Edit tour

Windows Analysis Report
Acal BFi UK - Products List 020240704PDF.exe

Overview

General Information

Sample name:	Acal BFi UK - Products List 020240704PDF.exe
Analysis ID:	1467943
MD5:	b7d9ebad39110de3ff89686962c3270b
SHA1:	a6e86e8d2ff174655eb1d30c62506db91e26c943
SHA256:	77ccc61481c9fa009dfb6af2f6293b604312d440df4338e757ad2df844d10e0b
Tags:	exeRedLineStealer
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected AntiVM3

Yara detected RedLine Stealer

.NET source code contains potential unpacker

.NET source code contains very large array initializations

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates processes with suspicious names

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Acal BFi UK - Products List 020240704PDF.exe (PID: 6456 cmdline: "C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe" MD5: B7D9EBAD39110DE3FF89686962C3270B)

Acal BFi UK - Products List 020240704PDF.exe (PID: 4028 cmdline: "C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe" MD5: B7D9EBAD39110DE3FF89686962C3270B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["79.110.62.16:1912"], "Bot Id": "foz", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1998404535.00000000038C9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1998404535.0000000003957000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1998404535.000000000390C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000003.00000002.2163095067.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: Acal BFi UK - Products List 020240704PDF.exe PID: 6456	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Acal BFi UK - Products List 020240704PDF.exe PID: 6456	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: Acal BFi UK - Products List 020240704PDF.exe PID: 4028	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Acal BFi UK - Products List 020240704PDF.exe PID: 4028	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.Acal BFi UK - Products List 020240704PDF.exe.38c9970.10.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
3.2.Acal BFi UK - Products List 020240704PDF.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.Acal BFi UK - Products List 020240704PDF.exe.3914b90.7.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.Acal BFi UK - Products List 020240704PDF.exe.3914b90.7.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.Acal BFi UK - Products List 020240704PDF.exe.38c9970.10.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 79.110.62.16 - Destination IP: 192.168.2.5

Timestamp:	07/05/24-06:01:59.399207
SID:	2043234
Source Port:	1912
Destination Port:	49706
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 79.110.62.16

Timestamp:	07/05/24-06:01:59.217507
SID:	2046045
Source Port:	49706
Destination Port:	1912
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.5 - Destination IP: 79.110.62.16

Timestamp:	07/05/24-06:02:04.460027
SID:	2043231
Source Port:	49706
Destination Port:	1912
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.3914b90.7.raw.unpack

Malware Configuration Extractor: RedLine {"C2 url": ["79.110.62.16:1912"], "Bot Id": "foz", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Multi AV Scanner detection for domain / URL

Source: 79.110.62.16:1912

Virustotal: Detection: 12%

Perma Link

Multi AV Scanner detection for submitted file

Source: Acal BFi UK - Products List 020240704PDF.exe

Virustotal: Detection: 33%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Acal BFi UK - Products List 020240704PDF.exe

Joe Sandbox ML: detected

Source: Acal BFi UK - Products List 020240704PDF.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Acal BFi UK - Products List 020240704PDF.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 4x nop then jmp 07320538h	3_2_07320040
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 4x nop then jmp 09246442h	3_2_09246020
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 4x nop then jmp 092468C2h	3_2_09246020
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 4x nop then jmp 09242D02h	3_2_09242A50
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	3_2_09242418

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) 192.168.2.5:49706 -> 79.110.62.16:1912
Source: Traffic	Snort IDS: 2043231 ET TROJAN Redline Stealer TCP CnC Activity 192.168.2.5:49706 -> 79.110.62.16:1912
Source: Traffic	Snort IDS: 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response 79.110.62.16:1912 -> 192.168.2.5:49706

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 79.110.62.16:1912

Source: global traffic

TCP traffic: 192.168.2.5:49706 -> 79.110.62.16:1912

Source: Joe Sandbox View

ASN Name: LASOTELFR LASOTELFR

Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: Acal BFi UK - Products List 020240704PDF.exe	String found in binary or memory: http://tempuri.org/DataSet1.xsd
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp, Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp, Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp, Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3ResponseD
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000000.00000002.1998404535.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Acal BFi UK - Products List 020240704PDF.exe, 00000000.00000002.1998404535.000000000390C000.00000004.00000800.00020000.00000000.sdmp, Acal BFi UK - Products List 020240704PDF.exe, 00000000.00000002.1998404535.0000000003957000.00000004.00000800.00020000.00000000.sdmp, Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp, Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2163095067.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip

System Summary

.NET source code contains very large array initializations

Source: Acal BFi UK - Products List 020240704PDF.exe, Resources.cs

Large array initialization: : array initializer size 728684

Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 0_2_00EDF2E4	0_2_00EDF2E4
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 0_2_06F10498	0_2_06F10498
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 0_2_06F187C8	0_2_06F187C8
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 0_2_06F10489	0_2_06F10489
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 0_2_06F1E070	0_2_06F1E070
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 0_2_06F19178	0_2_06F19178
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 0_2_06F17120	0_2_06F17120
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 0_2_06F17110	0_2_06F17110
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 0_2_06F16CE8	0_2_06F16CE8
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 0_2_06F168B0	0_2_06F168B0
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 3_2_018ADC74	3_2_018ADC74
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 3_2_07327738	3_2_07327738
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 3_2_0732B4A0	3_2_0732B4A0
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 3_2_0732F1F0	3_2_0732F1F0
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 3_2_07320040	3_2_07320040
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 3_2_07321E50	3_2_07321E50
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 3_2_07322B98	3_2_07322B98
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 3_2_0732B948	3_2_0732B948
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 3_2_07320006	3_2_07320006
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 3_2_09246020	3_2_09246020
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 3_2_09243220	3_2_09243220
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 3_2_09242A50	3_2_09242A50
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 3_2_092495A0	3_2_092495A0
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 3_2_092455B8	3_2_092455B8
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 3_2_09242418	3_2_09242418
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 3_2_09244C90	3_2_09244C90
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 3_2_0924601C	3_2_0924601C
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 3_2_09243BA8	3_2_09243BA8
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 3_2_09240BB8	3_2_09240BB8
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 3_2_09240BC8	3_2_09240BC8
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 3_2_09242409	3_2_09242409
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 3_2_09244C80	3_2_09244C80

Source: Acal BFi UK - Products List 020240704PDF.exe, 00000000.00000002.2007496707.0000000006EB0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameRT.dll. vs Acal BFi UK - Products List 020240704PDF.exe
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000000.00000002.1997830874.00000000028C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRT.dll. vs Acal BFi UK - Products List 020240704PDF.exe
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000000.00000002.2008278444.000000000E400000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Acal BFi UK - Products List 020240704PDF.exe
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000000.00000002.1998404535.000000000429E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Acal BFi UK - Products List 020240704PDF.exe
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000000.00000002.1998404535.00000000039A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs Acal BFi UK - Products List 020240704PDF.exe
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000000.00000002.1998404535.000000000390C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs Acal BFi UK - Products List 020240704PDF.exe
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000000.00000002.1996902572.0000000000A5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Acal BFi UK - Products List 020240704PDF.exe
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000000.00000002.1998404535.0000000003957000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs Acal BFi UK - Products List 020240704PDF.exe
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs Acal BFi UK - Products List 020240704PDF.exe
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2163095067.0000000000446000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs Acal BFi UK - Products List 020240704PDF.exe
Source: Acal BFi UK - Products List 020240704PDF.exe	Binary or memory string: OriginalFilenameNsvB.exeD vs Acal BFi UK - Products List 020240704PDF.exe

Source: Acal BFi UK - Products List 020240704PDF.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Acal BFi UK - Products List 020240704PDF.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.e400000.15.raw.unpack, SICfW2horEZfjKNg2G.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.4571e00.8.raw.unpack, SICfW2horEZfjKNg2G.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.e400000.15.raw.unpack, dTUnFlHn2XyurqWSCA.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.e400000.15.raw.unpack, dTUnFlHn2XyurqWSCA.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.e400000.15.raw.unpack, dTUnFlHn2XyurqWSCA.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.4571e00.8.raw.unpack, dTUnFlHn2XyurqWSCA.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.4571e00.8.raw.unpack, dTUnFlHn2XyurqWSCA.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.4571e00.8.raw.unpack, dTUnFlHn2XyurqWSCA.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@0/1

Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Acal BFi UK - Products List 020240704PDF.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe

Mutant created: NULL

Source: Acal BFi UK - Products List 020240704PDF.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Acal BFi UK - Products List 020240704PDF.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Acal BFi UK - Products List 020240704PDF.exe

Virustotal: Detection: 33%

Source: unknown	Process created: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe "C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe"
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process created: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe "C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe"
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process created: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe "C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Acal BFi UK - Products List 020240704PDF.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Acal BFi UK - Products List 020240704PDF.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: Acal BFi UK - Products List 020240704PDF.exe, MainForm.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.e400000.15.raw.unpack, dTUnFlHn2XyurqWSCA.cs	.Net Code: seTF7QOXIk System.Reflection.Assembly.Load(byte[])
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.4571e00.8.raw.unpack, dTUnFlHn2XyurqWSCA.cs	.Net Code: seTF7QOXIk System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 0_2_06F1B808 push es; ret	0_2_06F1B84E
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 3_2_0732B400 push FFFFFF8Bh; iretd	3_2_0732B402
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 3_2_0732B31C push FFFFFF8Bh; iretd	3_2_0732B31E
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Code function: 3_2_0732B361 push FFFFFF8Bh; iretd	3_2_0732B363

