Edit tour

Windows Analysis Report
DraftBl10101.exe

Overview

General Information

Sample name:	DraftBl10101.exe
Analysis ID:	1465601
MD5:	76329ae46cc8e0f01ef274425f835369
SHA1:	6ca774a4ba2e9c2da560df093e4adeb1ae1d30a4
SHA256:	2639ce69da59a31b16e2d969fc39946986f67ca2c0cbb7b712e20c1bcb2ba785
Tags:	exeRedLineStealer
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected RedLine Stealer

.NET source code contains potential unpacker

.NET source code contains very large array initializations

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

DraftBl10101.exe (PID: 6476 cmdline: "C:\Users\user\Desktop\DraftBl10101.exe" MD5: 76329AE46CC8E0F01EF274425F835369)

DraftBl10101.exe (PID: 1096 cmdline: C:\Users\user\Desktop\DraftBl10101.exe MD5: 76329AE46CC8E0F01EF274425F835369)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": "147.124.209.128:7847", "Bot Id": "01/07", "Message": "Appdata", "Authorization Header": "b6d46c5fb4032958adb4977201f937cc"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.3302313547.0000000003A8D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000001.00000002.2172368908.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: DraftBl10101.exe PID: 6476	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: DraftBl10101.exe PID: 1096	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: DraftBl10101.exe PID: 1096	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.DraftBl10101.exe.3ad8220.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.DraftBl10101.exe.3ad8220.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
1.2.DraftBl10101.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 147.124.209.128

Timestamp:	07/01/24-20:52:06.861949
SID:	2046045
Source Port:	49704
Destination Port:	7847
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 147.124.209.128 - Destination IP: 192.168.2.5

Timestamp:	07/01/24-20:52:06.994466
SID:	2043234
Source Port:	7847
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.5 - Destination IP: 147.124.209.128

Timestamp:	07/01/24-20:52:14.485005
SID:	2043231
Source Port:	49704
Destination Port:	7847
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) - Source IP: 147.124.209.128 - Destination IP: 192.168.2.5

Timestamp:	07/01/24-20:52:12.184088
SID:	2046056
Source Port:	7847
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.3302313547.0000000003A8D000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": "147.124.209.128:7847", "Bot Id": "01/07", "Message": "Appdata", "Authorization Header": "b6d46c5fb4032958adb4977201f937cc"}

Multi AV Scanner detection for submitted file

Source: DraftBl10101.exe

ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: DraftBl10101.exe

Joe Sandbox ML: detected

Source: DraftBl10101.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: DraftBl10101.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) 192.168.2.5:49704 -> 147.124.209.128:7847
Source: Traffic	Snort IDS: 2043231 ET TROJAN Redline Stealer TCP CnC Activity 192.168.2.5:49704 -> 147.124.209.128:7847
Source: Traffic	Snort IDS: 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response 147.124.209.128:7847 -> 192.168.2.5:49704
Source: Traffic	Snort IDS: 2046056 ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) 147.124.209.128:7847 -> 192.168.2.5:49704

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 147.124.209.128:7847

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 147.124.209.128:7847

Source: Joe Sandbox View

ASN Name: AC-AS-1US AC-AS-1US

Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.209.128

Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: DraftBl10101.exe, 00000001.00000002.2177836340.00000000036E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: DraftBl10101.exe, 00000001.00000002.2182764233.000000000484A000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: DraftBl10101.exe, 00000001.00000002.2177836340.00000000036E9000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: DraftBl10101.exe, 00000001.00000002.2177836340.00000000036E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3ResponseD
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: DraftBl10101.exe, 00000001.00000002.2177836340.000000000372B000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2177836340.0000000003801000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2177836340.00000000037FD000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2182764233.000000000456F000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2182764233.000000000462C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: DraftBl10101.exe, 00000000.00000002.3302313547.0000000003A8D000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2172368908.0000000000402000.00000040.00000400.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: DraftBl10101.exe, 00000001.00000002.2177836340.000000000372B000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2177836340.0000000003801000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2177836340.00000000037FD000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2182764233.000000000456F000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2182764233.000000000462C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: DraftBl10101.exe, 00000001.00000002.2177836340.000000000372B000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2177836340.0000000003801000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2177836340.00000000037FD000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2182764233.000000000456F000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2182764233.000000000462C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: DraftBl10101.exe, 00000001.00000002.2177836340.000000000372B000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2177836340.0000000003801000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2177836340.00000000037FD000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2182764233.000000000456F000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2182764233.000000000462C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: DraftBl10101.exe, 00000001.00000002.2177836340.000000000372B000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2177836340.0000000003801000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2177836340.00000000037FD000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2182764233.000000000456F000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2182764233.000000000462C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: DraftBl10101.exe, 00000001.00000002.2177836340.000000000372B000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2177836340.0000000003801000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2182764233.000000000456F000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2182764233.000000000462C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: DraftBl10101.exe, 00000001.00000002.2177836340.00000000037FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabS
Source: DraftBl10101.exe, 00000001.00000002.2177836340.000000000372B000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2177836340.0000000003801000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2177836340.00000000037FD000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2182764233.000000000456F000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2182764233.000000000462C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: DraftBl10101.exe, 00000001.00000002.2177836340.000000000372B000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2177836340.0000000003801000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2177836340.00000000037FD000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2182764233.000000000456F000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2182764233.000000000462C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: DraftBl10101.exe, 00000001.00000002.2177836340.000000000372B000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2177836340.0000000003801000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2177836340.00000000037FD000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2182764233.000000000456F000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2182764233.000000000462C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: DraftBl10101.exe, 00000000.00000002.3299087359.0000000002A24000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_07591db6-f

System Summary

.NET source code contains very large array initializations

Source: DraftBl10101.exe, gnitteSweiVataDataDmetsyS92486.cs

Large array initialization: yrogetaCnoitacidnySnoitacidnySledoMecivreSmetsyS27287a: array initializer size 304138

Source: C:\Users\user\Desktop\DraftBl10101.exe	Code function: 0_2_00E3DC34		0_2_00E3DC34
Source: C:\Users\user\Desktop\DraftBl10101.exe	Code function: 1_2_0176DC74		1_2_0176DC74

Source: DraftBl10101.exe, 00000000.00000002.3297731990.0000000000987000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs DraftBl10101.exe
Source: DraftBl10101.exe, 00000000.00000002.3297844383.0000000000A6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs DraftBl10101.exe
Source: DraftBl10101.exe, 00000000.00000000.2043160526.00000000005F2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCubically.exe4 vs DraftBl10101.exe
Source: DraftBl10101.exe, 00000000.00000002.3302313547.0000000003B19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTensible.exe8 vs DraftBl10101.exe
Source: DraftBl10101.exe, 00000001.00000002.2172368908.0000000000444000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTensible.exe8 vs DraftBl10101.exe
Source: DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs DraftBl10101.exe
Source: DraftBl10101.exe	Binary or memory string: OriginalFilenameCubically.exe4 vs DraftBl10101.exe

Source: DraftBl10101.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@0/1

Source: C:\Users\user\Desktop\DraftBl10101.exe

File created: C:\Users\user\AppData\Local\SystemCache

Jump to behavior

Source: C:\Users\user\Desktop\DraftBl10101.exe

Mutant created: NULL

Source: DraftBl10101.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: DraftBl10101.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%

Source: C:\Users\user\Desktop\DraftBl10101.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\DraftBl10101.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DraftBl10101.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\DraftBl10101.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: C:\Users\user\Desktop\DraftBl10101.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: DraftBl10101.exe

ReversingLabs: Detection: 50%

Source: unknown	Process created: C:\Users\user\Desktop\DraftBl10101.exe "C:\Users\user\Desktop\DraftBl10101.exe"
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process created: C:\Users\user\Desktop\DraftBl10101.exe C:\Users\user\Desktop\DraftBl10101.exe
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process created: C:\Users\user\Desktop\DraftBl10101.exe C:\Users\user\Desktop\DraftBl10101.exe	Jump to behavior

Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Section loaded: ntasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\DraftBl10101.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32

Jump to behavior

Source: DraftBl10101.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: DraftBl10101.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: DraftBl10101.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation

.NET source code contains potential unpacker

Source: DraftBl10101.exe, SystemExt.cs

.Net Code: RaiseEvent

Source: DraftBl10101.exe

Static PE information: 0xA418B958 [Thu Mar 29 09:28:56 2057 UTC]

Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\DraftBl10101.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\DraftBl10101.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\DraftBl10101.exe	Memory allocated: E30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Memory allocated: 2910000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Memory allocated: 4910000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Memory allocated: 1760000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Memory allocated: 3370000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Memory allocated: 5370000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\DraftBl10101.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\DraftBl10101.exe

Window / User API: threadDelayed 2678

Jump to behavior

Source: C:\Users\user\Desktop\DraftBl10101.exe TID: 1896	Thread sleep count: 2678 > 30	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe TID: 1896	Thread sleep count: 206 > 30	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe TID: 6500	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe TID: 5624	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\DraftBl10101.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\DraftBl10101.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004840000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004840000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004840000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004523000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004523000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004523000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004523000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004840000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004840000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004523000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004840000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004840000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004523000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004523000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004523000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004523000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: DraftBl10101.exe, 00000001.00000002.2188212147.0000000008690000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll-
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004840000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004523000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004523000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004840000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004840000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004523000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004840000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004523000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004523000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004840000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004523000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004840000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004523000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004840000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004840000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004840000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004523000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004840000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004523000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004840000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004523000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004523000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004523000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004523000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004523000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004523000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004523000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004840000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004523000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004523000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004840000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004840000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004523000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004840000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004523000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004523000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004840000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004840000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004840000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004840000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004840000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004840000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004840000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004840000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004523000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: DraftBl10101.exe, 00000001.00000002.2182764233.0000000004840000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x

Source: C:\Users\user\Desktop\DraftBl10101.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\DraftBl10101.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\DraftBl10101.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\DraftBl10101.exe

Process created: C:\Users\user\Desktop\DraftBl10101.exe C:\Users\user\Desktop\DraftBl10101.exe

Jump to behavior

Source: DraftBl10101.exe, 00000000.00000002.3299087359.0000000002A24000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: GetProgmanWindow
Source: DraftBl10101.exe, 00000000.00000002.3299087359.0000000002A24000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SetProgmanWindow

Source: C:\Users\user\Desktop\DraftBl10101.exe	Queries volume information: C:\Users\user\Desktop\DraftBl10101.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Queries volume information: C:\Users\user\Desktop\DraftBl10101.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\DraftBl10101.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\DraftBl10101.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\DraftBl10101.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\DraftBl10101.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\DraftBl10101.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\DraftBl10101.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\DraftBl10101.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.DraftBl10101.exe.3ad8220.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DraftBl10101.exe.3ad8220.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DraftBl10101.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3302313547.0000000003A8D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2172368908.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DraftBl10101.exe PID: 6476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DraftBl10101.exe PID: 1096, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\DraftBl10101.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\DraftBl10101.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\DraftBl10101.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DraftBl10101.exe PID: 1096, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.DraftBl10101.exe.3ad8220.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DraftBl10101.exe.3ad8220.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DraftBl10101.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3302313547.0000000003A8D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2172368908.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DraftBl10101.exe PID: 6476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DraftBl10101.exe PID: 1096, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	1 Masquerading	1 OS Credential Dumping	221 Security Software Discovery	Remote Services	11 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	11 Input Capture	2 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	2 Data from Local System	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	113 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
DraftBl10101.exe	50%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
DraftBl10101.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://tempuri.org/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id2Response	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id4	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id7	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/sc	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id20	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/trust	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id18	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	0%	Avira URL Cloud	safe
147.124.209.128:7847	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtabS	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id3ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
147.124.209.128:7847	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	DraftBl10101.exe, 00000001.00000002.2177836340.000000000372B000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2177836340.0000000003801000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2182764233.000000000456F000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2182764233.000000000462C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	DraftBl10101.exe, 00000001.00000002.2177836340.000000000372B000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2177836340.0000000003801000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2177836340.00000000037FD000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2182764233.000000000456F000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2182764233.000000000462C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	DraftBl10101.exe, 00000001.00000002.2177836340.00000000036E9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12Response	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21Response	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id9	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id4	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id7	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19Response	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15Response	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6Response	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ip.sb/ip	DraftBl10101.exe, 00000000.00000002.3302313547.0000000003A8D000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2172368908.0000000000402000.00000040.00000400.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id1ResponseD	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id9Response	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	DraftBl10101.exe, 00000001.00000002.2177836340.000000000372B000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2177836340.0000000003801000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2177836340.00000000037FD000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2182764233.000000000456F000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2182764233.000000000462C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id20	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id22	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id24	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id24Response	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	DraftBl10101.exe, 00000001.00000002.2177836340.000000000372B000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2177836340.0000000003801000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2177836340.00000000037FD000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2182764233.000000000456F000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2182764233.000000000462C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1Response	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id11	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16Response	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id13	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id17	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id18	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5Response	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10Response	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8Response	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	DraftBl10101.exe, 00000001.00000002.2177836340.000000000372B000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2177836340.0000000003801000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2177836340.00000000037FD000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2182764233.000000000456F000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2182764233.000000000462C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtabS	DraftBl10101.exe, 00000001.00000002.2177836340.00000000037FD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id3ResponseD	DraftBl10101.exe, 00000001.00000002.2177836340.00000000036E9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23Response	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003371000.00000004.00000800.00020000.00000000.sdmp, DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	DraftBl10101.exe, 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
147.124.209.128	unknown	United States		1432	AC-AS-1US	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1465601
Start date and time:	2024-07-01 20:51:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	DraftBl10101.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 36 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: DraftBl10101.exe

Simulations

Behavior and APIs

Time	Type	Description
14:52:12	API Interceptor	14x Sleep call for process: DraftBl10101.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AC-AS-1US	once_again.exe	Get hash	malicious	RHADAMANTHYS	Browse	147.124.216.114
	f4dde5135d892a3b27afc4a95376e7880eee75c2d0b1b711baf4a9bd93bda187_payload.exe	Get hash	malicious	RHADAMANTHYS	Browse	147.124.221.241
	file.exe	Get hash	malicious	RHADAMANTHYS	Browse	147.124.221.241
	Nesyxzngip.exe	Get hash	malicious	Njrat	Browse	147.124.205.158
	mC7Qm2oo1D.elf	Get hash	malicious	Unknown	Browse	147.124.40.17
	https://gmzyleyab.cc.rs6.net/tn.jsp?f=001L_m-s5obFnTgx_aIp2DKkknLvlMdBttO8zw2TI8e1yHcDXTem--V-Qf4VSCxHJHRSIn4bu6kM8X6Y1k4FUIJH9GHY1zBIvQDAKUcYWJKkjlT6SI3jHKRlHS8x33q3Wuy6cxqt0Ofo99y7zXi9Vxatw==&c=&ch=	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	147.124.192.147
	WFdAK6HQgz.elf	Get hash	malicious	Unknown	Browse	147.124.15.63
	SecuriteInfo.com.Win64.PWSX-gen.21194.11700.exe	Get hash	malicious	RHADAMANTHYS	Browse	147.124.220.237
	SecuriteInfo.com.Win64.PWSX-gen.21194.11700.exe	Get hash	malicious	RHADAMANTHYS	Browse	147.124.220.237
	SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.28597.30591.rtf	Get hash	malicious	XWorm	Browse	147.124.212.213

Process:	C:\Users\user\Desktop\DraftBl10101.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3094
Entropy (8bit):	5.33145931749415
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0atTqdqlq7qV
MD5:	3FD5C0634443FB2EF2796B9636159CB6
SHA1:	366DDE94AEFCFFFAB8E03AD8B448E05D7489EB48
SHA-256:	58307E94C67E2348F5A838DE4FF668983B38B7E9A3B1D61535D3A392814A57D6
SHA-512:	8535E7C0777C6B0876936D84BDE2BDC59963CF0954D4E50D65808E6E806E8B131DF5DB8FA0E030FAE2702143A7C3A70698A2B9A80519C9E2FFC286A71F0B797C
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.760857037514704
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.79% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01%
File name:	DraftBl10101.exe
File size:	523'264 bytes
MD5:	76329ae46cc8e0f01ef274425f835369
SHA1:	6ca774a4ba2e9c2da560df093e4adeb1ae1d30a4
SHA256:	2639ce69da59a31b16e2d969fc39946986f67ca2c0cbb7b712e20c1bcb2ba785
SHA512:	83f7a1e71f0ec5118840dd5809da420329cbe85009266766a58ae8a75b7546b4c23b677eca99b7bb45aa9b083841426cd17ee6cd3fc63c61ece44d6f8b275821
SSDEEP:	12288:+0NbavSR5o04KEIPEqqGBZksOMLV1Ijy:LCz04KEIG2Zko51
TLSH:	B3B4F47B3B5D8A68CCDABC7271DC45CEF16FE161828EBBE16FD381601855265C8881F8
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...X.................0.............:h... ... ....@.. .......................`............@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x43683a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xA418B958 [Thu Mar 29 09:28:56 2057 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
or ch, dl
aad
sal byte ptr [eax+5Ah], FFFFFF9Ah
and byte ptr [edi+0A45B047h], al
ret
jo 00007F02B07F7EECh
call far F52Ah : EA0A8724h
sal byte ptr [eax-1Eh], FFFFFF9Ah
and byte ptr [edi+0AD5EA0Ah], al
xor byte ptr [eax+5Ah], FFFFFF9Ah
and byte ptr [edi+0AD5EA0Ah], al
sal byte ptr [eax+5Ah], FFFFFF9Ah
and byte ptr [edi+0AD5EA0Ah], al
sal byte ptr [eax+5Ah], FFFFFF9Ah
and byte ptr [edi+0AD5EA0Ah], al
sal byte ptr [eax+5Ah], FFFFFF9Ah
and byte ptr [edi+0AD5EA8Ah], al
into
outsd
loopne 00007F02B07F7E26h
and byte ptr [ebx], dh
add esp, dword ptr [edi]
hlt
mov dl, C1h
cmp al, 97h
mov ebx, 9963EF74h
cmc
jp 00007F02B07F7E44h
pop ds
cmp eax, 2AEA41E8h
mov dword ptr [esp-45D1E052h], esi
inc edx
loop 00007F02B07F7EBCh
cwde
mov al, byte ptr [3419E064h]
mov edx, CA59C864h
mov eax, 7415A465h
xchg eax, edi
sub eax, D5EA2E8Dh
or al, al
jo 00007F02B07F7EECh
call far 0B99h : EA0AC270h
ret
jo 00007F02B07F7E65h
sar byte ptr [ebx+1Ch], 0000000Ah
jmp far 9A5Ah : 70C00AD5h
rol byte ptr [edi+0BDEEB08h], FFFFFFF0h
jo 00007F02B07F7EECh
dec edx
and al, byte ptr [edi+0AD43A0Ah]
sal byte ptr [eax+5Ah], FFFFFF9Ah
into
sbb byte ptr [eax], cl
jmp far 9A5Ah : 70C02AD5h
and eax, dword ptr [edi+0A95EA0Ah]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x367e8	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x82000	0x398	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x84000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x367cc	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x7ec50	0x7f000	394df071a28ca8a5719709fc59bc0032	False	0.4507431871309055	data	6.777418533750439	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x82000	0x398	0x400	98ac803eaa1b84ee9819e7bd0ed225ef	False	0.3955078125	data	3.008232598198786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x84000	0xc	0x400	576dcae5ebd58a03025e995078b8579f	False	0.025390625	data	0.05585530805374581	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x82058	0x33a	data			0.45036319612590797

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/01/24-20:52:06.861949	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	49704	7847	192.168.2.5	147.124.209.128
07/01/24-20:52:06.994466	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	7847	49704	147.124.209.128	192.168.2.5
07/01/24-20:52:14.485005	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49704	7847	192.168.2.5	147.124.209.128
07/01/24-20:52:12.184088	TCP	2046056	ET TROJAN Redline Stealer/MetaStealer Family Activity (Response)	7847	49704	147.124.209.128	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 1, 2024 20:52:06.264951944 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:06.269834995 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:06.269922018 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:06.279239893 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:06.284065962 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:06.808857918 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:06.856359959 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:06.861948967 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:06.866933107 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:06.994466066 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:07.043850899 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:12.047689915 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:12.052560091 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:12.184087992 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:12.184115887 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:12.184129000 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:12.184139013 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:12.184154034 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:12.184314013 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.646464109 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.651710033 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.651726007 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.651734114 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.651745081 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.651753902 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.651781082 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.651817083 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.651822090 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.651832104 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.651840925 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.651850939 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.651859999 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.651906013 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.656800985 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.656811953 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.656820059 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.656832933 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.656853914 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.656863928 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.656867027 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.656897068 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.656910896 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.657022953 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.657087088 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.657380104 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.657463074 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.662276983 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.662375927 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.662419081 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.662472010 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.662908077 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.662919044 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.662928104 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.662936926 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.662988901 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.663048983 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.663058996 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.663060904 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.663068056 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.663109064 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.663206100 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.663217068 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.663225889 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.663234949 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.663259029 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.663285971 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.663393021 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.663403988 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.663413048 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.663434982 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.663460970 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.663594007 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.663640976 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.667462111 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.667473078 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.667480946 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.667531013 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.667557955 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.667567968 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.667613983 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.668045998 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.668056011 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.668101072 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.668487072 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.668498993 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.668510914 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.668519974 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.668551922 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.668569088 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.668612003 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.668621063 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.668628931 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.668632030 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.668669939 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.668687105 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.668776989 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.668788910 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.668936968 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.668946028 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.669063091 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.669071913 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.669080019 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.669089079 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.669097900 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.669105053 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.669225931 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.669234991 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.669390917 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.669399977 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.669410944 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.669414997 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.669547081 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.669557095 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.669564962 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.669574976 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.669704914 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.669714928 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.669728994 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.669861078 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.669874907 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.669883013 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.669893026 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.669902086 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.669909954 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.669964075 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.669974089 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.670094967 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.670104980 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.670182943 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.670214891 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.670226097 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.670233965 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.670255899 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.670339108 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.670348883 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.670356989 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.670464993 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.670474052 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.670480967 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.670485020 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.670630932 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.670643091 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.670650959 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.670660019 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.670669079 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.670672894 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.670681000 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.670691967 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.670700073 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.672688007 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.672698021 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.672856092 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.672909021 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.672985077 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.672996044 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.673003912 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.673017979 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.673089027 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.673105001 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.673223972 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.673234940 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.673418999 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.673429012 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.673536062 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.674015045 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.674025059 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.674032927 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.674042940 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.674052954 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.674062014 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.674072027 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.674154997 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.674165010 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.674179077 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.674320936 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.674329996 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.674339056 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.674557924 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.674626112 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.675461054 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.675471067 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.675478935 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.675493002 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.675662994 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.675672054 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.675681114 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.675692081 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.675703049 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.675712109 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.675719976 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.675736904 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.675746918 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.675755024 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.675765991 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.675774097 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.675784111 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.675803900 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.675812960 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.675821066 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.675831079 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.675842047 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.675868034 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.675878048 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.675900936 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.675910950 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.675987005 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.675998926 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.676083088 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.676094055 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.676100969 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.676172018 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.676184893 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.676192999 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.676208019 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.676218033 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.676225901 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.676362991 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.676373959 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.676382065 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.676393986 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.676403046 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.676413059 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.676423073 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.676430941 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.677047968 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.677057028 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.677066088 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.677076101 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.677083969 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.677094936 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.677102089 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.677114964 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.679727077 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.679737091 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.679745913 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.679758072 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.679853916 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.679863930 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.679873943 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.679877996 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.679887056 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.679896116 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.679936886 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.680006981 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.680012941 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.680016994 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.680027962 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.680160999 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.680170059 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.680179119 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.680196047 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.680203915 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.680217028 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.680226088 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.680284977 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.680304050 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.680533886 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.680545092 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.680560112 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.680569887 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.680579901 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.680701971 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.680711985 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.680721998 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.680733919 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.681034088 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.681044102 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.681055069 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.681063890 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.681073904 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.681082964 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.681189060 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.681199074 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.681206942 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.681216955 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.681332111 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.681341887 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.681473970 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.681483984 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.681493044 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.681520939 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.681531906 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.681540012 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.681549072 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.681670904 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.681680918 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.681689978 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686016083 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686194897 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686214924 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.686306000 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.686330080 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686340094 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686350107 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686359882 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686368942 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686378002 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686610937 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686620951 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686630011 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686639071 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686649084 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686659098 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686706066 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686716080 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686726093 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686736107 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686745882 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686760902 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686769962 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686779022 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686788082 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686796904 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686804056 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686815023 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686822891 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686836958 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686846018 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686857939 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686866999 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686876059 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686885118 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686903954 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686912060 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686922073 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686932087 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686940908 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686950922 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686961889 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686976910 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686985970 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.686995029 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.687004089 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.687012911 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.687021017 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.687030077 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.687038898 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.687047958 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.687056065 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.687064886 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.687073946 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.687082052 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.691241026 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.691447020 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.691517115 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.691531897 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.691540956 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.691545963 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.691555023 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.691658020 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.691665888 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.691767931 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.691776991 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.691785097 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.691793919 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.691804886 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.691993952 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.692004919 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.692013979 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.692136049 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.692145109 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.692153931 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.692162991 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.692166090 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.692176104 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.692261934 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.692270994 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.692279100 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.692286968 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.692296028 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.692305088 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.692315102 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.692322969 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.692332983 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.692342043 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.692353010 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.692362070 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.692372084 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.692382097 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.692389965 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.692399979 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.692537069 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.692545891 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.692555904 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.692564964 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.692574024 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.692697048 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.692707062 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.692714930 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.692723989 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.692733049 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.692742109 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.692750931 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.692770004 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.692779064 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.692787886 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.692826033 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.697926044 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.697937965 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.697947025 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.697956085 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.697959900 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.697962999 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.697972059 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.697976112 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.697983980 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.697993994 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.698004007 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.698014021 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.698026896 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.698036909 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.698045969 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.698055029 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.698062897 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.698071957 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.698080063 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.698088884 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.698097944 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.698107004 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.698117018 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.698126078 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.698134899 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.698143959 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.698153019 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.698163033 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.698172092 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.698180914 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.698189974 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.698199034 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.698210001 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.698220015 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.698420048 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.698498011 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.739141941 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.739408016 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.739526033 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.739526033 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.739567041 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:13.744446993 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.744458914 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.744472027 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.744487047 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.744507074 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.744515896 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.744527102 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.744573116 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.744582891 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.744591951 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.744601011 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.744638920 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.744647980 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.744664907 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.744688034 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.744697094 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.744708061 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.744718075 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.744730949 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.744740009 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.744781971 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.744792938 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.744890928 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.744900942 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.744910955 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:13.774530888 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:14.484210014 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:14.485004902 CEST	49704	7847	192.168.2.5	147.124.209.128
Jul 1, 2024 20:52:14.490026951 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:14.617244005 CEST	7847	49704	147.124.209.128	192.168.2.5
Jul 1, 2024 20:52:14.646306992 CEST	49704	7847	192.168.2.5	147.124.209.128

Target ID:	0
Start time:	14:52:00
Start date:	01/07/2024
Path:	C:\Users\user\Desktop\DraftBl10101.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\DraftBl10101.exe"
Imagebase:	0x570000
File size:	523'264 bytes
MD5 hash:	76329AE46CC8E0F01EF274425F835369
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.3302313547.0000000003A8D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	14:52:01
Start date:	01/07/2024
Path:	C:\Users\user\Desktop\DraftBl10101.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\DraftBl10101.exe
Imagebase:	0xfb0000
File size:	523'264 bytes
MD5 hash:	76329AE46CC8E0F01EF274425F835369
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000001.00000002.2172368908.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000001.00000002.2177836340.0000000003405000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	107
Total number of Limit Nodes:	4

Executed Functions

Function 00E3ADF0 Relevance: 1.7, APIs: 1, Instructions: 209
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00E3B046

Memory Dump Source

Source File: 00000000.00000002.3298601183.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_DraftBl10101.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f19a6487aec11b12e077de45eac1d423f55162233238f55d68fcc9fa14ae9147
Instruction ID: 88d931f880aae226665819c39c0babe961787ab79cd4e4c045dbfdeea1a06326
Opcode Fuzzy Hash: f19a6487aec11b12e077de45eac1d423f55162233238f55d68fcc9fa14ae9147
Instruction Fuzzy Hash: 578159B0A00B058FDB24DF2AD44975ABBF1FF88304F04992ED086EBA51D775E985CB91

Function 00E3590C Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00E359C9

Memory Dump Source

Source File: 00000000.00000002.3298601183.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_DraftBl10101.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: f139ed21b226f0eb4909988d1df8a1175de3ca1a70fb6884776c78c13f5d5c3d
Instruction ID: 7706a23e07f3923ffa880bbbb008305b1a861c6b78472fdf701bfba359588c0f
Opcode Fuzzy Hash: f139ed21b226f0eb4909988d1df8a1175de3ca1a70fb6884776c78c13f5d5c3d
Instruction Fuzzy Hash: 1A41B1B1C00759CBDB24CFA9C888B9EBBF5BF89304F20815AD418AB255DB756949CF90

Function 00E34248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00E359C9

Memory Dump Source

Source File: 00000000.00000002.3298601183.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_DraftBl10101.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 129159819b455d7d3125df3b2301830e685938fa7eb9b5a02f68dd40140259e0
Instruction ID: c7f7da712636521b7420de3a540e7d226d42c4eb453e0cce4e74a92ac74196fa
Opcode Fuzzy Hash: 129159819b455d7d3125df3b2301830e685938fa7eb9b5a02f68dd40140259e0
Instruction Fuzzy Hash: 9F41BFB1C00719CBDB24CFA9C888B9DBBF5BF49304F20815AD408BB261DB756949CF90

Function 00E3C960 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00E3D286,?,?,?,?,?), ref: 00E3D347

Memory Dump Source

Source File: 00000000.00000002.3298601183.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_DraftBl10101.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5f16f3b74d6be0ac4504c768aae31bda37f08caf0247ecb8f9a235da87919c7e
Instruction ID: 66912186f09aee3faec1293beb8414aa69c03fec8d74ba122b291decd214acbc
Opcode Fuzzy Hash: 5f16f3b74d6be0ac4504c768aae31bda37f08caf0247ecb8f9a235da87919c7e
Instruction Fuzzy Hash: 3521D4B59042489FDB10CF9AD984AEEBFF4EB48310F14841AE914B7210D374A954DFA5

Function 00E3D2B8 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00E3D286,?,?,?,?,?), ref: 00E3D347

Memory Dump Source

Source File: 00000000.00000002.3298601183.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_DraftBl10101.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 440072ed79c7c1f235b56d0b38be833470ce7ec332f790d74ef04497c88bc21c
Instruction ID: 9b9f35ab8f7b0a411ff53422bd8ed775a1c3ef3097853e0e23ae9e730215f523
Opcode Fuzzy Hash: 440072ed79c7c1f235b56d0b38be833470ce7ec332f790d74ef04497c88bc21c
Instruction Fuzzy Hash: 1521E5B5900249AFDB10CF9AD984ADEBFF9EB48324F14841AE914B3350C374A944DFA5

Function 00E3B260 Relevance: 1.6, APIs: 1, Instructions: 56
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00E3B0C1,00000800,00000000,00000000), ref: 00E3B2D2

Memory Dump Source

Source File: 00000000.00000002.3298601183.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_DraftBl10101.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 60deb6abae5f4c0fb6a272e32f55039930b6bf0b05e163b9ad4a52647f4fe352
Instruction ID: 8187e3a09b08a769255b3995db27ba7573df411f2d3c18656a057ef95cc9a1d2
Opcode Fuzzy Hash: 60deb6abae5f4c0fb6a272e32f55039930b6bf0b05e163b9ad4a52647f4fe352
Instruction Fuzzy Hash: 121106B69042498FCB10CF9AC448ADEFFF8EB88310F14851ED555A7210C775A945CFA5

Function 00E3A830 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00E3B0C1,00000800,00000000,00000000), ref: 00E3B2D2

Memory Dump Source

Source File: 00000000.00000002.3298601183.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_DraftBl10101.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 66a7dd85f679925303fa6b0f4c48fcc74e66a4d5a36042f5e3c113d54dd6c5d5
Instruction ID: ce54b2fac7782fbd54e307c4d88a677af18f49e0f8ea0b7b7ebd346ded0bf815
Opcode Fuzzy Hash: 66a7dd85f679925303fa6b0f4c48fcc74e66a4d5a36042f5e3c113d54dd6c5d5
Instruction Fuzzy Hash: F31106B69043499FDB10CF9AC448ADFFBF4EB88310F10851AD915B7210C375A945CFA4

Function 00E3AFE0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00E3B046

Memory Dump Source

Source File: 00000000.00000002.3298601183.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_DraftBl10101.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 3123f189727dc4e3334e92f6db643d55186a747edcf64d4945f217dc70d72ba1
Instruction ID: 189bc230e1f2d537740a0cd04d79af28a43f821e665989b2d6cb053cb6e183e8
Opcode Fuzzy Hash: 3123f189727dc4e3334e92f6db643d55186a747edcf64d4945f217dc70d72ba1
Instruction Fuzzy Hash: 1811D2B6D00349CFCB24CF9AD444A9EFBF4EB88314F14841AD529B7610C375A949CFA1

Function 00DCD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3298368348.0000000000DCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dcd000_DraftBl10101.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9066ebe7f2e0e48b97cc7784be25a95622ae752c647ab2cce14687ac7836ffff
Instruction ID: b98065a9d0da9655674c1a815902966c8a3df778fc646dc9bd8e6b7151658509
Opcode Fuzzy Hash: 9066ebe7f2e0e48b97cc7784be25a95622ae752c647ab2cce14687ac7836ffff
Instruction Fuzzy Hash: 0321E2B1508205DFDB09DF54D9C0F26BB66EB98324F24C56DEA090B25AC336E856CAB1

Function 00DDD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3298425639.0000000000DDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ddd000_DraftBl10101.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 935cc662d74f1a845c7da1da6b2b6e45ac7c6d7c6699b36965fbc727d7caa26c
Instruction ID: b2ee375363982edfaebb1f8c6d5520cb0e46e2b6f1e5d8ebe7d6460f5eb47f3e
Opcode Fuzzy Hash: 935cc662d74f1a845c7da1da6b2b6e45ac7c6d7c6699b36965fbc727d7caa26c
Instruction Fuzzy Hash: 2121F575504200DFCF15DF14D984B26BB66EBC8314F24C56ED8494B386C33AD807CA71

Function 00DDD2BC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3298425639.0000000000DDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ddd000_DraftBl10101.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b60a263367755a5370a65bcf8186b75c349cfce65289f83e8981e66dc2ab7df1
Instruction ID: c75945c78967e30bdcb97e9fd1c86f4902af449a547d0efa330eb126b04ab9c3
Opcode Fuzzy Hash: b60a263367755a5370a65bcf8186b75c349cfce65289f83e8981e66dc2ab7df1
Instruction Fuzzy Hash: 0D2105B5504244DFDF01DF14D9C0B2ABB66FB98324F38C56AD8490B346C33AE806CAB2

Function 00DDD005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3298425639.0000000000DDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ddd000_DraftBl10101.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 231f05ca6185ee9dc7a45b96a7b5bc63c842127b802746523d13b1bd52c617b6
Instruction ID: d37ee1585594055684368e694964b3635ebddc1cd0d2593f8e9405524924d58b
Opcode Fuzzy Hash: 231f05ca6185ee9dc7a45b96a7b5bc63c842127b802746523d13b1bd52c617b6
Instruction Fuzzy Hash: BB2153755093808FDB12CF24D994715BF71EB46314F29C5EBD8498B6A7C33A980ACB62

Function 00DCD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3298368348.0000000000DCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dcd000_DraftBl10101.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a42a10f79047cfc5a8dfbea04f5877e4b045e58f4eb555799dbe40d0299e0d1
Instruction ID: 8cd953c14b6c3ea0a3860229b05a329b6165b271dcca2414ce7b4b61885f5a60
Opcode Fuzzy Hash: 2a42a10f79047cfc5a8dfbea04f5877e4b045e58f4eb555799dbe40d0299e0d1
Instruction Fuzzy Hash: 87110376404241DFCB06CF00D9C4B16BF72FB94324F28C2ADD9090B256C33AE85ACBA1

Function 00DDD2B7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3298425639.0000000000DDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ddd000_DraftBl10101.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0ca1e03a89bf6502059eb4096cb2751f98ce07bc6b40026132c113bb1690e3e
Instruction ID: 2955dc90b1d5abb139c276083eb25a4eb811fce1c1acc6af890b7088ccb40154
Opcode Fuzzy Hash: f0ca1e03a89bf6502059eb4096cb2751f98ce07bc6b40026132c113bb1690e3e
Instruction Fuzzy Hash: D1118276504684DFDB12CF14D5C4B19FB62FB84324F28C6AAD8494B756C33AD84ACBA2

Function 05B70D88 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3304182136.0000000005B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b70000_DraftBl10101.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a0c328763c7d69754db65941214546d9cdc34a931da3087fa98581562b86ff5
Instruction ID: 493d5526f255e4bec08caea31425d14ab64a30d83bf61d958c72cff9238dd082
Opcode Fuzzy Hash: 0a0c328763c7d69754db65941214546d9cdc34a931da3087fa98581562b86ff5
Instruction Fuzzy Hash: 4DF02232600F166BCB01AB0AE405B6EB3A6FF80738F440119DA18B7F80CB70BC618BC0

Function 05B709D0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3304182136.0000000005B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b70000_DraftBl10101.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74bd0c5bc6d24b57b49e4c5c31c96aced4f4c4e0e2fed4e1c8dd882bcf3fb842
Instruction ID: 92a0902fccad81cf0fa66fb4b3d245f22bd1c722b72d953d4e82567f074b3291
Opcode Fuzzy Hash: 74bd0c5bc6d24b57b49e4c5c31c96aced4f4c4e0e2fed4e1c8dd882bcf3fb842
Instruction Fuzzy Hash: 95F082323005088FCB24975EE4C8C69F7EAEFC927531440B7F119C7761DA65EC008B50

Function 05B70D98 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3304182136.0000000005B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b70000_DraftBl10101.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5a7fb019546504147a56157b971faaf1da2b80a17fa9b1546a35af01a8fd4cb
Instruction ID: 86956417961b922bf044d7c48b829fd1617e012b14e73a3aa37c9c9624921108
Opcode Fuzzy Hash: d5a7fb019546504147a56157b971faaf1da2b80a17fa9b1546a35af01a8fd4cb
Instruction Fuzzy Hash: 47F0BE32700B166BDB15AB1AE419B2EB3A6FF84738F044119D909ABB80CF74BC418BD0

Function 05B709C0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3304182136.0000000005B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b70000_DraftBl10101.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb2f1f2717ee979c729a331e37f2796ddc2e708520b8b6ed39a504e9b0a19b3
Instruction ID: bd2ab245c7345576af55c750131467c7eaa3c128e1edeca28d6f57dc18b9385a
Opcode Fuzzy Hash: dbb2f1f2717ee979c729a331e37f2796ddc2e708520b8b6ed39a504e9b0a19b3
Instruction Fuzzy Hash: 55F0E536300A084BCB20531AD889EAAF7D9EFC5260B148076E159C7750D924EC018611

Function 05B70EE0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3304182136.0000000005B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b70000_DraftBl10101.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7e8baed7b6da958b27399ac49f818d511733de0dbcc224d3ce4d14906737abd
Instruction ID: 88d5b0ee3bb932b2594c16877063267c7a070f3e8392a826175c049f9e9bebd8
Opcode Fuzzy Hash: c7e8baed7b6da958b27399ac49f818d511733de0dbcc224d3ce4d14906737abd
Instruction Fuzzy Hash: 4AE0C27370002C3BDB04760AE804AAB7BCECBD4A20B54802AB44AC3341D8619D0345E5

Function 05B70EF0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3304182136.0000000005B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b70000_DraftBl10101.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 507d5baf13faebb12c3e19e99585ddacbae4945618a4a2853429e9b1fd864fe7
Instruction ID: a5ebad9560748028d9eee9d90a8c80dabd5630ba21e8430b859168c13deb8cbf
Opcode Fuzzy Hash: 507d5baf13faebb12c3e19e99585ddacbae4945618a4a2853429e9b1fd864fe7
Instruction Fuzzy Hash: F1D0A9323000283B6B146A4AA800CAFBBDECBC4A70310C03FB80C87390CD70AC0282E0

Non-executed Functions

Function 00E3DC34 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3298601183.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_DraftBl10101.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58a59d8fcf7d5cb54b2b00f60b8314feb74969e0dffa68c81a06050c8cffa5ba
Instruction ID: d772954a43752d8f27b9ac8e7b7c4a923654f2d26cccbe34655f122bc6d474ca
Opcode Fuzzy Hash: 58a59d8fcf7d5cb54b2b00f60b8314feb74969e0dffa68c81a06050c8cffa5ba
Instruction Fuzzy Hash: 94A15836E10209CFCF05DFB4D8485AEBBB2FF88304B25556AE905BB265DB71E915CB80

Analysis Process: DraftBl10101.exePID: 1096, Parent PID: 6476COMMON

Execution Graph

Execution Coverage:	7.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	51
Total number of Limit Nodes:	7

Executed Functions

Function 0176AE30 Relevance: 1.7, APIs: 1, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0176B086

Memory Dump Source

Source File: 00000001.00000002.2174029236.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1760000_DraftBl10101.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 80ac936c96002a29ca8bb668602406b6db2a8a90997705664c4264254e3ffcbc
Instruction ID: 5134e5d8ab60bfec03740cfe9e91f6a268dd9c8b1f29cad45d51e5e6afed2f03
Opcode Fuzzy Hash: 80ac936c96002a29ca8bb668602406b6db2a8a90997705664c4264254e3ffcbc
Instruction Fuzzy Hash: 4C7134B0A00B058FD725DF29D44579AFBF5FF88204F04892EE98AE7A40D774E945CB91

Function 01764248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 017659F1

Memory Dump Source

Source File: 00000001.00000002.2174029236.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1760000_DraftBl10101.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 51ee06c935975cd87a316f09972b9ccb5dabfe05e6f541c374cb15c9e09cf403
Instruction ID: 69abd4b1b95c84a9dc9afa9b69ef04d3fbbd968f51a05c12d8bd871fec3e1f24
Opcode Fuzzy Hash: 51ee06c935975cd87a316f09972b9ccb5dabfe05e6f541c374cb15c9e09cf403
Instruction Fuzzy Hash: 8C41EEB0C00718CADB24CFAAC884B8DBBF5FF49314F60806AD808AB251DB756949CF90

Function 01765935 Relevance: 1.6, APIs: 1, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 017659F1

Memory Dump Source

Source File: 00000001.00000002.2174029236.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1760000_DraftBl10101.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 5fef584a57c49f0f8a07d4372c3277f8adfee327d18fdc4e216a44cda44ae0d5
Instruction ID: febe1a8c2087300cfb5dcb03b5c4be1528b4d62dd5cac0838a987de8197227d0
Opcode Fuzzy Hash: 5fef584a57c49f0f8a07d4372c3277f8adfee327d18fdc4e216a44cda44ae0d5
Instruction Fuzzy Hash: 5241CEB1C00759CEDB24CFA9C884B9DBBF5FF48304F64816AD808AB255DB756949CF50

Function 0176C9A0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0176D2C6,?,?,?,?,?), ref: 0176D387

Memory Dump Source

Source File: 00000001.00000002.2174029236.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1760000_DraftBl10101.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4a1d020e6ec5220c1fc319968dda59a3cb3c3d5c3bba3340e3a2ef1dbfc0ab11
Instruction ID: d9edb98bf1bc30976dfc64b1dbbebcc0a473b23c21b9abee86198676f2ef1137
Opcode Fuzzy Hash: 4a1d020e6ec5220c1fc319968dda59a3cb3c3d5c3bba3340e3a2ef1dbfc0ab11
Instruction Fuzzy Hash: 6521E4B5910248DFDB10CF9AD984ADEFFF9EB48320F14841AE958A7310D374A954CFA5

Function 0176D2F9 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0176D2C6,?,?,?,?,?), ref: 0176D387

Memory Dump Source

Source File: 00000001.00000002.2174029236.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1760000_DraftBl10101.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a49ae7ae8fd791684f45d40ea289458e547d2515f1b8055846ae738efcab3d1a
Instruction ID: b125af248d1ec3d9b9576bce7296441184ddc40b410e4a0579b28a595d30afba
Opcode Fuzzy Hash: a49ae7ae8fd791684f45d40ea289458e547d2515f1b8055846ae738efcab3d1a
Instruction Fuzzy Hash: CB21E4B5D00249DFDB10CFAAD984AEEFBF5FB48314F14841AE958A7210D378A940CFA5

Function 0176A870 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0176B101,00000800,00000000,00000000), ref: 0176B312

Memory Dump Source

Source File: 00000001.00000002.2174029236.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1760000_DraftBl10101.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f67d4dec20811cc37521efd5c525499929984b2b8650fb01ce558abbe7039d1c
Instruction ID: 56cc9168e4e216b762cc64fdb752c00e1483719e289e8b7f3c82c887ea018053
Opcode Fuzzy Hash: f67d4dec20811cc37521efd5c525499929984b2b8650fb01ce558abbe7039d1c
Instruction Fuzzy Hash: EE11E7B6D043499FDB10CF9AC444A9EFBF8EB89324F14842ED915A7600C375A945CFA5

Function 0176B2A0 Relevance: 1.6, APIs: 1, Instructions: 53
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0176B101,00000800,00000000,00000000), ref: 0176B312

Memory Dump Source

Source File: 00000001.00000002.2174029236.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1760000_DraftBl10101.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d290ff1ae7eb066eeeb31c96f7afd694e2d487cba60232ffae4c5f815a43a366
Instruction ID: aa83979ed6293962cf4c6bada3d5bff34ecac6901ab469df94b8e9a15b9ab9da
Opcode Fuzzy Hash: d290ff1ae7eb066eeeb31c96f7afd694e2d487cba60232ffae4c5f815a43a366
Instruction Fuzzy Hash: 7311E4B6D002499FDB10CF9AC944ADEFBF8EB88314F14842AD929A7600C375A545CFA5

Function 0176B020 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0176B086

Memory Dump Source

Source File: 00000001.00000002.2174029236.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1760000_DraftBl10101.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: bc3e7fb04417086686bf72e2eba6c9af0ec87b16327220e50a6358aa2548bd39
Instruction ID: dfcaf9b7ffc82a1ab7529d46b30ffadf2d7afa5384c410fc097aae0169db941c
Opcode Fuzzy Hash: bc3e7fb04417086686bf72e2eba6c9af0ec87b16327220e50a6358aa2548bd39
Instruction Fuzzy Hash: A91102B6D003498FDB20DF9AC844A9EFBF8EB89314F10841AD928B7210C375A545CFA1

Function 0170D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2172865022.000000000170D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0170D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_170d000_DraftBl10101.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4807e3afb4608342419c34230fc5d9af54e3c2fdbf8cd666561abb00315c1291
Instruction ID: 9cad4cc9b98d4cc0ed1d8e9b1cedf39ab3c09976bc0c1b6e5d0bc3beb76421f2
Opcode Fuzzy Hash: 4807e3afb4608342419c34230fc5d9af54e3c2fdbf8cd666561abb00315c1291
Instruction Fuzzy Hash: 402105B1104300DFDB12DF88C980B56FFA5EB84324F20C5A9ED090A286C336E406C6A1

Function 0170D110 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2172865022.000000000170D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0170D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_170d000_DraftBl10101.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dda5b5f7409b7e3c45dc8603052bb7f04c96ef026519129169f88308fe3968dc
Instruction ID: 75f71b0ce361b94a894db5f6eb870520944448a3b7ff2b8caa40fd05f46ba0a6
Opcode Fuzzy Hash: dda5b5f7409b7e3c45dc8603052bb7f04c96ef026519129169f88308fe3968dc
Instruction Fuzzy Hash: 20212571504300DFDB26DF98D9C0B26FFA6FB98324F2485A9E9090B287C736D816C6A1

Function 0171D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2172894343.000000000171D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0171D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_171d000_DraftBl10101.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c3c89c64c6ae9c9e638e16c612fa3c59549ac6eeba11dac73242c939bb911be
Instruction ID: 829c22cedccabb4d43e75ee00a23e8e0e0d6df1a171cb6ae972adf1d7f232c75
Opcode Fuzzy Hash: 2c3c89c64c6ae9c9e638e16c612fa3c59549ac6eeba11dac73242c939bb911be
Instruction Fuzzy Hash: 78212575604200DFCB25DF5CD9C8B16FB65EB88314F20C5ADD8090B24AC33BD407CA61

Function 0170D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2172865022.000000000170D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0170D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_170d000_DraftBl10101.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a42a10f79047cfc5a8dfbea04f5877e4b045e58f4eb555799dbe40d0299e0d1
Instruction ID: da065d913f989cbb443cc71679e52634c775b44230143a7f1a9e8e7bf8bdf08c
Opcode Fuzzy Hash: 2a42a10f79047cfc5a8dfbea04f5877e4b045e58f4eb555799dbe40d0299e0d1
Instruction Fuzzy Hash: 0911CD76404340CFDB12CF84D5C4B56FFA2FB84324F24C2A9ED090A256C33AE45ACBA1

Function 0170D10B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2172865022.000000000170D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0170D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_170d000_DraftBl10101.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a42a10f79047cfc5a8dfbea04f5877e4b045e58f4eb555799dbe40d0299e0d1
Instruction ID: 0c15baf690d8f7a7980187a7b970d6c867fe2dc70ef5763e4c91140896c454a6
Opcode Fuzzy Hash: 2a42a10f79047cfc5a8dfbea04f5877e4b045e58f4eb555799dbe40d0299e0d1
Instruction Fuzzy Hash: 8F119D76504340CFDB16CF54D9C4B16BFA2FB88324F2485A9D9094B256C33AD45ACBA1

Function 0171D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2172894343.000000000171D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0171D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_171d000_DraftBl10101.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c74efafe6a787794d2e52374dfad20fc7a218ab120a23d42f416259975cce95d
Instruction ID: f6a5a91c80316b744ecac937ff173631fefbb38e2bef10589698f46322e23474
Opcode Fuzzy Hash: c74efafe6a787794d2e52374dfad20fc7a218ab120a23d42f416259975cce95d
Instruction Fuzzy Hash: B111BE75504280CFDB12CF58D5C8B16FB61FB44314F24C6A9D8094B65AC33AD44ACF62

Function 0170D655 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2172865022.000000000170D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0170D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_170d000_DraftBl10101.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 324c74c1bcd6ce590f1b5ffc2da85b8d008826b7ba4ca68381650db018d5b724
Instruction ID: a99a364f5199a9398c8dfdbc57122f348ea5981050c3fbedc77421ef6ccac014
Opcode Fuzzy Hash: 324c74c1bcd6ce590f1b5ffc2da85b8d008826b7ba4ca68381650db018d5b724
Instruction Fuzzy Hash: E201A271108344DAE7229AD9CD84B66FFE8DF453B4F18C45AED4D0A2C6C679A840CAB1

Function 0170D654 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2172865022.000000000170D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0170D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_170d000_DraftBl10101.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce770506d9bc3d147bc3a12dae4919df4901225f80ecfb33154bc0bf34413d7f
Instruction ID: c8a0bc586061be2f2c6a965548eef79c140008244d1aae59a8d5036e3a291865
Opcode Fuzzy Hash: ce770506d9bc3d147bc3a12dae4919df4901225f80ecfb33154bc0bf34413d7f
Instruction Fuzzy Hash: 64F0C2724043409AE7218E49CD88B62FFD8EB41374F18C45AED0C0A286C278A840CAB0

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report DraftBl10101.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DraftBl10101.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
DraftBl10101.exe

Function 00E3ADF0 Relevance: 1.7, APIs: 1, Instructions: 209
COMMON

Function 00E3590C Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Function 00E34248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 00E3C960 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 00E3D2B8 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 00E3B260 Relevance: 1.6, APIs: 1, Instructions: 56
libraryCOMMON

Function 00E3A830 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Function 00E3AFE0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 0176AE30 Relevance: 1.7, APIs: 1, Instructions: 195
COMMON

Function 01764248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 01765935 Relevance: 1.6, APIs: 1, Instructions: 94
COMMON

Function 0176C9A0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 0176D2F9 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Function 0176A870 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Function 0176B2A0 Relevance: 1.6, APIs: 1, Instructions: 53
libraryCOMMON

Function 0176B020 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON