windows Analysis Report
EYve4TeHvZ.exe