Source: Acal BFi UK - Products List 020240704PDF.exe

Static PE information: section name: .text entropy: 7.923423628808881

Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.e400000.15.raw.unpack, lC6aIIABArybbWHsUf.cs	High entropy of concatenated method names: 'WpBybaDiBR', 'rH3yVRku76', 'Kriy4Qci2M', 'WdByL7UWNM', 'HdEy63IeCT', 'WeFyisKW6R', 'y9iyc2LkVS', 'AAgyA1qO7V', 'uUayEPWIKb', 'flZyKleHD2'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.e400000.15.raw.unpack, rdKrpXk1UOc7wi5bZH.cs	High entropy of concatenated method names: 'qOyiDL1k5n', 'Rlhim0lNTL', 'aoQi7OOZAY', 'NSoiNORQC5', 'axSiHm9TpG', 'nEniTHqSKG', 'ljqiIMNdns', 'xcsisQItIE', 'bxxidYay26', 'umcikl5LwR'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.e400000.15.raw.unpack, NsiqUoKOMlr7IcvYJe.cs	High entropy of concatenated method names: 'AmG0EZZLRu', 'U0j0Koiatm', 'ToString', 'MEN0b0A5js', 'Hb10VRsWkH', 'h1S04QvBVm', 'vvw0LGj4qH', 'y9v06jCVpt', 'G0P0iUOcaJ', 'hoP0csWRwQ'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.e400000.15.raw.unpack, ydxQo1aOyWtU7qmN3yN.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'g8shMhguXS', 'sZ8htrHRki', 'foFhqbresA', 'sjMhxIhy0E', 'lRYhOyW1Jy', 'b6Xh2BZfZu', 'YSDhf43xe8'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.e400000.15.raw.unpack, UELmkJN8Z4vp7grtUK.cs	High entropy of concatenated method names: 'io4nsY3Qvv', 'TtUndtXVdp', 'EcNnX1HWPd', 'ayOn1J5XPl', 'Eycn8T1hbp', 'J5bnC9QUAX', 'kZ7nQoh1Ma', 'uu4nBGBmvp', 'EuWnoDa6WU', 'j0HnlQJ4yX'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.e400000.15.raw.unpack, g8ARMEBFO7Tg1FWK1B.cs	High entropy of concatenated method names: 'coYRirihin', 'yS6RcjkDJ8', 'XulREja3l1', 'G5WRKYhmM0', 'AlURPmdE0i', 'gUZRr7Ax1s', 'qfIh69o5OG9JpQgCAF', 'dxM03l8aug64bDPj3N', 'YpCRRN6DQF', 'Ss9RaCaMcS'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.e400000.15.raw.unpack, PDqR0syHIiBonmE7bJ.cs	High entropy of concatenated method names: 'qPPyXjrciy', 'tLQy11UREe', 'Ao8yeNAshy', 'OiZy89M0eL', 'zdVyMfse6l', 'sUbyCor28v', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.e400000.15.raw.unpack, rvj93o4aQ1sTiw0p6B.cs	High entropy of concatenated method names: 'Dispose', 'LDHRvDSacw', 'XfhG1VxCA3', 'ca0ZZ5iM8K', 'b9UR9nMgbd', 'L1vRzm6Zaa', 'ProcessDialogKey', 'ITMGUrSLD2', 'QSTGRJkbxK', 'ScTGGQo6YV'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.e400000.15.raw.unpack, wNFtybaa62dhGPMiB49.cs	High entropy of concatenated method names: 'ToString', 'ij8haynaeM', 'UeqhFdiEfk', 'sl8hwlMjB4', 'iSKhbP3PXM', 'F6ehVV7aRC', 'XEWh4tVFIS', 'B9UhLxvTHe', 'Er73MWgkgq6rxyAlNRk', 'Yb3scNg7IO2y23JRsTC'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.e400000.15.raw.unpack, OSXCZuq44EiNB4DYmu.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'oZOGvg3ojD', 'imGG9FB8f1', 'YQWGzcBgBl', 'QNvaURisk5', 'zwyaRTIXFG', 'mPIaG4e5Mk', 'wk2aaxrgmY', 'DJsiqYRUGMDyEY7jN2l'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.e400000.15.raw.unpack, W8ZbQSt5jWh0sb3rti.cs	High entropy of concatenated method names: 'lHGibf4ajh', 'rNYi4iRIT4', 'Tlbi683Cvy', 'yey696Fq5s', 'U956znwQ6g', 'e9yiUTJu7Y', 'hCEiRCBQDM', 'ldeiGpF0JF', 'BqQiaLMefN', 'M7eiF1rJCh'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.e400000.15.raw.unpack, JYovLVZoiUnjgs6JfN.cs	High entropy of concatenated method names: 'fhh4NLdPKh', 'VKA4TxF81y', 'Pxy4sXtIXY', 'qTx4d39y5G', 'MVr4P2bn18', 'xGZ4raetur', 'b4t40bnSwr', 'x034yucFWw', 'kWT4WETfS3', 'IUc4h9kCoo'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.e400000.15.raw.unpack, wDnIPxmpGcckSP6vC4.cs	High entropy of concatenated method names: 'G7v7VycgK', 'zlsNX23Zn', 'M6VTJWdDh', 'y63IupuYm', 'AggdKhLGO', 'GNEknnMyU', 'YOoJjumP0LfR1hIOfg', 'qxKptm2WIuaVyHUHbB', 'KE2y9eGJG', 'LWNhPkI4A'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.e400000.15.raw.unpack, UliMWVa59jq9jqe0Mk7.cs	High entropy of concatenated method names: 'h04WDGFywC', 'rXSWmAoS0p', 'DptW7wAxLS', 'Hp5WNjbQUn', 'FU5WHlSaAh', 'BacWTPSx73', 'xsmWILJrqc', 'MGtWs6ZXJK', 'oAdWdG2hya', 'zQoWknjBdB'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.e400000.15.raw.unpack, dTUnFlHn2XyurqWSCA.cs	High entropy of concatenated method names: 'eGhawrcG6V', 'Rwkab5tuAE', 'ivaaVu0SVF', 'qYTa45Sr3j', 'krxaLRmXpv', 'wtJa6Y9fVo', 'rAoai3LuTI', 'YbuacSd5rV', 'VIhaArQ2hD', 'aQnaE1Etdn'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.e400000.15.raw.unpack, ide653oNnpAoAJdane.cs	High entropy of concatenated method names: 'FO66wlkhDG', 'zZ86VKybHh', 'Nib6LrVPrm', 'ONN6iffv48', 'c0m6cehueK', 'IDoLORtlIi', 'Ok8L2Gj0R6', 'XZ0LfolXOv', 'xHAL5Ko6II', 'KThLviXJ7J'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.e400000.15.raw.unpack, SICfW2horEZfjKNg2G.cs	High entropy of concatenated method names: 'PwcVMpKNYC', 'thAVtdKtTi', 'P1AVqYq2hV', 'mVwVxy2eo6', 'n4oVOlSm9y', 'KVVV2nMmE3', 'iX4VfpgSy4', 'DJ2V5c7go9', 'sEeVvFQtVk', 'Ak7V9LFlqJ'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.e400000.15.raw.unpack, Pk8tyBz0xsGs1FFEBY.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'J2HWn6qNL6', 'neFWPGa7XG', 'edRWr1Ex2F', 'LM7W0gq7Mf', 'Q32WyaU0FQ', 'jexWWAf3dZ', 'YJoWh6bo3V'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.e400000.15.raw.unpack, WI9mCc9RbUQDCsdfNg.cs	High entropy of concatenated method names: 'aWgWRAgC3i', 'rr0Wav8rat', 'E93WFMtT8V', 'FmXWbKjCo0', 'qx7WVHCZEv', 'YmLWLwkWfD', 'eXAW6kCLFp', 'O8oyfdL91U', 'rgLy5IgySr', 'yAQyvdlfYR'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.e400000.15.raw.unpack, H41oKPStCvFpMB79cZ.cs	High entropy of concatenated method names: 'Qb0LHlq2pn', 'e1yLIcuJLn', 'fSK4e79nKT', 'EdJ48aPmcj', 'oQi4CspA3R', 'zNR4SpATOj', 'ECn4QG43iw', 'vpj4BN5YEG', 'nB74u4FPDG', 'r2v4ofMJrA'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.e400000.15.raw.unpack, YA0HAsXCiB3v8n8Nyp.cs	High entropy of concatenated method names: 'mPh05isLth', 'cr009XV5Sr', 'oyjyUi5BCr', 'wugyR0YS8s', 'mgV0l59xsV', 'bB90Y1YQck', 'CSq03U1QmS', 'BLh0MtlgGn', 'gF00t2Ddwj', 'RvK0qCQmmd'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.4571e00.8.raw.unpack, lC6aIIABArybbWHsUf.cs	High entropy of concatenated method names: 'WpBybaDiBR', 'rH3yVRku76', 'Kriy4Qci2M', 'WdByL7UWNM', 'HdEy63IeCT', 'WeFyisKW6R', 'y9iyc2LkVS', 'AAgyA1qO7V', 'uUayEPWIKb', 'flZyKleHD2'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.4571e00.8.raw.unpack, rdKrpXk1UOc7wi5bZH.cs	High entropy of concatenated method names: 'qOyiDL1k5n', 'Rlhim0lNTL', 'aoQi7OOZAY', 'NSoiNORQC5', 'axSiHm9TpG', 'nEniTHqSKG', 'ljqiIMNdns', 'xcsisQItIE', 'bxxidYay26', 'umcikl5LwR'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.4571e00.8.raw.unpack, NsiqUoKOMlr7IcvYJe.cs	High entropy of concatenated method names: 'AmG0EZZLRu', 'U0j0Koiatm', 'ToString', 'MEN0b0A5js', 'Hb10VRsWkH', 'h1S04QvBVm', 'vvw0LGj4qH', 'y9v06jCVpt', 'G0P0iUOcaJ', 'hoP0csWRwQ'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.4571e00.8.raw.unpack, ydxQo1aOyWtU7qmN3yN.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'g8shMhguXS', 'sZ8htrHRki', 'foFhqbresA', 'sjMhxIhy0E', 'lRYhOyW1Jy', 'b6Xh2BZfZu', 'YSDhf43xe8'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.4571e00.8.raw.unpack, UELmkJN8Z4vp7grtUK.cs	High entropy of concatenated method names: 'io4nsY3Qvv', 'TtUndtXVdp', 'EcNnX1HWPd', 'ayOn1J5XPl', 'Eycn8T1hbp', 'J5bnC9QUAX', 'kZ7nQoh1Ma', 'uu4nBGBmvp', 'EuWnoDa6WU', 'j0HnlQJ4yX'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.4571e00.8.raw.unpack, g8ARMEBFO7Tg1FWK1B.cs	High entropy of concatenated method names: 'coYRirihin', 'yS6RcjkDJ8', 'XulREja3l1', 'G5WRKYhmM0', 'AlURPmdE0i', 'gUZRr7Ax1s', 'qfIh69o5OG9JpQgCAF', 'dxM03l8aug64bDPj3N', 'YpCRRN6DQF', 'Ss9RaCaMcS'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.4571e00.8.raw.unpack, PDqR0syHIiBonmE7bJ.cs	High entropy of concatenated method names: 'qPPyXjrciy', 'tLQy11UREe', 'Ao8yeNAshy', 'OiZy89M0eL', 'zdVyMfse6l', 'sUbyCor28v', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.4571e00.8.raw.unpack, rvj93o4aQ1sTiw0p6B.cs	High entropy of concatenated method names: 'Dispose', 'LDHRvDSacw', 'XfhG1VxCA3', 'ca0ZZ5iM8K', 'b9UR9nMgbd', 'L1vRzm6Zaa', 'ProcessDialogKey', 'ITMGUrSLD2', 'QSTGRJkbxK', 'ScTGGQo6YV'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.4571e00.8.raw.unpack, wNFtybaa62dhGPMiB49.cs	High entropy of concatenated method names: 'ToString', 'ij8haynaeM', 'UeqhFdiEfk', 'sl8hwlMjB4', 'iSKhbP3PXM', 'F6ehVV7aRC', 'XEWh4tVFIS', 'B9UhLxvTHe', 'Er73MWgkgq6rxyAlNRk', 'Yb3scNg7IO2y23JRsTC'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.4571e00.8.raw.unpack, OSXCZuq44EiNB4DYmu.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'oZOGvg3ojD', 'imGG9FB8f1', 'YQWGzcBgBl', 'QNvaURisk5', 'zwyaRTIXFG', 'mPIaG4e5Mk', 'wk2aaxrgmY', 'DJsiqYRUGMDyEY7jN2l'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.4571e00.8.raw.unpack, W8ZbQSt5jWh0sb3rti.cs	High entropy of concatenated method names: 'lHGibf4ajh', 'rNYi4iRIT4', 'Tlbi683Cvy', 'yey696Fq5s', 'U956znwQ6g', 'e9yiUTJu7Y', 'hCEiRCBQDM', 'ldeiGpF0JF', 'BqQiaLMefN', 'M7eiF1rJCh'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.4571e00.8.raw.unpack, JYovLVZoiUnjgs6JfN.cs	High entropy of concatenated method names: 'fhh4NLdPKh', 'VKA4TxF81y', 'Pxy4sXtIXY', 'qTx4d39y5G', 'MVr4P2bn18', 'xGZ4raetur', 'b4t40bnSwr', 'x034yucFWw', 'kWT4WETfS3', 'IUc4h9kCoo'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.4571e00.8.raw.unpack, wDnIPxmpGcckSP6vC4.cs	High entropy of concatenated method names: 'G7v7VycgK', 'zlsNX23Zn', 'M6VTJWdDh', 'y63IupuYm', 'AggdKhLGO', 'GNEknnMyU', 'YOoJjumP0LfR1hIOfg', 'qxKptm2WIuaVyHUHbB', 'KE2y9eGJG', 'LWNhPkI4A'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.4571e00.8.raw.unpack, UliMWVa59jq9jqe0Mk7.cs	High entropy of concatenated method names: 'h04WDGFywC', 'rXSWmAoS0p', 'DptW7wAxLS', 'Hp5WNjbQUn', 'FU5WHlSaAh', 'BacWTPSx73', 'xsmWILJrqc', 'MGtWs6ZXJK', 'oAdWdG2hya', 'zQoWknjBdB'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.4571e00.8.raw.unpack, dTUnFlHn2XyurqWSCA.cs	High entropy of concatenated method names: 'eGhawrcG6V', 'Rwkab5tuAE', 'ivaaVu0SVF', 'qYTa45Sr3j', 'krxaLRmXpv', 'wtJa6Y9fVo', 'rAoai3LuTI', 'YbuacSd5rV', 'VIhaArQ2hD', 'aQnaE1Etdn'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.4571e00.8.raw.unpack, ide653oNnpAoAJdane.cs	High entropy of concatenated method names: 'FO66wlkhDG', 'zZ86VKybHh', 'Nib6LrVPrm', 'ONN6iffv48', 'c0m6cehueK', 'IDoLORtlIi', 'Ok8L2Gj0R6', 'XZ0LfolXOv', 'xHAL5Ko6II', 'KThLviXJ7J'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.4571e00.8.raw.unpack, SICfW2horEZfjKNg2G.cs	High entropy of concatenated method names: 'PwcVMpKNYC', 'thAVtdKtTi', 'P1AVqYq2hV', 'mVwVxy2eo6', 'n4oVOlSm9y', 'KVVV2nMmE3', 'iX4VfpgSy4', 'DJ2V5c7go9', 'sEeVvFQtVk', 'Ak7V9LFlqJ'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.4571e00.8.raw.unpack, Pk8tyBz0xsGs1FFEBY.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'J2HWn6qNL6', 'neFWPGa7XG', 'edRWr1Ex2F', 'LM7W0gq7Mf', 'Q32WyaU0FQ', 'jexWWAf3dZ', 'YJoWh6bo3V'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.4571e00.8.raw.unpack, WI9mCc9RbUQDCsdfNg.cs	High entropy of concatenated method names: 'aWgWRAgC3i', 'rr0Wav8rat', 'E93WFMtT8V', 'FmXWbKjCo0', 'qx7WVHCZEv', 'YmLWLwkWfD', 'eXAW6kCLFp', 'O8oyfdL91U', 'rgLy5IgySr', 'yAQyvdlfYR'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.4571e00.8.raw.unpack, H41oKPStCvFpMB79cZ.cs	High entropy of concatenated method names: 'Qb0LHlq2pn', 'e1yLIcuJLn', 'fSK4e79nKT', 'EdJ48aPmcj', 'oQi4CspA3R', 'zNR4SpATOj', 'ECn4QG43iw', 'vpj4BN5YEG', 'nB74u4FPDG', 'r2v4ofMJrA'
Source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.4571e00.8.raw.unpack, YA0HAsXCiB3v8n8Nyp.cs	High entropy of concatenated method names: 'mPh05isLth', 'cr009XV5Sr', 'oyjyUi5BCr', 'wugyR0YS8s', 'mgV0l59xsV', 'bB90Y1YQck', 'CSq03U1QmS', 'BLh0MtlgGn', 'gF00t2Ddwj', 'RvK0qCQmmd'

Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	File created: \acal bfi uk - products list 020240704pdf.exe
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	File created: \acal bfi uk - products list 020240704pdf.exe			Jump to behavior

Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: Acal BFi UK - Products List 020240704PDF.exe PID: 6456, type: MEMORYSTR

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Memory allocated: ED0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Memory allocated: 28C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Memory allocated: 2800000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Memory allocated: 8A70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Memory allocated: 9A70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Memory allocated: 9C70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Memory allocated: AC70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Memory allocated: B070000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Memory allocated: C070000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Memory allocated: D070000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Memory allocated: E490000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Memory allocated: F490000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Memory allocated: 10490000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Memory allocated: 11490000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Memory allocated: 18A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Memory allocated: 31D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Memory allocated: 51D0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Window / User API: threadDelayed 749			Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Window / User API: threadDelayed 3756			Jump to behavior

Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe TID: 7124	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe TID: 2504	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe TID: 6584	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.000000000367D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.000000000367D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.000000000367D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.000000000367D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.000000000367D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.000000000367D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.000000000367D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.000000000367D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.000000000367D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.000000000367D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.000000000367D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.000000000367D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000000.00000002.1998404535.000000000429E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: EjuKEygW1vmCi3OKcCy
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.000000000367D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2164682294.00000000015BF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.000000000367D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.000000000367D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.000000000367D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.000000000367D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.000000000367D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.000000000367D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.000000000367D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.000000000367D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.000000000367D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.000000000367D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.000000000367D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.000000000367D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.000000000367D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.000000000367D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.000000000367D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.000000000367D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.000000000367D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.000000000367D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655

Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe

Memory written: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe

Process created: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe "C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Queries volume information: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Queries volume information: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.38c9970.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Acal BFi UK - Products List 020240704PDF.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.3914b90.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.3914b90.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.38c9970.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1998404535.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1998404535.0000000003957000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1998404535.000000000390C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2163095067.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Acal BFi UK - Products List 020240704PDF.exe PID: 6456, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Acal BFi UK - Products List 020240704PDF.exe PID: 4028, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Acal BFi UK - Products List 020240704PDF.exe PID: 4028, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.38c9970.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Acal BFi UK - Products List 020240704PDF.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.3914b90.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.3914b90.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Acal BFi UK - Products List 020240704PDF.exe.38c9970.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1998404535.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1998404535.0000000003957000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1998404535.000000000390C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2163095067.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Acal BFi UK - Products List 020240704PDF.exe PID: 6456, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Acal BFi UK - Products List 020240704PDF.exe PID: 4028, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	1 Masquerading	1 OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	113 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Acal BFi UK - Products List 020240704PDF.exe	34%	Virustotal		Browse
Acal BFi UK - Products List 020240704PDF.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	0%	URL Reputation	safe
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6Response	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9Response	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	0%	URL Reputation	safe
http://tempuri.org/Entity/Id1Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	0%	URL Reputation	safe
http://tempuri.org/Entity/Id16Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id23ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	0%	Avira URL Cloud	safe
http://tempuri.org/DataSet1.xsd	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust	0%	URL Reputation	safe
http://tempuri.org/D	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	0%	URL Reputation	safe
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	0%	Virustotal		Browse
http://tempuri.org/Entity/Id9	0%	Avira URL Cloud	safe
http://tempuri.org/DataSet1.xsd	0%	Virustotal		Browse
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	0%	Virustotal		Browse
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	0%	Virustotal		Browse
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	0%	Virustotal		Browse
http://tempuri.org/Entity/Id5	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id4	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id7	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9	3%	Virustotal		Browse
http://tempuri.org/Entity/Id5	1%	Virustotal		Browse
http://tempuri.org/Entity/Id8	1%	Virustotal		Browse
http://tempuri.org/Entity/Id23ResponseD	1%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	0%	Virustotal		Browse
http://tempuri.org/Entity/Id4	1%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id7	1%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/10/wsat	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	0%	Virustotal		Browse
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/04/sc	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6	1%	Virustotal		Browse
http://tempuri.org/Entity/Id1ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	0%	Avira URL Cloud	safe
79.110.62.16:1912	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id20	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/sc	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	0%	Virustotal		Browse
79.110.62.16:1912	13%	Virustotal		Browse
http://tempuri.org/Entity/Id22	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21	1%	Virustotal		Browse
http://tempuri.org/Entity/Id24	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/10/wsat	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23	1%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	0%	Virustotal		Browse
http://tempuri.org/Entity/Id1ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id24Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
79.110.62.16:1912	true	13%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12Response	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/DataSet1.xsd	Acal BFi UK - Products List 020240704PDF.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp, Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21Response	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id9	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id4	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id7	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19Response	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15Response	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6Response	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.ip.sb/ip	Acal BFi UK - Products List 020240704PDF.exe, 00000000.00000002.1998404535.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Acal BFi UK - Products List 020240704PDF.exe, 00000000.00000002.1998404535.000000000390C000.00000004.00000800.00020000.00000000.sdmp, Acal BFi UK - Products List 020240704PDF.exe, 00000000.00000002.1998404535.0000000003957000.00000004.00000800.00020000.00000000.sdmp, Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp, Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2163095067.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id1ResponseD	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id9Response	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id20	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id22	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id23	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id24	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id24Response	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id1Response	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id11	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16Response	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id13	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id17	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id18	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5Response	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id19	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id10Response	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8Response	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id3ResponseD	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23Response	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp, Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/D	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/06/addressingex	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	Acal BFi UK - Products List 020240704PDF.exe, 00000003.00000002.2165008190.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
79.110.62.16	unknown	Germany		39180	LASOTELFR	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467943
Start date and time:	2024-07-05 06:01:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Acal BFi UK - Products List 020240704PDF.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 64 Number of non-executed functions: 8
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
00:01:49	API Interceptor	24x Sleep call for process: Acal BFi UK - Products List 020240704PDF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
79.110.62.16	FOB TENDER 5463DTZR-KS03.exe	Get hash	malicious	RedLine	Browse
	Nichiden Viet Nam - Products List & Specification.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse
	Products inquiryJULY ORDER2024.PDF.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LASOTELFR	Acal BFi UK - Products List 020240704.exe	Get hash	malicious	AgentTesla, RedLine, StormKitty, XWorm	Browse	79.110.62.113
	FOB TENDER 5463DTZR-KS03.exe	Get hash	malicious	RedLine	Browse	79.110.62.16
	Nichiden Viet Nam - Products List & Specification.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	79.110.62.16
	Products inquiryJULY ORDER2024.PDF.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	79.110.62.16
	Nichiden Viet Nam - RFQ List & Specification..exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	79.110.62.113
	copy_76499Kxls.vbs	Get hash	malicious	Remcos, GuLoader	Browse	79.110.62.35
	Invoice 78284722.doc	Get hash	malicious	Remcos	Browse	79.110.62.77
	V4ybHAFrDb.exe	Get hash	malicious	Remcos	Browse	79.110.62.77
	EUR-32608-Swift.doc	Get hash	malicious	Remcos	Browse	79.110.62.77
	HVuACIbZyx.exe	Get hash	malicious	Remcos	Browse	79.110.62.77

Process:	C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.917500189223224
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Acal BFi UK - Products List 020240704PDF.exe
File size:	819'712 bytes
MD5:	b7d9ebad39110de3ff89686962c3270b
SHA1:	a6e86e8d2ff174655eb1d30c62506db91e26c943
SHA256:	77ccc61481c9fa009dfb6af2f6293b604312d440df4338e757ad2df844d10e0b
SHA512:	33e0439e08deb2c35ddf27e1604efa75888509340b96a4e44f976f00a5cf5f61d2f209837c8a48850224bd08ceaa08b2137ddb1307b147d834e695c2fd573234
SSDEEP:	24576:87LxpIU55gevCR+vlum6CMQe5aFpBpLHLKRAwn:6vTPdkDl5u/FQBn
TLSH:	7805128852BFAF1AD53D4BB5D0B1251417B0E41A9312F3671ED638EA1E21BC08AB5FC7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...VO.f.................x............... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4c97ae
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66874F56 [Fri Jul 5 01:41:42 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc975c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xca000	0x600	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xcc000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xc77b4	0xc7800	ebdb97d24661661bbaf36a50446dd32d	False	0.9425210976660401	data	7.923423628808881	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xca000	0x600	0x600	0e48bdb133eed7e85e06d1b6bc0f13a2	False	0.4231770833333333	data	4.107152535264838	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xcc000	0xc	0x200	3b4bbca91dd191585d385cd353a00f1e	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xca090	0x32c	data			0.42610837438423643
RT_MANIFEST	0xca3cc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/05/24-06:01:59.399207	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	1912	49706	79.110.62.16	192.168.2.5
07/05/24-06:01:59.217507	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	49706	1912	192.168.2.5	79.110.62.16
07/05/24-06:02:04.460027	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49706	1912	192.168.2.5	79.110.62.16

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 5, 2024 06:01:52.452286005 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:01:52.457345009 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:01:52.457421064 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:01:52.466340065 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:01:52.471187115 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:01:59.097208023 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:01:59.143275023 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:01:59.217506886 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:01:59.222377062 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:01:59.399207115 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:01:59.440148115 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:04.460026979 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:04.465547085 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:04.649739981 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:04.649785995 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:04.649800062 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:04.649811983 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:04.649826050 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:04.649951935 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:05.994570971 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.005740881 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.005762100 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.005825043 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.005975962 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.005986929 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.006026030 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.023941040 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.023953915 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.023962021 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.023971081 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.023977995 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.023986101 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.023993015 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.023997068 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.023998022 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.024004936 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.024013996 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.024028063 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.024036884 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.024036884 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.024044037 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.024063110 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.024090052 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.031033039 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.031043053 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.031050920 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.031059027 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.031100035 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.031141996 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.031303883 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.031418085 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.032140970 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.032187939 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.038398027 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.038470030 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.038754940 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.038813114 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.038885117 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.038933992 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.038959026 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.039045095 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.039047956 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.039057970 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.039110899 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.039140940 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.039169073 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.039169073 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.039179087 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.039186954 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.039213896 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.039232016 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.039254904 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.039316893 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.039325953 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.039326906 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.039369106 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.039427042 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.039437056 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.039484024 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.039654970 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.039664984 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.039674997 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.039685011 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.039701939 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.039710999 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.039711952 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.039742947 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.039769888 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.039779902 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.039797068 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.039807081 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.039822102 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.039829016 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.039839029 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.039846897 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.039858103 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.039868116 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.039870024 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.039880037 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.039889097 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.039905071 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.039937973 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.039957047 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.039967060 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.039973974 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.039983034 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.039994001 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.040004969 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.043179035 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.043190002 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.043229103 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.043237925 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.043349028 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.043665886 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.043673992 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.043780088 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.043788910 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.043875933 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.043935061 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.044039011 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.044049978 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.044059038 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.044068098 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.044222116 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.044233084 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.044251919 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.044260979 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.044271946 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.044346094 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.044400930 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.044410944 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.044507027 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.044557095 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.044637918 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.044648886 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.044651985 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.044706106 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.044765949 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.044770002 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.044775009 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.044806957 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.044842005 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.044874907 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.044918060 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.045068026 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.045077085 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.045146942 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.045156956 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.045166016 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.045291901 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.045301914 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.045309067 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.045319080 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.045325994 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.045335054 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.045351982 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.045361996 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.045368910 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.045377970 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.045424938 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.045434952 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.045505047 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.045514107 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.045552015 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.045665026 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.045674086 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.045681953 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.045691013 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.045701027 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.045710087 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.045727015 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.045736074 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.045758009 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.045768023 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.045778036 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.045825005 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.045835972 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.045886040 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.045896053 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.045922041 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.045983076 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.045991898 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.046088934 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.046107054 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.046116114 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.046164036 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.046241045 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.046256065 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.046282053 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.046461105 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.046521902 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.049598932 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.049844027 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.049853086 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.049896002 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.049913883 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.049968004 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.049978018 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050128937 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050137997 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050189018 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050198078 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050251007 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050260067 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050307989 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050384998 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050425053 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050432920 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050493002 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050502062 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050509930 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050525904 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050544024 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050554037 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050606966 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050616980 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050627947 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050719976 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050729990 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050738096 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050751925 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050761938 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050770044 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050779104 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050796032 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050803900 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050812960 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050822020 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050831079 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050838947 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050848961 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050858021 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050873995 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050883055 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050890923 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050899029 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050906897 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050915956 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050924063 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050934076 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050941944 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050954103 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050964117 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.050973892 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.051419973 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.051429033 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.051435947 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.051445007 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.051462889 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.051472902 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.051484108 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.051512957 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.051548004 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.051610947 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.051625967 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.051635981 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.051666975 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.051672935 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.051702976 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.051712036 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.051738024 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.051866055 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.051875114 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.051882982 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.051892042 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.051902056 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.051928997 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.051939011 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.051948071 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.051979065 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.052045107 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.052053928 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.052062988 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.052072048 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.052089930 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.052098989 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.052105904 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.052114964 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.052123070 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.052131891 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.052144051 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.052153111 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.052160978 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.052169085 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.052179098 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.052195072 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.052202940 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.052212000 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.052222967 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.052232027 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.052239895 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.052258015 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.052268028 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.052274942 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.052284002 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.052294970 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.052335024 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.052345037 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.052352905 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.056444883 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.056500912 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.056510925 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.056554079 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.056606054 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.056611061 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.056658983 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.056668997 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.056678057 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.056680918 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.056723118 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.056835890 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.056844950 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.056849003 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.056853056 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.056924105 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.056931973 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.056953907 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.056962967 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.056974888 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.056984901 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.057065964 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.057075977 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.057082891 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.057092905 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.057166100 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.057176113 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.057183981 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.057192087 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.057209969 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.057219982 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.057226896 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.057235956 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.057244062 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.057254076 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.057280064 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.057290077 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.057296991 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.057312012 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.057322025 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.057328939 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.057347059 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.057356119 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.057365894 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.057375908 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.057411909 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.057420969 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.057429075 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.057432890 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.057461023 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.057470083 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.057487011 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.057496071 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.057512045 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.057521105 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.061650038 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.061698914 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.061743975 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.061815023 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.061825037 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.061825991 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.061904907 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.061918020 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.061928034 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.061964035 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.062020063 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.062149048 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.062195063 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.062231064 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.062241077 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.062262058 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.062304974 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.062364101 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.062374115 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.062432051 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.062439919 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.062473059 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.062500000 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.062563896 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.062572956 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.062580109 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.062598944 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.062608004 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.062618017 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.062649965 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.062659025 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.062674999 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.062683105 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.062700987 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.062714100 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.062726974 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.062768936 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.062778950 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.062863111 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.062871933 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.062973976 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.062983036 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.062990904 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.063000917 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.063009977 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.063018084 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.063025951 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.063043118 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.063051939 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.063059092 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.063066959 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.063076019 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.063092947 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.063102007 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.063143015 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.066782951 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.066793919 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.066926003 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.066987038 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.066993952 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.067019939 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.067079067 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.067092896 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.067116976 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.067126036 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.067171097 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.067178965 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.067187071 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.067189932 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.067224979 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.067241907 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.067279100 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.067287922 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.067296028 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.067305088 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.067322016 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.067331076 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.067359924 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.067368984 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.067400932 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.067459106 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.067467928 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.067476034 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.067492962 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.067502022 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.067536116 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.067544937 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.067585945 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.067595005 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.067682981 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.067692995 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.067732096 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.080780029 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.086414099 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.086594105 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.086654902 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.086654902 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.086710930 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.091883898 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.091979027 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.091989040 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.091998100 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.092008114 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.092016935 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.092022896 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.092061996 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.092071056 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.092080116 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.092259884 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.092324972 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.092533112 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.092541933 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.092591047 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.098275900 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.098412991 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.103418112 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.127636909 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.132515907 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.970685959 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:06.971504927 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:06.976341963 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:07.659764051 CEST	1912	49706	79.110.62.16	192.168.2.5
Jul 5, 2024 06:02:07.705898046 CEST	49706	1912	192.168.2.5	79.110.62.16
Jul 5, 2024 06:02:07.747241020 CEST	49706	1912	192.168.2.5	79.110.62.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 5, 2024 06:02:13.728471994 CEST	53	56366	1.1.1.1	192.168.2.5
Jul 5, 2024 06:02:15.229121923 CEST	53	57903	1.1.1.1	192.168.2.5

Target ID:	0
Start time:	00:01:48
Start date:	05/07/2024
Path:	C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe"
Imagebase:	0x3a0000
File size:	819'712 bytes
MD5 hash:	B7D9EBAD39110DE3FF89686962C3270B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1998404535.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1998404535.0000000003957000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1998404535.000000000390C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:01:49
Start date:	05/07/2024
Path:	C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Acal BFi UK - Products List 020240704PDF.exe"
Imagebase:	0xeb0000
File size:	819'712 bytes
MD5 hash:	B7D9EBAD39110DE3FF89686962C3270B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000003.00000002.2163095067.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000003.00000002.2165008190.0000000003266000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	225
Total number of Limit Nodes:	20

Executed Functions

Function 06F10489 Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

T(z , xrefs: 06F10587

Memory Dump Source

Source File: 00000000.00000002.2007635483.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID:
String ID: T(z
API String ID: 0-3184255237
Opcode ID: b18938631614c716fcdbca92e7af9d34f95f442444be9ab44dcfbafee532bae9
Instruction ID: f90591d7f3927acf2a114e3a7fb7c66e05b914c0672ba50851644c24fb57ac3c
Opcode Fuzzy Hash: b18938631614c716fcdbca92e7af9d34f95f442444be9ab44dcfbafee532bae9
Instruction Fuzzy Hash: 63414E32F052049FEB98CFB88A515BFB6B7BBD8640F14D42BD509AF291CE708D418791

Function 06F10498 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

T(z , xrefs: 06F10587

Memory Dump Source

Source File: 00000000.00000002.2007635483.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID:
String ID: T(z
API String ID: 0-3184255237
Opcode ID: 7525f882efbd63f80767d0b5b3a6714b1158109be727e20621970e6e76acd042
Instruction ID: 01d7c6423fc85e78bc64e0bc75ac61483c0a981038d7023e767da08169691422
Opcode Fuzzy Hash: 7525f882efbd63f80767d0b5b3a6714b1158109be727e20621970e6e76acd042
Instruction Fuzzy Hash: 84410D32F011059FEB98CEB98A516BFB6A6BBD8640F10D427D519BF294CE70CD418791

Function 00EDD7F0 Relevance: 6.1, APIs: 4, Instructions: 129
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00EDD87E
GetCurrentThread.KERNEL32 ref: 00EDD8BB
GetCurrentProcess.KERNEL32 ref: 00EDD8F8
GetCurrentThreadId.KERNEL32 ref: 00EDD951

Memory Dump Source

Source File: 00000000.00000002.1997528978.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 01650d23244fb7111749324ccad850a66e5291936e740740c00e4c1a92b38e15
Instruction ID: 7bdd5e8035e052c30d70281a562b053d6f1bf830b84bc3d1beb72f98b82abcb2
Opcode Fuzzy Hash: 01650d23244fb7111749324ccad850a66e5291936e740740c00e4c1a92b38e15
Instruction Fuzzy Hash: FE5166B09012098FDB08DFA9D9587AEBBF1EF88314F24849DD008B7360DB79A944CF65

Function 00EDD800 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00EDD87E
GetCurrentThread.KERNEL32 ref: 00EDD8BB
GetCurrentProcess.KERNEL32 ref: 00EDD8F8
GetCurrentThreadId.KERNEL32 ref: 00EDD951

Memory Dump Source

Source File: 00000000.00000002.1997528978.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: c41c0a020ed79448a5f6561aed4c33e9fd98d906efa639934981c9a1c04b1994
Instruction ID: 2d32ae42305b6d86a782676076ebf86cdc0b698f5c6fc25dea31ce83a1d13a00
Opcode Fuzzy Hash: c41c0a020ed79448a5f6561aed4c33e9fd98d906efa639934981c9a1c04b1994
Instruction Fuzzy Hash: 105154B09012098FDB14DFAAD958BAEBBF5EF88304F20845DE009A7360D779A944CF65

Function 00EDB158 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00EDB3BE

Strings

$G, xrefs: 00EDB31B
$G, xrefs: 00EDB2F6

Memory Dump Source

Source File: 00000000.00000002.1997528978.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID: HandleModule
String ID: $G$$G
API String ID: 4139908857-1356050826
Opcode ID: 21a58128293d87f148228bc7acc8495956bcbe078255aca74e9a64c7e98c67cb
Instruction ID: 61eca61414f678b4a1f997bb7496cdc9c92768a8869d9225d4461a04491f73f4
Opcode Fuzzy Hash: 21a58128293d87f148228bc7acc8495956bcbe078255aca74e9a64c7e98c67cb
Instruction Fuzzy Hash: B8812070A00B058FD724DF69D4457AABBF1FF88304F10992ED48AA7B50EB74E946CB91

Function 06F198EC Relevance: 1.7, APIs: 1, Instructions: 249
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06F19B2E

Memory Dump Source

Source File: 00000000.00000002.2007635483.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 7b85a997a39da78307f7dede14eb29641c994d97f33769edcd414ed3ec4ddcae
Instruction ID: 04f2bffc1fa69a0c354ad50720be37993215f80321e90b0a5a5ba0e51aaa95d5
Opcode Fuzzy Hash: 7b85a997a39da78307f7dede14eb29641c994d97f33769edcd414ed3ec4ddcae
Instruction Fuzzy Hash: 8FA19C71D00219CFDB64CF68C851BEDBBB2FF48304F14856AE809AB244DBB59A85CF91

Function 06F198F8 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06F19B2E

Memory Dump Source

Source File: 00000000.00000002.2007635483.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 4c0f678a1d2f30db73a2c6d5840ce163fb3c0c622fbc045c932ad2b4ce86049d
Instruction ID: 042645ab5cacd5f2d4d311784bae38ccd7c874076b6164d5a18f700823e25033
Opcode Fuzzy Hash: 4c0f678a1d2f30db73a2c6d5840ce163fb3c0c622fbc045c932ad2b4ce86049d
Instruction Fuzzy Hash: DC918C71D00219CFDB64CF68C851BEDBBB2FF48304F14856AD809AB244DBB59A85CF91

Function 00ED4AD0 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00ED5F71

Memory Dump Source

Source File: 00000000.00000002.1997528978.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 11cd3ef86a46f211a831db65d6edc0d9a5ea16c3c16a32c3b731cf2454e646db
Instruction ID: 25de68eea8e90671ea876ac74a262160cd637e4f8efbc0e0ba906bd84aeddfb0
Opcode Fuzzy Hash: 11cd3ef86a46f211a831db65d6edc0d9a5ea16c3c16a32c3b731cf2454e646db
Instruction Fuzzy Hash: E141BCB1D00619CADB24DFA9C844B9EBBF5FF49304F20806AD408BB255DBB5694ACF90

Function 00ED5EB4 Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00ED5F71

Memory Dump Source

Source File: 00000000.00000002.1997528978.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 550a4ffc455fc0aa49b9d5459b463c4dbc5b8e74140d5865c61bd4c91f4c50b1
Instruction ID: 105427e05d8572be0c65f5bb221dccdd3e990d3b253438e326f19298b379bb63
Opcode Fuzzy Hash: 550a4ffc455fc0aa49b9d5459b463c4dbc5b8e74140d5865c61bd4c91f4c50b1
Instruction Fuzzy Hash: F741DDB1D00619CFDB24DFA9C984B9DBBB6FF49304F20806AD408AB254DB75694ACF90

Function 06F19668 Relevance: 1.6, APIs: 1, Instructions: 73injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06F19700

Memory Dump Source

Source File: 00000000.00000002.2007635483.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: f842f5330e950ec507d628f8356701d793ca494218e88c2476e9135e163a55a0
Instruction ID: 611de66f7b75aa177ff7f64a9448c02fd80e38057974b7ba6fd42c30d9609828
Opcode Fuzzy Hash: f842f5330e950ec507d628f8356701d793ca494218e88c2476e9135e163a55a0
Instruction Fuzzy Hash: E82117B5D002499FCB10DFAAC885BEEBBF5FF48310F50842AE959A7240C7789945CBA0

Function 06F19670 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06F19700

Memory Dump Source

Source File: 00000000.00000002.2007635483.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 68a81001d734746900b3f7e6b20d3614119ddec57336fe261f5ca02542a8c1b9
Instruction ID: e918db5e2eddc52b65561d06959ad8807e303f1e4833158cb3e189d25276bdc8
Opcode Fuzzy Hash: 68a81001d734746900b3f7e6b20d3614119ddec57336fe261f5ca02542a8c1b9
Instruction Fuzzy Hash: 98212AB5D003499FCB10DFAAC885BEEBBF5FF48310F10842AE959A7250D7799954CBA0

Function 06F19758 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06F197E0

Memory Dump Source

Source File: 00000000.00000002.2007635483.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: b8062e69ceccb5517b067baa1f2125da798a5b93d239d5b23d81551b079dc997
Instruction ID: fe35f9fce11d9056efca25eb572df9a76f399db4ea7a89ff440f4c9713f5a543
Opcode Fuzzy Hash: b8062e69ceccb5517b067baa1f2125da798a5b93d239d5b23d81551b079dc997
Instruction Fuzzy Hash: 232128B1C002499FCB10DFAAC885AEEFBF5FF48310F10842AE559A7240C7789941CFA4

Function 06F19098 Relevance: 1.6, APIs: 1, Instructions: 68threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06F1911E

Memory Dump Source

Source File: 00000000.00000002.2007635483.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 1ba9fbdd9f09b025104d871c81e2bc79cdc1474baf499f3ad9de1d63cadc5e87
Instruction ID: 2a4a36f4681a6399bc3b4e9cc0dbffc4155960aa780b05ad0f254bd2517f0791
Opcode Fuzzy Hash: 1ba9fbdd9f09b025104d871c81e2bc79cdc1474baf499f3ad9de1d63cadc5e87
Instruction Fuzzy Hash: BB2139B1D002098FDB54DFAAC4857EEBBF5FF48314F14842AD559A7240CB789985CFA4

Function 06F19760 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06F197E0

Memory Dump Source

Source File: 00000000.00000002.2007635483.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 917c2af153cabe897d7782125458c107dbaeb8d3473f30efee2b6c21452fae54
Instruction ID: 4b9b5bca59b8323c6c2692bb1c981aceff120e3c085b653c56bfb390e03d05ef
Opcode Fuzzy Hash: 917c2af153cabe897d7782125458c107dbaeb8d3473f30efee2b6c21452fae54
Instruction Fuzzy Hash: 8D2138B1C003499FCB10DFAAC881AEEFBF5FF48310F10842AE519A7240C7789940CBA0

Function 06F190A0 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06F1911E

Memory Dump Source

Source File: 00000000.00000002.2007635483.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 163b998c6f8c59e847cb643947f7662eff1f6039768b0da7f56dc4697b5c0749
Instruction ID: 42b3fee13a805a3e9e4ef08ec7ecad91d7e2516e1410c752555580a550388611
Opcode Fuzzy Hash: 163b998c6f8c59e847cb643947f7662eff1f6039768b0da7f56dc4697b5c0749
Instruction Fuzzy Hash: AC2118B1D002098FDB10DFAAC4857EEBBF5EF48314F148429D559A7240DB789985CFA1

Function 00EDDA48 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00EDDACF

Memory Dump Source

Source File: 00000000.00000002.1997528978.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b2d1b777af7edf308eb0e4081d77acf2c64ac24a1cdfd970a8afbae8e0713433
Instruction ID: e60347c70d5b0ee648063da6d1078521e1b20d9a72b85126a4cbabbf7f8ea93f
Opcode Fuzzy Hash: b2d1b777af7edf308eb0e4081d77acf2c64ac24a1cdfd970a8afbae8e0713433
Instruction Fuzzy Hash: 8521E4B59042089FDB10CF9AD984AEEBFF8FB48310F14801AE918A3310D378A940CFA0

Function 00EDDA40 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00EDDACF

Memory Dump Source

Source File: 00000000.00000002.1997528978.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1e1744c517dc0d761793750bdf28d8edc675c2c442eab71cb10631dac77c9413
Instruction ID: df64c41f6347491b69d7464cfd813c0388925b89b6952fdde562c2274448a78e
Opcode Fuzzy Hash: 1e1744c517dc0d761793750bdf28d8edc675c2c442eab71cb10631dac77c9413
Instruction Fuzzy Hash: A821E2B5904208DFDB10CFA9D984AEEBBF5FB48310F14801AE918A7350D378A954CFA4

Function 06F195A8 Relevance: 1.6, APIs: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06F1961E

Memory Dump Source

Source File: 00000000.00000002.2007635483.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ae86cb2c00a47103fd032aabc552425e1662511c3238bed84d4a00a51035f5bb
Instruction ID: 685430de025974f1763089c7e5d8d41f23d1e6d9d11db0069c0a70523efbf12a
Opcode Fuzzy Hash: ae86cb2c00a47103fd032aabc552425e1662511c3238bed84d4a00a51035f5bb
Instruction Fuzzy Hash: 1F2156758002499FDB20DFAAC845BEFFFF5EF49310F248819E559A7250C779A944CBA0

Function 00EDA548 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00EDB439,00000800,00000000,00000000), ref: 00EDBA4A

Memory Dump Source

Source File: 00000000.00000002.1997528978.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1ec310a3bfedcac5a2ce8c5a1aa8646542d91f3fb1e520640e1eaaeb82d149ab
Instruction ID: 3f1551577d5e477a76c702296cdb84b7dd545ff8cc36d4bcb824cec4182d15cb
Opcode Fuzzy Hash: 1ec310a3bfedcac5a2ce8c5a1aa8646542d91f3fb1e520640e1eaaeb82d149ab
Instruction Fuzzy Hash: 911103B69002489FDB10DF9AD445AEEFBF4EB88310F11842AE519B7310D379A945CFA4

Function 00EDB9DB Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00EDB439,00000800,00000000,00000000), ref: 00EDBA4A

Memory Dump Source

Source File: 00000000.00000002.1997528978.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 64d07fd5651bbca6c4a813be5b9667d37d7403f240be89e7262caa1706d51b06
Instruction ID: 85a57cf8a26796a5c17146c444d492437cbd30f662032af64d14d35c700ee93b
Opcode Fuzzy Hash: 64d07fd5651bbca6c4a813be5b9667d37d7403f240be89e7262caa1706d51b06
Instruction Fuzzy Hash: 521112B6800209CFDB10DF9AD484AEEFBF5EB88310F10842AD419B7210C379A946CFA4

Function 06F195B0 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06F1961E

Memory Dump Source

Source File: 00000000.00000002.2007635483.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 492fb75791d6952f5db08fb9acea6a2cf24254434613c725dc7b8a4d8d43c50b
Instruction ID: 8f10363e25553ae47316cc00f5258a75bfc5d659d24ec7b314b6bee15cad84fd
Opcode Fuzzy Hash: 492fb75791d6952f5db08fb9acea6a2cf24254434613c725dc7b8a4d8d43c50b
Instruction Fuzzy Hash: 951126758002499FCB10DFAAC845AEEBFF5EF49310F108419E519A7250C779A940CBA0

Function 06F18FE8 Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(0000000A), ref: 06F19052

Memory Dump Source

Source File: 00000000.00000002.2007635483.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: e9877a83b450786d771ba312f508ebde485e61405c7dd343b8e24f81623da26d
Instruction ID: c0ee08d7115c39a79e283d28cc564ebd36e3ae0c678f772116f082f5dad7a8f6
Opcode Fuzzy Hash: e9877a83b450786d771ba312f508ebde485e61405c7dd343b8e24f81623da26d
Instruction Fuzzy Hash: 851158B1D002498FDB20DFAAC8457EEFFF5EF88324F24841AD519A7240C779A544CBA0

Function 06F1DEC4 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,06F1EBD1,?,?), ref: 06F1ED78

Memory Dump Source

Source File: 00000000.00000002.2007635483.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: fa93d1d02a5dbe37a872c595bcc949ddb8cbd01084ba7ecf25f5fbacd8af4185
Instruction ID: 78ee9ad4eb1330c81e042d9dd7ac12f76d4b1ee1783482be100a79ddd77f658d
Opcode Fuzzy Hash: fa93d1d02a5dbe37a872c595bcc949ddb8cbd01084ba7ecf25f5fbacd8af4185
Instruction Fuzzy Hash: 171125B18007498FDB50DF9AC545BEEBBF5EB48320F108419E958A7340D338A944CFA5

Function 06F1DE24 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,06F1EBD1,?,?), ref: 06F1ED78

Memory Dump Source

Source File: 00000000.00000002.2007635483.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 0ec2b661225e60d9829493504086d261182b4bff803150e4f50fa602d28c0ce7
Instruction ID: f5bcf121e09860075fe29fd2c1d20eecf0db595a72d3dec594ca8e2e7ef8d444
Opcode Fuzzy Hash: 0ec2b661225e60d9829493504086d261182b4bff803150e4f50fa602d28c0ce7
Instruction Fuzzy Hash: EE1136B18007498FDB50DF9AC545BEEBBF5EB48320F108419E958A7340D338A944CFA5

Function 06F18FF0 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(0000000A), ref: 06F19052

Memory Dump Source

Source File: 00000000.00000002.2007635483.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 79cdcb5f40097b5b28a78d047d242693172964627031c2d1fdaa486c4b6eab18
Instruction ID: ce4a9dc756fe6bc0b5b99fa062efa62c1376ab768062f88f58290249e41dfa49
Opcode Fuzzy Hash: 79cdcb5f40097b5b28a78d047d242693172964627031c2d1fdaa486c4b6eab18
Instruction Fuzzy Hash: 6B1128B1D002488FDB20DFAAC4457EEFBF5EF88314F208419D519A7240CB79A944CBA1

Function 00EDB358 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00EDB3BE

Memory Dump Source

Source File: 00000000.00000002.1997528978.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 82ade1e24567011b8be2cd4cc8ebcf29d1dd7fbd8c9653803691071c07b2f0d5
Instruction ID: 748ccd573412b9de9c90268d8886854bea65f4fae391043fb77600ea23c56619
Opcode Fuzzy Hash: 82ade1e24567011b8be2cd4cc8ebcf29d1dd7fbd8c9653803691071c07b2f0d5
Instruction Fuzzy Hash: 6911DFB5C002498FCB10DF9AD844A9EFBF4EF88314F11842AD519B7610D3B9A545CFA1

Function 06F1C0E2 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06F1C145

Memory Dump Source

Source File: 00000000.00000002.2007635483.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: b9e6e0fb27ad88ff309dcef3b085c32042cbd1e893e1fd0ea2f29c9bfc821ce9
Instruction ID: 31e5986b8af4c5f41a1430cc2d70e6b35d5c710bd15637283f3d6316454ef0a8
Opcode Fuzzy Hash: b9e6e0fb27ad88ff309dcef3b085c32042cbd1e893e1fd0ea2f29c9bfc821ce9
Instruction Fuzzy Hash: ED11F2B58002489FDB10DF9AC885BEEBFF8FB49310F208459E598A7600C379A944CFA1

Function 06F1BA58 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06F1C145

Memory Dump Source

Source File: 00000000.00000002.2007635483.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: d3dea91c7497b7a7a906e184cd12dbf5d21b90bd047f3956484e97131fb73721
Instruction ID: 80093b2d6668f2135536a5441887f01b3991682e60093c744015c16e1d4e79bc
Opcode Fuzzy Hash: d3dea91c7497b7a7a906e184cd12dbf5d21b90bd047f3956484e97131fb73721
Instruction Fuzzy Hash: A411F2B58003489FDB10DF9AD845BEEBBF8FB48320F10841AE518B7600C379A944CFA1

Function 00E7D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1997290375.0000000000E7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e7d000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cf4ba641c518641e2c84b5e8b64110e1715e9de90d1b81045c14f5193b63b47
Instruction ID: 640dfdd412f9700a6a4ad60c637c49fc4c26a94e9904bf845ec6b733d6aa46c3
Opcode Fuzzy Hash: 2cf4ba641c518641e2c84b5e8b64110e1715e9de90d1b81045c14f5193b63b47
Instruction Fuzzy Hash: E4212172108204EFCB05DF14D9C0B26BF75FF98324F20C169E90D5B25AD33AE816CAA2

Function 00E8D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1997321491.0000000000E8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e8d000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9aad57ab2016340a669a906623cd94dad45ebf5a029c40de19eca979dc1da07
Instruction ID: a85d798a6ed0619aec707dc64a5e0dc35c757e85973f07a210d9d5d84f5aa195
Opcode Fuzzy Hash: d9aad57ab2016340a669a906623cd94dad45ebf5a029c40de19eca979dc1da07
Instruction Fuzzy Hash: 3121D071608204DFDB15EF24D984B26BB66EB88318F20C569D94E5B296C33AD806DB62

Function 00E8D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1997321491.0000000000E8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e8d000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c16e31197b0599c391c6b28ebefab8bbf5f466977578447e781afcf1061e7568
Instruction ID: 26d1e66937d6684fddfafb7fd9a82eca5d7a2f7e8ddd371f0aade51eca074b30
Opcode Fuzzy Hash: c16e31197b0599c391c6b28ebefab8bbf5f466977578447e781afcf1061e7568
Instruction Fuzzy Hash: 7B21F571548204DFDB05EF54D9C0F26BB65FB84318F20C56DD90D5B2A6C33AD806CB61

Function 00E8D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1997321491.0000000000E8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e8d000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 457294071584a835ddb6447ba1cef9743cd4dd6dd08ec683dfc07d8ef9252b5a
Instruction ID: abc4d9040078970f6a6bce4158439893d6713890ff1697f1ff082f5aa551e020
Opcode Fuzzy Hash: 457294071584a835ddb6447ba1cef9743cd4dd6dd08ec683dfc07d8ef9252b5a
Instruction Fuzzy Hash: 2721537550D3808FDB12DF24D994715BF71EB46314F28C5DAD84D8B6A7C33A980ACB62

Function 00E7D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1997290375.0000000000E7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e7d000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 8d7098725bda6d4e7c8e9e4a2abce1118b0f0e1c84741bb31b803b90838c4d7f
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: 04112672404240DFCB12CF00D9C4B16BF71FF94324F24C6A9D9090B256C33AE85ACBA2

Function 00E8D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1997321491.0000000000E8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e8d000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 174c0ae9b0648e54542d598ef49498b1970eb2d102521514b3b90b0bca48efd3
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: D711BB75548280DFCB02DF54C9C4B15BBA1FB84318F24C6A9D84D5B2A6C33AD81ACB62

Function 00E7D759 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1997290375.0000000000E7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e7d000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7be7cba6624c816ed0fe8ddbbcc736b201e2332605fef46ceb5e4eaa4f8f36e8
Instruction ID: 03149686379c8cfdf89a8ee5fe9e75516729fc39b58053897a778b0d06d2c028
Opcode Fuzzy Hash: 7be7cba6624c816ed0fe8ddbbcc736b201e2332605fef46ceb5e4eaa4f8f36e8
Instruction Fuzzy Hash: 9501A7710093449AD7249A59CD84B66BFACEF55324F18C82BED0D6A286C2799840C6B1

Function 00E7D758 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1997290375.0000000000E7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e7d000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f616676f9ccab493ebaf6b2de47b8eadc62c03e7c3fbff2a40cb6a04d5961bd8
Instruction ID: 645f4d40085007ad7622002a6820b0176108f2cf4acc1cba9dff27e5f050c9dd
Opcode Fuzzy Hash: f616676f9ccab493ebaf6b2de47b8eadc62c03e7c3fbff2a40cb6a04d5961bd8
Instruction Fuzzy Hash: 0FF062714093449EE7248A1ADD84B62FFA8EF55724F18C45AED4C5E286C2799C44CBB1

Non-executed Functions

Function 06F1E070 Relevance: 2.8, Strings: 2, Instructions: 298COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06F1E25B
PH]q, xrefs: 06F1E333

Memory Dump Source

Source File: 00000000.00000002.2007635483.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID:
String ID: PH]q$PH]q
API String ID: 0-1166926398
Opcode ID: 792fa9f76181a4406e7e7afb744368a06935bdbed06962ae9184c8d2e2c2d69a
Instruction ID: dba60921c084d4360b6dc0b079c04b138e06229bba3862ab1a87d35756aac328
Opcode Fuzzy Hash: 792fa9f76181a4406e7e7afb744368a06935bdbed06962ae9184c8d2e2c2d69a
Instruction Fuzzy Hash: CCD1B234A00609CFDB48DF69C598AA9B7F1BF8D741F2580A9E805AB371DB31AD45CF60

Function 06F187C8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007635483.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ab661fdf3e07a66f587bbcfae2045bd8c6c755622fc00c5b695cec5faaea8e7
Instruction ID: 3daa976b92c226e73d39251841d9b3d7c38f613ed0984a96bb6e58f87e17d0d5
Opcode Fuzzy Hash: 6ab661fdf3e07a66f587bbcfae2045bd8c6c755622fc00c5b695cec5faaea8e7
Instruction Fuzzy Hash: 2AE11874E102198FCB14DFA9C5809AEFBF2FF89345F248169E415AB35AD730A941CFA1

Function 06F19178 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007635483.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bb0e0e7d68cffee9d17260ef86c81ff2abdc6e8f9b32216253216bcddda7a8b
Instruction ID: cfa353320c7f83122d01c3cac1b4284fe5cab83f65ad2c1f7de0dd179848b2d2
Opcode Fuzzy Hash: 2bb0e0e7d68cffee9d17260ef86c81ff2abdc6e8f9b32216253216bcddda7a8b
Instruction Fuzzy Hash: 84E13874E001198FCB14DFA9C5909AEFBF2FF89345F248169E418AB356D731A942CFA1

Function 06F17120 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007635483.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e798548e0d74acfa5133b1dd1ba2b0b2ad7fb91a30c8d6b4c0a6f4bacdc2312
Instruction ID: 666b41efc9e0e7a44f947edaca44eb3bc1fe85b6aed9c0b323b116f6778a397d
Opcode Fuzzy Hash: 5e798548e0d74acfa5133b1dd1ba2b0b2ad7fb91a30c8d6b4c0a6f4bacdc2312
Instruction Fuzzy Hash: C6E11B74E101198FCB14DFA9C5809AEFBF2FF89345F248169E419AB356D730A942CFA1

Function 06F16CE8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007635483.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c034ee87d57bc8e7179fc009fcdb32cc0df1bed9e0bf960646e7fe9269ec2b0
Instruction ID: 62a2ad46a123793c425cf6893519533bced28cb870b18009e063145a97e1c840
Opcode Fuzzy Hash: 3c034ee87d57bc8e7179fc009fcdb32cc0df1bed9e0bf960646e7fe9269ec2b0
Instruction Fuzzy Hash: 41E12974E002198FCB14DFA8C5809AEFBF2FF89345F248169E419AB356D731A941CFA1

Function 06F168B0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007635483.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e9b81975220c0db0e8aeaff03c2e67970ef1a34b7664814cdd0e2a0efa0077e
Instruction ID: a2de5f9a5f0fd4dc09f2dbd0ee1886beb554cae91d87bff4326e33554188e919
Opcode Fuzzy Hash: 0e9b81975220c0db0e8aeaff03c2e67970ef1a34b7664814cdd0e2a0efa0077e
Instruction Fuzzy Hash: F5E10874E102198FCB14DFA9C5809AEFBB2FF89345F24C169E415AB356D730A941CFA1

Function 00EDF2E4 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1997528978.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 509f73c3c80b5682da886d6e7f4ae33bd14e5231e1ef42385e4d4b85f9181294
Instruction ID: 0c2979c37cd928c4a8d7eb36255217ff1677dd9a0535fbe2dbc60d50d39cd2a5
Opcode Fuzzy Hash: 509f73c3c80b5682da886d6e7f4ae33bd14e5231e1ef42385e4d4b85f9181294
Instruction Fuzzy Hash: 9AA15832E002098FCF05DFA5D89059EB7B2FF85304B25957AE806BB365DB31E956CB90

Function 06F17110 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007635483.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f500424b3f9974a75a62d82aefb7e724721e96a0dbfbe4861258bd2f4cc81a94
Instruction ID: 7ca3e3b1fc2fabadafff2772513e9ab71c0c91ae238d21a6c68b0c9c35f6d9d5
Opcode Fuzzy Hash: f500424b3f9974a75a62d82aefb7e724721e96a0dbfbe4861258bd2f4cc81a94
Instruction Fuzzy Hash: 2A512E74E102598FDB14DFA9C5809AEFBF2BF89301F24C169D458AB356D7309A42CFA1

Analysis Process: Acal BFi UK - Products List 020240704PDF.exePID: 4028, Parent PID: 6456COMMON

Execution Graph

Execution Coverage:	11.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	75
Total number of Limit Nodes:	10

Executed Functions

Function 09246020 Relevance: 5.5, Strings: 4, Instructions: 496
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 09246345
$]q, xrefs: 09246409
$]q, xrefs: 09246886
$]q, xrefs: 092467B9

Memory Dump Source

Source File: 00000003.00000002.2183009927.0000000009240000.00000040.00000800.00020000.00000000.sdmp, Offset: 09240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9240000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: bb2f49fde2c77ce571fc1ad1617275892a281d5d98b5ac3b2ed3d983ce2f20f7
Instruction ID: 5562aa0f72a3de210261e5fcd65f918db26841158568f63123adbaa02dd01a4c
Opcode Fuzzy Hash: bb2f49fde2c77ce571fc1ad1617275892a281d5d98b5ac3b2ed3d983ce2f20f7
Instruction Fuzzy Hash: FB32C370E00229CFDB69DF65C950BDEB7B2BB89300F5085E9D109AB250DB359E85CF81

Function 09242418 Relevance: 5.3, Strings: 4, Instructions: 271
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 092425C9
$]q, xrefs: 09242663
$]q, xrefs: 092425B3
$]q, xrefs: 09242679

Memory Dump Source

Source File: 00000003.00000002.2183009927.0000000009240000.00000040.00000800.00020000.00000000.sdmp, Offset: 09240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9240000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 846781a95e12abe37ee9a87204f3a18cf055caf8795b98fb3ed02667e01a4542
Instruction ID: af50fae9e8eb2e31b4401c49d9d122a2b6a38c65f090724a853ef412ceb2b0f1
Opcode Fuzzy Hash: 846781a95e12abe37ee9a87204f3a18cf055caf8795b98fb3ed02667e01a4542
Instruction Fuzzy Hash: 6EC10670E00219CFDB68DFAAC99079EBBB2FF89300F5084A9D419AB254DB345E85CF51

Function 07320040 Relevance: 2.9, Strings: 2, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

1, xrefs: 07320345
., xrefs: 073202C0

Memory Dump Source

Source File: 00000003.00000002.2178050908.0000000007320000.00000040.00000800.00020000.00000000.sdmp, Offset: 07320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7320000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID:
String ID: .$1
API String ID: 0-1839485796
Opcode ID: 0a2c6ed90962475a99d0c25f78908adddfd0a5e55fab88da7586330fdc9d30f2
Instruction ID: 26c82db1215ec4b120e2417cecd96a13d7fdcd14ca45ee257fb83e4e9919939a
Opcode Fuzzy Hash: 0a2c6ed90962475a99d0c25f78908adddfd0a5e55fab88da7586330fdc9d30f2
Instruction Fuzzy Hash: FCF1CDB4E01229CFDB69DF65D884B9DBBB2BF89305F1081A9D50AA7250DB315E86CF10

Function 09242A50 Relevance: 2.7, Strings: 2, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LR]q, xrefs: 09242AFA
PH]q, xrefs: 09242D32

Memory Dump Source

Source File: 00000003.00000002.2183009927.0000000009240000.00000040.00000800.00020000.00000000.sdmp, Offset: 09240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9240000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID:
String ID: LR]q$PH]q
API String ID: 0-3791814328
Opcode ID: 29641fbf18e0a88177971b86f5f7453a493d71d5cce9d4776948dc205f4bfa80
Instruction ID: 811a0f74910a427cc3be223e82df03badee53b34284b55e0f63c203fd5c87441
Opcode Fuzzy Hash: 29641fbf18e0a88177971b86f5f7453a493d71d5cce9d4776948dc205f4bfa80
Instruction Fuzzy Hash: 98A10674E10219CFDB28DFA5C854B9EBBB2FF89300F1084A9E409AB264DB705A85CF51

Function 018AD0A8 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 018AD136
GetCurrentThread.KERNEL32 ref: 018AD173
GetCurrentProcess.KERNEL32 ref: 018AD1B0
GetCurrentThreadId.KERNEL32 ref: 018AD209

Memory Dump Source

Source File: 00000003.00000002.2164780669.00000000018A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_18a0000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: fff829c31031546832af0acde3ab783a802106881c7d6d466edaf4b577cffc1f
Instruction ID: 7b823c02ba1b7ef6c0e87540254c41986c17df04322ff11840094440bb280b7d
Opcode Fuzzy Hash: fff829c31031546832af0acde3ab783a802106881c7d6d466edaf4b577cffc1f
Instruction Fuzzy Hash: 375188B09017498FDB14DFAAE948B9EBFF1EF48300F208059E519A7360D738A944CF65

Function 018AD0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 018AD136
GetCurrentThread.KERNEL32 ref: 018AD173
GetCurrentProcess.KERNEL32 ref: 018AD1B0
GetCurrentThreadId.KERNEL32 ref: 018AD209

Memory Dump Source

Source File: 00000003.00000002.2164780669.00000000018A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_18a0000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 441f4c52960c488de57aff5086dbebba77b49ea0f115981c3fdb5d9dbf32fe32
Instruction ID: c2c4babc1cf3252f172ae6edc10771756ac4796d54d3cdef7911f21d933f59e9
Opcode Fuzzy Hash: 441f4c52960c488de57aff5086dbebba77b49ea0f115981c3fdb5d9dbf32fe32
Instruction Fuzzy Hash: C75167B09017098FDB14DFAAE548B9EBFF1FF48300F208459E519A7360D738A944CB65

Function 018AAE30 Relevance: 1.7, APIs: 1, Instructions: 209COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 018AB086

Memory Dump Source

Source File: 00000003.00000002.2164780669.00000000018A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_18a0000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 9602f814c4df766531eb64bcf78a05601316cc88baee5be80a2c5d08525e3e5e
Instruction ID: 43c1173c7e146eeb71b3818e6f70e6fed2842319f32b53e34c17b811640487ee
Opcode Fuzzy Hash: 9602f814c4df766531eb64bcf78a05601316cc88baee5be80a2c5d08525e3e5e
Instruction Fuzzy Hash: 478179B0A00B458FE728DF6AD0407AABBF5FF48704F40892ED15AD7A50D735EA49CB91

Function 018A5935 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 018A59F1

Memory Dump Source

Source File: 00000003.00000002.2164780669.00000000018A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_18a0000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 67e56a6ed1503fa23ed11cd79c36fddcec57d0e5531b40d75b19bae5a42dfc86
Instruction ID: 39d3e669c2c589be6ac5ba9f7c84d8f48699553163675f923aa926ab6f3f21bd
Opcode Fuzzy Hash: 67e56a6ed1503fa23ed11cd79c36fddcec57d0e5531b40d75b19bae5a42dfc86
Instruction Fuzzy Hash: ED4112B0D00719CBEB24CFA9C884B9DBBB5FF45304F20806AD008AB254DB756985CF91

Function 018A4248 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 018A59F1

Memory Dump Source

Source File: 00000003.00000002.2164780669.00000000018A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_18a0000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: be18d985f7d0a6fe33891ac6fb7b80ce8f895fa53e25abdc035eff4a05f07ff9
Instruction ID: a8a85d029c1cf515b0b6bb10814082b393412703e281dd1f765fba0ea06f519e
Opcode Fuzzy Hash: be18d985f7d0a6fe33891ac6fb7b80ce8f895fa53e25abdc035eff4a05f07ff9
Instruction Fuzzy Hash: 6241F2B0D0071DCBEB24DFA9C884B9DBBB5FF49304F60806AD408AB254DB756985CF91

Function 018AD2F9 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 018AD387

Memory Dump Source

Source File: 00000003.00000002.2164780669.00000000018A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_18a0000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e4f7ca892b124fe89bb5a8bc4086066cf0172203d8f975347319086d4da4eac8
Instruction ID: 42b914c616171b7f82657462901c5c61b3897c5f09015f6a634eee63772e7d4f
Opcode Fuzzy Hash: e4f7ca892b124fe89bb5a8bc4086066cf0172203d8f975347319086d4da4eac8
Instruction Fuzzy Hash: D421B3B59002499FDB10CF9AD984ADEBFF9FB48310F14841AE918E3250D378AA54CFA5

Function 018AD300 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 018AD387

Memory Dump Source

Source File: 00000003.00000002.2164780669.00000000018A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_18a0000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 980ca4a6b40bbb55430ef1fc2f468d5a6f253026ec65ebe30adec286d7bfdb84
Instruction ID: cef01a68f2f5b0fd1eb0b38dac316c665ca8a6b24df9b29adbb048a38012441c
Opcode Fuzzy Hash: 980ca4a6b40bbb55430ef1fc2f468d5a6f253026ec65ebe30adec286d7bfdb84
Instruction Fuzzy Hash: D821C2B59002489FDB10CFAAD984ADEBFF9FB48310F14841AE918A3350D378A954CFA5

Function 018AA870 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,018AB101,00000800,00000000,00000000), ref: 018AB312

Memory Dump Source

Source File: 00000003.00000002.2164780669.00000000018A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_18a0000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 618f860a4e11d1d6838c45a08bd158fc0e1cde3f1e019ff315a14b74f914d26e
Instruction ID: 8d675adf09992f571f0f6bf953e27ff6bc835505906a781e97f13fced2c23817
Opcode Fuzzy Hash: 618f860a4e11d1d6838c45a08bd158fc0e1cde3f1e019ff315a14b74f914d26e
Instruction Fuzzy Hash: E711E4B69003499FDB10DF9AD444ADEFBF4EB58310F50842ED919A7210C379A545CFA5

Function 018AB2A0 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,018AB101,00000800,00000000,00000000), ref: 018AB312

Memory Dump Source

Source File: 00000003.00000002.2164780669.00000000018A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_18a0000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1ae9a2fef836185ca35fcee0a9bd6204b9d116265b8d5354b68d8f2001362fbf
Instruction ID: c3cfd648305a604b0e417da8eced0da415b62a1e81692ab47329417ed44cf77e
Opcode Fuzzy Hash: 1ae9a2fef836185ca35fcee0a9bd6204b9d116265b8d5354b68d8f2001362fbf
Instruction Fuzzy Hash: F911F6B6D002499FDB14DF9AD444AEEFFF4EB98310F14841ED929A7210C379A645CFA1

Function 07325468 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000,?,?,?,?,00000000,00000E20,?,?,0732593E), ref: 07325A46

Memory Dump Source

Source File: 00000003.00000002.2178050908.0000000007320000.00000040.00000800.00020000.00000000.sdmp, Offset: 07320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7320000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 2a343bc6ed2a4137013ed27010c2ad20f1c27c571f037ed5a8052de7b85c3bff
Instruction ID: 0763a5c100e1cf2691a71471e40dbfe51c1cb9bf5b17b6dc0cb50376c30ae79e
Opcode Fuzzy Hash: 2a343bc6ed2a4137013ed27010c2ad20f1c27c571f037ed5a8052de7b85c3bff
Instruction Fuzzy Hash: A91123B5D003598BDB20DF9AD445A9EFBF4EF88320F10845AD419B7210C379A546CFA1

Function 073259DE Relevance: 1.6, APIs: 1, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000,?,?,?,?,00000000,00000E20,?,?,0732593E), ref: 07325A46

Memory Dump Source

Source File: 00000003.00000002.2178050908.0000000007320000.00000040.00000800.00020000.00000000.sdmp, Offset: 07320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7320000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: bb471dd6ef1daee9b89f65fc99e57a2f9951a853cfd2a5272ab16754eac7ead9
Instruction ID: 51eb7bba48033d031b7b9d1316e570750c9e816eab19c00058a3409c129f8991
Opcode Fuzzy Hash: bb471dd6ef1daee9b89f65fc99e57a2f9951a853cfd2a5272ab16754eac7ead9
Instruction Fuzzy Hash: 2C1120B6C002498BDB20DFAAD444ADEFBF4AF88220F10846AD418A7210C378A545CFA1

Function 09248B3C Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 09248B9D

Memory Dump Source

Source File: 00000003.00000002.2183009927.0000000009240000.00000040.00000800.00020000.00000000.sdmp, Offset: 09240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9240000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 8e0351160a966733889931a74db1b6ab9b81b6c8c31fafaeb44fecb5251ce04a
Instruction ID: 33584aabed990d8dbd13aa276a12e8205ef08d1c56c25a78335efe090bc0d27d
Opcode Fuzzy Hash: 8e0351160a966733889931a74db1b6ab9b81b6c8c31fafaeb44fecb5251ce04a
Instruction Fuzzy Hash: 421103B58003499FCB10DF9AD945BEEFBF8FB49320F20845AE918A7600C379A544CFA1

Function 018AB020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 018AB086

Memory Dump Source

Source File: 00000003.00000002.2164780669.00000000018A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_18a0000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: c8897438e4409a711c28d131340f5a5f0b3b583c82f0d60aedd6fe6e29325fa1
Instruction ID: 5b165622baa4dc34869c07292e1279ba70f36e9f18d32212b8f3d0334bc6c457
Opcode Fuzzy Hash: c8897438e4409a711c28d131340f5a5f0b3b583c82f0d60aedd6fe6e29325fa1
Instruction Fuzzy Hash: BF11DFB5C007498FDB20DF9AD444ADEFBF4EB89310F10841AD529B7210C379A645CFA1

Function 09248B71 Relevance: 1.5, APIs: 1, Instructions: 30windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 09248B9D

Memory Dump Source

Source File: 00000003.00000002.2183009927.0000000009240000.00000040.00000800.00020000.00000000.sdmp, Offset: 09240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9240000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: b9d4e15a519254c6b12cd36e2fced110302c3c66332a1979e2705c1903526ec4
Instruction ID: a6d876c097952cfc10e72c62d0b534b7a00b1e0af2838b78ca2c808023a96bb2
Opcode Fuzzy Hash: b9d4e15a519254c6b12cd36e2fced110302c3c66332a1979e2705c1903526ec4
Instruction Fuzzy Hash: 2CF0E2B68103099FDB10DF89D888BDEBBF4FB58324F10845AE958A7250C379A584CFA1

Function 0147D654 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2163983251.000000000147D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0147D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_147d000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 067ac002bccafe0d563a6a6017dec5a9bd17b70d50c555aab331f414989ae15d
Instruction ID: 067d4d714bf67aeae4ed08a24540877b183aa13925db7c631de38d5ae8239eaa
Opcode Fuzzy Hash: 067ac002bccafe0d563a6a6017dec5a9bd17b70d50c555aab331f414989ae15d
Instruction Fuzzy Hash: 3221F775910240DFCB059F94D9C0F57BFA5FF88314F24C66AE94D0A266C33AD416CBA1

Function 0147D1FC Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2163983251.000000000147D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0147D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_147d000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c804b841ac1cb049b0c31a41abb2c599528473bf6d1579cf1745a86e58e96bf
Instruction ID: 61e0eb2d7abb581c1cc72da30de79a76612ccc162e7a8e8413b74616884940cb
Opcode Fuzzy Hash: 3c804b841ac1cb049b0c31a41abb2c599528473bf6d1579cf1745a86e58e96bf
Instruction Fuzzy Hash: 4421C171914244DFDB06DF98D9C4B67BF65FF88320F24C56AE9090A266C33AD417CBA1

Function 0147D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2163983251.000000000147D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0147D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_147d000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9af84c24d2dbd9cd87ddfb45091d0d11bb7674ef351b21bb19b43ed08dbe314d
Instruction ID: 8f6b4a6474f0d94dc25b4ed0de61be79e8bc8ab2c887f395b03a81a1d9765ec6
Opcode Fuzzy Hash: 9af84c24d2dbd9cd87ddfb45091d0d11bb7674ef351b21bb19b43ed08dbe314d
Instruction Fuzzy Hash: 4921F171910240DFDB15DF58D980B67BF65FF88318F24C56AE9090A266C33AD416CAA2

Function 0148D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2164028110.000000000148D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0148D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_148d000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4449fcaf07e345c38553f0ba671a13c262a2b1621f7f06a829829b03a60ff5ff
Instruction ID: 2c94dcf42349a0a8619776e62a5c9145e241b978a03426e459f94a3e3d9f7ac4
Opcode Fuzzy Hash: 4449fcaf07e345c38553f0ba671a13c262a2b1621f7f06a829829b03a60ff5ff
Instruction Fuzzy Hash: 472125B1904204DFDB15EFA8D980B1ABF65FB85318F20C56ED90A4B3A6C33AD407CA61

Function 0148D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2164028110.000000000148D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0148D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_148d000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfd6a1ceda702198ae065580f12ee77eb564d9057799227d34af6261a16e0d64
Instruction ID: 010913378c21f9d4b83ae32df67311583dfee96e9087cd01eea8ebee5eeaa52c
Opcode Fuzzy Hash: dfd6a1ceda702198ae065580f12ee77eb564d9057799227d34af6261a16e0d64
Instruction Fuzzy Hash: 062180755093808FDB03DF64D594716BF71EB46214F28C5DBD8498B2A7C33A980BCB62

Function 0147D64F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2163983251.000000000147D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0147D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_147d000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4df52cb15700b59c5b6b401fa95ea1d4e97f6e18881beb99e30f99f1fcf6035
Instruction ID: 4e19565e319150bcaa5723d01d50131066943a04d34414af39d43aacae797e7d
Opcode Fuzzy Hash: b4df52cb15700b59c5b6b401fa95ea1d4e97f6e18881beb99e30f99f1fcf6035
Instruction Fuzzy Hash: C921C076804280DFCB06CF44D9C4B56BF72FF88314F24C6AAD9480A267C33AD416CB91

Function 0147D1F7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2163983251.000000000147D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0147D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_147d000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d06fae078f3ccc2112caf8552f6b645ede566e603d6c7b0d9faf10800b04cc1c
Instruction ID: 68a1d7cb72cc17a1382db3ac08266cf8b0b8d5818df95eec6ae570bca6094e11
Opcode Fuzzy Hash: d06fae078f3ccc2112caf8552f6b645ede566e603d6c7b0d9faf10800b04cc1c
Instruction Fuzzy Hash: EA21C076904240CFDB06CF44D9C4B56BF62FF84320F24C5AADD050A266C336D416CBA1

Function 0147D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2163983251.000000000147D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0147D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_147d000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: eb31a51f6ce2353f94e9cf3d9b0dc3b4dad9f44c5d38eec892fa26cf56e3290c
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: 9D11DF72804280CFCB12CF54D9C4B56BF71FB88324F24C6AAD9490B266C336D45ACBA2

Function 0147DA59 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2163983251.000000000147D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0147D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_147d000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b462ce51f35bea1e83295e87661a002bfb667db3e48206c0949da49808a48cba
Instruction ID: 5a119af5d91e31fc6ce06ebd4b521331a580b516adb6185b3047786c51f67aa4
Opcode Fuzzy Hash: b462ce51f35bea1e83295e87661a002bfb667db3e48206c0949da49808a48cba
Instruction Fuzzy Hash: 07012B714083009AE720ABA9CC84BA7BF9CFF55330F18C56BED080A3A6C2799841CA71

Function 0147DA58 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2163983251.000000000147D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0147D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_147d000_Acal BFi UK - Products List 020240704PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cb00ce9da723cec622f21165d4b9f6892507c743b8751e26d53e320c197add5
Instruction ID: 4057ab77fc19cd0c4a10f2fe2ae5d27c26f02d945aadd328d4810c8d7166f5b4
Opcode Fuzzy Hash: 1cb00ce9da723cec622f21165d4b9f6892507c743b8751e26d53e320c197add5
Instruction Fuzzy Hash: C2F0C2714083449AE7209A0ACC84BA3FFA8EF55234F18C45AED480A396C2799844CAB0

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Acal BFi UK - Products List 020240704PDF.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Acal BFi UK - Products List 020240704PDF.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

Windows Analysis Report
Acal BFi UK - Products List 020240704PDF.exe

Function 00EDD7F0 Relevance: 6.1, APIs: 4, Instructions: 129
threadCOMMON

Function 00EDD800 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 00EDB158 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 197
COMMON

Function 06F198EC Relevance: 1.7, APIs: 1, Instructions: 249
processCOMMON

Function 06F198F8 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 00ED4AD0 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON