Edit tour

Windows Analysis Report
ds1bfe33xg.exe

Overview

General Information

Sample name:	ds1bfe33xg.exe renamed because original name is a hash value
Original sample name:	2b1d9b594350ca3b9f2d75b71ea514bfa8e14d8f.exe
Analysis ID:	1582810
MD5:	2d1e50ce1769f7752c37724fd59e7f6b
SHA1:	2b1d9b594350ca3b9f2d75b71ea514bfa8e14d8f
SHA256:	ffe1c8029056380be4f7cc025d6f4a3c7698d352363330ea5a822de589fcb4cf
Tags:	exeuser-NDA0E
Infos:

Detection

RedLine

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected RedLine Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Installs new ROOT certificates

Machine Learning detection for sample

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops certificate files (DER)

Internet Provider seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

ds1bfe33xg.exe (PID: 7312 cmdline: "C:\Users\user\Desktop\ds1bfe33xg.exe" MD5: 2D1E50CE1769F7752C37724FD59E7F6B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["185.38.142.167:6302"], "Authorization Header": "19b166de386548abffc45a63fbb79ca0"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
ds1bfe33xg.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
ds1bfe33xg.exe	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x24ccb:$gen01: ChromeGetRoamingName 0x24cf0:$gen02: ChromeGetLocalName 0x24d33:$gen03: get_UserDomainName 0x28bca:$gen04: get_encrypted_key 0x27949:$gen05: browserPaths 0x27c1f:$gen06: GetBrowsers 0x27511:$gen07: get_InstalledInputLanguages 0x239d4:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x3018:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x2900e:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x290ac:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x29712:$spe9: wallet 0x219f2:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x21f1c:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x21fc9:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x219a0:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x219c9:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x21b9a:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x21ded:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x220dc:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1374001431.0000000000292000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: ds1bfe33xg.exe PID: 7312	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.ds1bfe33xg.exe.290000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.0.ds1bfe33xg.exe.290000.0.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x24ccb:$gen01: ChromeGetRoamingName 0x24cf0:$gen02: ChromeGetLocalName 0x24d33:$gen03: get_UserDomainName 0x28bca:$gen04: get_encrypted_key 0x27949:$gen05: browserPaths 0x27c1f:$gen06: GetBrowsers 0x27511:$gen07: get_InstalledInputLanguages 0x239d4:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x3018:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x2900e:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x290ac:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x29712:$spe9: wallet 0x219f2:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x21f1c:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x21fc9:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x219a0:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x219c9:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x21b9a:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x21ded:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x220dc:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: ds1bfe33xg.exe

Malware Configuration Extractor: RedLine {"C2 url": ["185.38.142.167:6302"], "Authorization Header": "19b166de386548abffc45a63fbb79ca0"}

Multi AV Scanner detection for submitted file

Source: ds1bfe33xg.exe	ReversingLabs: Detection: 70%
Source: ds1bfe33xg.exe	Virustotal: Detection: 70%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: ds1bfe33xg.exe

Joe Sandbox ML: detected

Source: ds1bfe33xg.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: ds1bfe33xg.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Windows\System.ServiceModel.pdbpdbdel.pdb source: ds1bfe33xg.exe, 00000000.00000002.2633601930.0000000006183000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.ServiceModel.pdb source: ds1bfe33xg.exe, 00000000.00000002.2633601930.0000000006183000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ServiceModel.pdb693405117-2476756634-1003_Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Servererver32** source: ds1bfe33xg.exe, 00000000.00000002.2631737873.00000000009CB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.ServiceModel.pdb source: ds1bfe33xg.exe, 00000000.00000002.2631737873.00000000009E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb< source: ds1bfe33xg.exe, 00000000.00000002.2631737873.0000000000944000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ServiceModel.pdb source: ds1bfe33xg.exe, 00000000.00000002.2633601930.0000000006175000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb source: ds1bfe33xg.exe, 00000000.00000002.2631737873.0000000000944000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.ServiceModel.pdb source: ds1bfe33xg.exe, 00000000.00000002.2631737873.00000000009E8000.00000004.00000020.00020000.00000000.sdmp

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 185.38.142.167:6302

Source: global traffic

TCP traffic: 192.168.2.11:49757 -> 185.38.142.167:6302

Source: Joe Sandbox View

ASN Name: NETSOLUTIONSNL NETSOLUTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.167
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.167
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.167
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.167
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.167
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.167
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.167
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.167
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.167
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.167
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.167
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.167
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.167
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.167
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.167
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.167
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.167
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.167
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.167
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.167
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.167
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.167
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.167

Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/H)
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10LR_q
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10LR_q(
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10LR_qLf
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10LR_qPy
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10LR_qp
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Responsex
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11LR_q
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Responsex
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12LR_q
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12LR_qD
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12LR_qT
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12LR_qd
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12LR_qh
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Responsex
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13LR_q
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Responsex
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14LR_q
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14LR_qH
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14LR_qX
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14LR_ql
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Responsex
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15LR_q
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15LR_qd3p
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Responsex
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16LR_q
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16LR_qL
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16LR_qP
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16LR_qd
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Responsex
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17LR_q
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Responsex
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18LR_q
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Responsex
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19LR_q
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19LR_q8bp
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19LR_qX
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19LR_ql
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19LR_qp
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Responsex
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1LR_q
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1LR_qX
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1LR_ql2
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Responsex
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20LR_q
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Responsex
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21LR_q
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21LR_qP
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21LR_qPyp
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21LR_qp
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21LR_qt
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Responsex
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22LR_q
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Responsex
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23LR_q
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Responsex
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24LR_q
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Responsex
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2LR_q
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2LR_q0;
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Responsex
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3LR_q
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3LR_qWz
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3LR_qp
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Responsex
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4LR_q
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4LR_q0N
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Responsex
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5LR_q
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5LR_q82
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5LR_qHE
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5LR_qLX
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Responsex
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6LR_q
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6LR_qP
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6LR_qpb
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6LR_qtuz
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Responsex
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7LR_q
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7LR_qd
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Responsex
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8LR_q
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8LR_q$Q
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8LR_q4d
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8LR_q8w
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8LR_qH
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Responsex
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9LR_q
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9LR_qH
Source: ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Responsex
Source: ds1bfe33xg.exe	String found in binary or memory: https://api.ip.sb/ip

Source: C:\Users\user\Desktop\ds1bfe33xg.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp9AD2.tmp			Jump to dropped file
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp9AC1.tmp			Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: ds1bfe33xg.exe, type: SAMPLE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.0.ds1bfe33xg.exe.290000.0.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io

Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Code function: 0_2_024ADC74	0_2_024ADC74
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Code function: 0_2_05D967D8	0_2_05D967D8
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Code function: 0_2_05D9A3D8	0_2_05D9A3D8
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Code function: 0_2_05D93F50	0_2_05D93F50
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Code function: 0_2_05D96FF8	0_2_05D96FF8
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Code function: 0_2_05D96FE8	0_2_05D96FE8

Source: ds1bfe33xg.exe, 00000000.00000002.2631737873.000000000090E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs ds1bfe33xg.exe
Source: ds1bfe33xg.exe, 00000000.00000000.1374031883.00000000002D6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSkimping.exe8 vs ds1bfe33xg.exe
Source: ds1bfe33xg.exe	Binary or memory string: OriginalFilenameSkimping.exe8 vs ds1bfe33xg.exe

Source: ds1bfe33xg.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: ds1bfe33xg.exe, type: SAMPLE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.0.ds1bfe33xg.exe.290000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e

Source: classification engine

Classification label: mal88.troj.winEXE@1/4@0/1

Source: C:\Users\user\Desktop\ds1bfe33xg.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Jump to behavior

Source: C:\Users\user\Desktop\ds1bfe33xg.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\ds1bfe33xg.exe

File created: C:\Users\user\AppData\Local\Temp\Tmp9AC1.tmp

Jump to behavior

Source: ds1bfe33xg.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: ds1bfe33xg.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\ds1bfe33xg.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\ds1bfe33xg.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ds1bfe33xg.exe	ReversingLabs: Detection: 70%
Source: ds1bfe33xg.exe	Virustotal: Detection: 70%

Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Section loaded: esdsip.dll	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Section loaded: mswsock.dll	Jump to behavior

Source: C:\Users\user\Desktop\ds1bfe33xg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32

Jump to behavior

Source: Google Chrome.lnk.0.dr

LNK file: ..\..\..\Program Files\Google\Chrome\Application\chrome.exe

Source: C:\Users\user\Desktop\ds1bfe33xg.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: ds1bfe33xg.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: ds1bfe33xg.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Windows\System.ServiceModel.pdbpdbdel.pdb source: ds1bfe33xg.exe, 00000000.00000002.2633601930.0000000006183000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.ServiceModel.pdb source: ds1bfe33xg.exe, 00000000.00000002.2633601930.0000000006183000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ServiceModel.pdb693405117-2476756634-1003_Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Servererver32** source: ds1bfe33xg.exe, 00000000.00000002.2631737873.00000000009CB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.ServiceModel.pdb source: ds1bfe33xg.exe, 00000000.00000002.2631737873.00000000009E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb< source: ds1bfe33xg.exe, 00000000.00000002.2631737873.0000000000944000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ServiceModel.pdb source: ds1bfe33xg.exe, 00000000.00000002.2633601930.0000000006175000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb source: ds1bfe33xg.exe, 00000000.00000002.2631737873.0000000000944000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.ServiceModel.pdb source: ds1bfe33xg.exe, 00000000.00000002.2631737873.00000000009E8000.00000004.00000020.00020000.00000000.sdmp

Source: ds1bfe33xg.exe

Static PE information: 0xC415AB00 [Sat Mar 31 20:39:28 2074 UTC]

Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Code function: 0_2_05D9D413 push es; ret	0_2_05D9D420
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Code function: 0_2_05D9C711 push es; ret	0_2_05D9C720
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Code function: 0_2_05D9ECF2 push eax; ret	0_2_05D9ED01

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Users\user\Desktop\ds1bfe33xg.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Jump to behavior

Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT			Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Memory allocated: 2400000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Memory allocated: 2660000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Memory allocated: 2400000 memory reserve \| memory write watch	Jump to behavior

Source: ds1bfe33xg.exe, 00000000.00000002.2633601930.0000000006183000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\ds1bfe33xg.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Queries volume information: C:\Users\user\Desktop\ds1bfe33xg.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ds1bfe33xg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\ds1bfe33xg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: ds1bfe33xg.exe, type: SAMPLE
Source: Yara match	File source: 0.0.ds1bfe33xg.exe.290000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1374001431.0000000000292000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ds1bfe33xg.exe PID: 7312, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: ds1bfe33xg.exe, type: SAMPLE
Source: Yara match	File source: 0.0.ds1bfe33xg.exe.290000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1374001431.0000000000292000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ds1bfe33xg.exe PID: 7312, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Masquerading	OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Disable or Modify Tools	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Install Root Certificate	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ds1bfe33xg.exe	70%	ReversingLabs	ByteCode-MSIL.Trojan.Jalapeno
ds1bfe33xg.exe	71%	Virustotal		Browse
ds1bfe33xg.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
185.38.142.167:6302	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
185.38.142.167:6302	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://tempuri.org/Entity/Id5LR_qLX	ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id18LR_q	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id14LR_qH	ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id10LR_qLf	ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id15Responsex	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id3LR_qp	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id2LR_q	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id14LR_ql	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id10Responsex	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id11LR_q	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id24LR_q	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/H)	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id6Responsex	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id7Responsex	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id10LR_q(	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id14LR_qX	ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id1Responsex	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id9LR_q	ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id3LR_qWz	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.ip.sb/ip	ds1bfe33xg.exe	false	high
http://tempuri.org/Entity/Id23Responsex	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id5Responsex	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id14Responsex	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id8LR_q8w	ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id20Responsex	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id7LR_q	ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id1LR_ql2	ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id14LR_q	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id16LR_qP	ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id22LR_q	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id16LR_qL	ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id8Responsex	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id19LR_qX	ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id16LR_q	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id6LR_qtuz	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id6LR_qP	ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/	ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/08/addressing	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id3Responsex	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id5LR_q	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id16LR_qd	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id9LR_qH	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id19LR_qp	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id12Responsex	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id17Responsex	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id19LR_q8bp	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id19LR_ql	ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id20LR_q	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id3LR_q	ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id19LR_q	ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id10LR_qp	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id18Responsex	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/soap/envelope/	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id8LR_qH	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id17LR_q	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id2LR_q0;	ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id10LR_q	ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id21LR_qPyp	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id10LR_qPy	ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id22Responsex	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id19Responsex	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id1LR_q	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id12LR_q	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id21Responsex	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id8LR_q	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id21LR_qp	ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id12LR_qd	ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id13LR_q	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id6LR_qpb	ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id12LR_qh	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id4LR_q0N	ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id21LR_q	ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id2Responsex	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id11Responsex	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id21LR_qt	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id23LR_q	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id12LR_qT	ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id6LR_q	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id8LR_q4d	ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id8LR_q$Q	ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id13Responsex	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id16Responsex	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id7LR_qd	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id21LR_qP	ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id12LR_qD	ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id9Responsex	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id24Responsex	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002794000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp, ds1bfe33xg.exe, 00000000.00000002.2632121158.00000000027EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id1LR_qX	ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm	ds1bfe33xg.exe, 00000000.00000002.2632121158.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id5LR_qHE	ds1bfe33xg.exe, 00000000.00000002.2632121158.000000000283B000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.38.142.167	unknown	Portugal		47674	NETSOLUTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582810
Start date and time:	2024-12-31 15:01:19 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ds1bfe33xg.exe renamed because original name is a hash value
Original Sample Name:	2b1d9b594350ca3b9f2d75b71ea514bfa8e14d8f.exe
Detection:	MAL
Classification:	mal88.troj.winEXE@1/4@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 67 Number of non-executed functions: 14
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 4.245.163.56
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	u233hvgTow.exe	Get hash	malicious	RedLine	Browse	13.107.246.45
	zhMQ0hNEmb.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	2RxMkSAgZ8.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	bzzF5OFbVi.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	6684V5n83w.exe	Get hash	malicious	Vidar	Browse	13.107.246.45
	Bp4LoSXw83.lnk	Get hash	malicious	Unknown	Browse	13.107.246.45
	COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	UmotQ1qjLq.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	Open Purchase Order Summary Details-16-12-2024.vbs	Get hash	malicious	LodaRAT, XRed	Browse	13.107.246.45
	Open Purchase Order Summary Sheet.vbs	Get hash	malicious	LodaRAT, XRed	Browse	13.107.246.45

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NETSOLUTIONSNL	PRESUPUEST.exe	Get hash	malicious	AsyncRAT	Browse	185.38.142.240
	Aviso de transferencia.exe	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	185.38.142.240
	rUAE_LPO.com.exe	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	185.38.142.240
	A9BripDhRY.lnk	Get hash	malicious	Unknown	Browse	185.38.142.128
	93.123.85.253-bot.armv4l-2024-08-28T17_49_11.elf	Get hash	malicious	Unknown	Browse	188.93.233.79
	a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36_dump.exe	Get hash	malicious	RedLine	Browse	185.38.142.10
	b3u71vBG0u.exe	Get hash	malicious	RedLine	Browse	185.38.142.10
	2MbHBiqXH2.rtf	Get hash	malicious	RedLine	Browse	185.38.142.10
	YPSvIjQCzd.exe	Get hash	malicious	RedLine	Browse	185.38.142.10
	Invoice LGMSCH0040924 Paid - EFT Remittance Advice and Receipt.docx.doc	Get hash	malicious	RedLine	Browse	185.38.142.10

Process:	C:\Users\user\Desktop\ds1bfe33xg.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Thu Oct 5 10:09:20 2023, atime=Mon Oct 2 20:46:56 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	3.46453241582864
Encrypted:	false
SSDEEP:	48:8S4zd4TUCrARYrnvPdAKRkdAGdAKRFdAKRN:8Sx7
MD5:	0E20070907CF17DE55B1130FF4AD275D
SHA1:	68B9507E88AF59122FCBC2F1D9331C14C488329F
SHA-256:	135907128E850BC8C1D418072F2E7FE95C69DD108C3F58C8A2AD7EE906DA3D6F
SHA-512:	C90C74AEE293C1587143E61D0EA0BE2CEDCBB9CEF6D2C5BAF4A50162CB542334DB315CBCC3AD52C8E6154C08C31A134514877F3559244A96AC3BDAA642707432
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ......,.....\|.c\|...>'..y... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....EWXX..PROGRA~1..t......O.IEW.Y....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VEWgV....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.V..Chrome..>......CW.VEW.V....M.....................g.u.C.h.r.o.m.e.....`.1.....EW.V..APPLIC~1..H......CW.VEW.V..........................g.u.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.BW. .chrome.exe..F......CW.VEW"Y.............................c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.!.-.-.p.r.o.x.y.-.s.e.r.v.e.r

C:\Users\user\AppData\Local\Temp\Tmp9AC1.tmp

Download File

Process:	C:\Users\user\Desktop\ds1bfe33xg.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\Tmp9AD2.tmp

Download File

Process:	C:\Users\user\Desktop\ds1bfe33xg.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Users\user\Desktop\ds1bfe33xg.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	7.621362605225644
Encrypted:	false
SSDEEP:	48:S7SjQDU0O07/uDVUEMp0TB9V0G7Y89fuTSFliZpnXHHgW5r:ASUDl0ydpKB9V0YfuTxzHp5r
MD5:	F51C24932A4462200B4DC6F0D37E39EF
SHA1:	7DB012AEDF19A28E5AFFC14C41F75472394E654A
SHA-256:	C8568ED709314BA74CE97C86AFBA0C3BC58B290E1409C8ED57A247BC2013FF6C
SHA-512:	9171A35AA102C046CF114DD6ABC84A291A8F0CAD0FB2EBAA5BDCAAB08723F40E7BC155417578B79B2B1B912DF30B8A338930B1BCE0C66E9DED82363687B10D12
Malicious:	false
Reputation:	low
Preview:	........'...............P...............{41744BE4-11C5-494C-A213-BA0CE944938E}.....................RSA1..................v..XU~l2_.......vj....b.... ..&...X.Y...=q...).....`.1.0..~......5DL. ..S>.......<..y...?YOA.... eb.QD..B..<.!..'J..+.'...4fu.z./....]@.y.b...o...).j'......0}B.j..R..-..2.....'=...@....s....;. .v=..;...\$...G....2S....al.ZQ.Q...w...aXzW.....................z..O......9GS.>j.G....{..J....,...C.r.y.p.t.o.A.P.I. .P.r.i.v.a.t.e. .K.e.y....f...... .....wo......w.n.~...K......P............... ....S..u.-.s..(9.....[...?h..P...P...>..MIZT.?.K..!O.... .t......Lf7E..P..`P.p..0..YP.F[...xT.2P...N.....re..1.....z.m.i.a..P"..((......J.0.D`aG`:.q.....xa.31.?~....F.u.7.p..z..rb.R'.....P.........N.jdN.v.%..\|E.V..1....i.*.[..(x..kr..F........p..{7...M.yn.5.p......x.W.]S.1f7..+Z)...C.atO.c?....z.E.S+...Do.C.../y..XT`L.q..O.....2J.DV7>d{0VPfn.`.8w@.E.h...N.N(...J{'.....z..+I.d....T0w...g.a(H]..8.nN,K...GVt....H..x...\|&...."...a._)..Nw...b..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.083733745539814
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	ds1bfe33xg.exe
File size:	307'712 bytes
MD5:	2d1e50ce1769f7752c37724fd59e7f6b
SHA1:	2b1d9b594350ca3b9f2d75b71ea514bfa8e14d8f
SHA256:	ffe1c8029056380be4f7cc025d6f4a3c7698d352363330ea5a822de589fcb4cf
SHA512:	021498b255141ff2f599ac8b1fc5ee0f3b6f6b4a9fa496d30ade47d0834687a1f555aadf4a2ad60ceeefa3e3a064697c92de7ce248f9220c16653cd7879ef6c0
SSDEEP:	3072:8cZqf7D340p/0+mA/kygggQEgASklCBhp6ucTV+tk5bx31IeqiOL2bBOe:8cZqf7DIMnhTAlCB76DTVKkjsL
TLSH:	01646B5833E88904DA7F4775D871D67093B1BC63A916E70B4FC4ACAB3D32740EA50AB6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ... ....@.. ....................... ............@................................

File Icon


Icon Hash:	4d8ea38d85a38e6d

Static PE Info

General

Entrypoint:	0x4302de
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xC415AB00 [Sat Mar 31 20:39:28 2074 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x30290	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x32000	0x1c9c6	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x50000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x2e2e4	0x2e400	f4656c4647803c6287a25ef0e6c9d319	False	0.4750316722972973	data	6.189975402009514	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x32000	0x1c9c6	0x1ca00	8b184733de298f35abb1e06afceafce0	False	0.2380680267467249	data	2.614881226006285	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x50000	0xc	0x200	9cf8688692d56eec2446fe27d31fe01a	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x32220	0x3d04	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9934058898847631
RT_ICON	0x35f24	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2835 x 2835 px/m	0.09013072282030049
RT_ICON	0x4674c	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2835 x 2835 px/m	0.13905290505432216
RT_ICON	0x4a974	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2835 x 2835 px/m	0.17033195020746889
RT_ICON	0x4cf1c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2835 x 2835 px/m	0.2045028142589118
RT_ICON	0x4dfc4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2835 x 2835 px/m	0.24645390070921985
RT_GROUP_ICON	0x4e42c	0x5a	data	0.7666666666666667
RT_VERSION	0x4e488	0x352	data	0.4411764705882353
RT_MANIFEST	0x4e7dc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 31, 2024 15:02:30.968211889 CET	49757	6302	192.168.2.11	185.38.142.167
Dec 31, 2024 15:02:30.973432064 CET	6302	49757	185.38.142.167	192.168.2.11
Dec 31, 2024 15:02:30.973498106 CET	49757	6302	192.168.2.11	185.38.142.167
Dec 31, 2024 15:02:30.984554052 CET	49757	6302	192.168.2.11	185.38.142.167
Dec 31, 2024 15:02:30.989787102 CET	6302	49757	185.38.142.167	192.168.2.11
Dec 31, 2024 15:02:52.358774900 CET	6302	49757	185.38.142.167	192.168.2.11
Dec 31, 2024 15:02:52.360105038 CET	49757	6302	192.168.2.11	185.38.142.167
Dec 31, 2024 15:02:52.404057026 CET	49757	6302	192.168.2.11	185.38.142.167
Dec 31, 2024 15:02:57.572391033 CET	49931	6302	192.168.2.11	185.38.142.167
Dec 31, 2024 15:02:57.577209949 CET	6302	49931	185.38.142.167	192.168.2.11
Dec 31, 2024 15:02:57.577280045 CET	49931	6302	192.168.2.11	185.38.142.167
Dec 31, 2024 15:02:57.580112934 CET	49931	6302	192.168.2.11	185.38.142.167
Dec 31, 2024 15:02:57.584849119 CET	6302	49931	185.38.142.167	192.168.2.11
Dec 31, 2024 15:03:18.948215961 CET	6302	49931	185.38.142.167	192.168.2.11
Dec 31, 2024 15:03:18.948285103 CET	49931	6302	192.168.2.11	185.38.142.167
Dec 31, 2024 15:03:18.948535919 CET	49931	6302	192.168.2.11	185.38.142.167
Dec 31, 2024 15:03:23.955818892 CET	49973	6302	192.168.2.11	185.38.142.167
Dec 31, 2024 15:03:23.960725069 CET	6302	49973	185.38.142.167	192.168.2.11
Dec 31, 2024 15:03:23.960983992 CET	49973	6302	192.168.2.11	185.38.142.167
Dec 31, 2024 15:03:23.961488008 CET	49973	6302	192.168.2.11	185.38.142.167
Dec 31, 2024 15:03:23.966275930 CET	6302	49973	185.38.142.167	192.168.2.11
Dec 31, 2024 15:03:45.307456970 CET	6302	49973	185.38.142.167	192.168.2.11
Dec 31, 2024 15:03:45.307574987 CET	49973	6302	192.168.2.11	185.38.142.167
Dec 31, 2024 15:03:45.307918072 CET	49973	6302	192.168.2.11	185.38.142.167
Dec 31, 2024 15:03:50.315984011 CET	49974	6302	192.168.2.11	185.38.142.167
Dec 31, 2024 15:03:50.320883989 CET	6302	49974	185.38.142.167	192.168.2.11
Dec 31, 2024 15:03:50.324274063 CET	49974	6302	192.168.2.11	185.38.142.167
Dec 31, 2024 15:03:50.324527979 CET	49974	6302	192.168.2.11	185.38.142.167
Dec 31, 2024 15:03:50.329313040 CET	6302	49974	185.38.142.167	192.168.2.11
Dec 31, 2024 15:04:11.682853937 CET	6302	49974	185.38.142.167	192.168.2.11
Dec 31, 2024 15:04:11.682982922 CET	49974	6302	192.168.2.11	185.38.142.167
Dec 31, 2024 15:04:11.683351994 CET	49974	6302	192.168.2.11	185.38.142.167
Dec 31, 2024 15:04:16.711652994 CET	49975	6302	192.168.2.11	185.38.142.167
Dec 31, 2024 15:04:16.716598988 CET	6302	49975	185.38.142.167	192.168.2.11
Dec 31, 2024 15:04:16.716723919 CET	49975	6302	192.168.2.11	185.38.142.167
Dec 31, 2024 15:04:16.719111919 CET	49975	6302	192.168.2.11	185.38.142.167
Dec 31, 2024 15:04:16.723938942 CET	6302	49975	185.38.142.167	192.168.2.11

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 31, 2024 15:02:21.762965918 CET	1.1.1.1	192.168.2.11	0xc302	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 15:02:21.762965918 CET	1.1.1.1	192.168.2.11	0xc302	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	09:02:27
Start date:	31/12/2024
Path:	C:\Users\user\Desktop\ds1bfe33xg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ds1bfe33xg.exe"
Imagebase:	0x290000
File size:	307'712 bytes
MD5 hash:	2D1E50CE1769F7752C37724FD59E7F6B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000000.1374001431.0000000000292000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	6.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	38
Total number of Limit Nodes:	7

Executed Functions

Function 05D93F50 Relevance: 1.8, Strings: 1, Instructions: 528
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$_q, xrefs: 05D941E4

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID: $_q
API String ID: 0-238743419
Opcode ID: 52026fb29e9e86e44d3cfe1dc23924411cb75ebb6e883334616597eede0ec46e
Instruction ID: d851003a7eafb1cc2a84402f19a4ee110350c9d0ec133a114a62a42981d797d5
Opcode Fuzzy Hash: 52026fb29e9e86e44d3cfe1dc23924411cb75ebb6e883334616597eede0ec46e
Instruction Fuzzy Hash: 56126F74B002159FDB18DF69C454A6EBBF6FF88704B14856AD506EB366DB30EC42CB90

Function 05D967D8 Relevance: .4, Instructions: 415COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b36ea84e800ce2e10f040d27358802dc38094369a4cf97aff227fe72c45ce15f
Instruction ID: 286d77253722f734c83a32fa53a5224e915429c73b0dab1672a1fe6afe4add7a
Opcode Fuzzy Hash: b36ea84e800ce2e10f040d27358802dc38094369a4cf97aff227fe72c45ce15f
Instruction Fuzzy Hash: 15F17E71A002099FDB15DF68D880B9EBBF6FF84300F55856AE505EB2A1DB30ED45CB91

Function 05D9A3D8 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c5ea01e9ef23b42c64ac84fcd566aecf3df253885bcc3cce149857d0a1a1ddd
Instruction ID: 64313a0d68c41f25f4250bb860ec21b4942ead9489565e15e02b950d61f5fc75
Opcode Fuzzy Hash: 9c5ea01e9ef23b42c64ac84fcd566aecf3df253885bcc3cce149857d0a1a1ddd
Instruction Fuzzy Hash: F4D1F630900318CFDB18EFB4D954A9DBBB2FF8A301F5095A9D54AAB355DB31598ACF01

Function 024AD0A8 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 024AD136
GetCurrentThread.KERNEL32 ref: 024AD173
GetCurrentProcess.KERNEL32 ref: 024AD1B0
GetCurrentThreadId.KERNEL32 ref: 024AD209

Memory Dump Source

Source File: 00000000.00000002.2631972093.00000000024A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_ds1bfe33xg.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 9d4063c7afed1e6fbfb2e9d4b7fad33844790897802f2758ccb2a81b1ec6f9d6
Instruction ID: 827b02cd4d4d78aa845bbfea22c793c41d85af8e3a4ff34b221c487e16a1f851
Opcode Fuzzy Hash: 9d4063c7afed1e6fbfb2e9d4b7fad33844790897802f2758ccb2a81b1ec6f9d6
Instruction Fuzzy Hash: E25186B1900309CFDB15DFAAD948B9EBBF1EF58314F20845EE019A73A1D734A984CB65

Function 024AD0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 024AD136
GetCurrentThread.KERNEL32 ref: 024AD173
GetCurrentProcess.KERNEL32 ref: 024AD1B0
GetCurrentThreadId.KERNEL32 ref: 024AD209

Memory Dump Source

Source File: 00000000.00000002.2631972093.00000000024A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_ds1bfe33xg.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: d481f0d19fe15946856b81ca6c3bd3cd1bffe5a0b5db6ba4e5e86030e9599c21
Instruction ID: 2995634666e27220d3401edd1a7454e9d4369412e97151993bdee7a4c7173e02
Opcode Fuzzy Hash: d481f0d19fe15946856b81ca6c3bd3cd1bffe5a0b5db6ba4e5e86030e9599c21
Instruction Fuzzy Hash: E45187B1900309CFDB14DFAAD948B9EBBF1FF58314F20845AE018A73A1D734A984CB65

Function 024AAE30 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 024AB086

Memory Dump Source

Source File: 00000000.00000002.2631972093.00000000024A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_ds1bfe33xg.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 02532266c61ab62077bf94d66f9732c6bb3c40264eab4e982a0b3873df8baccd
Instruction ID: 5763fd9288f9f2094fa100a6dd8a45525edde5d9ad65436e0aa7c5a1175cf9bf
Opcode Fuzzy Hash: 02532266c61ab62077bf94d66f9732c6bb3c40264eab4e982a0b3873df8baccd
Instruction Fuzzy Hash: D97103B0A00B158FDB24DF2AC45475BBBF1FF98304F00892EE48697A40D775E94ACB91

Function 024A5935 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 024A59F1

Memory Dump Source

Source File: 00000000.00000002.2631972093.00000000024A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_ds1bfe33xg.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a802e1c36f3c48db56c4ac3719aec285e11a9f3921420461c058227fd6b40d7f
Instruction ID: 2990fb277100f95607c990814aa7940870c4475bfa334286108347a0d7936fad
Opcode Fuzzy Hash: a802e1c36f3c48db56c4ac3719aec285e11a9f3921420461c058227fd6b40d7f
Instruction Fuzzy Hash: 8641D1B0D00719CBDB24DFA9C984B9EBBB5FF48304F24815AD409AB251DB75694ACF90

Function 024A4248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 024A59F1

Memory Dump Source

Source File: 00000000.00000002.2631972093.00000000024A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_ds1bfe33xg.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 754b41f92474be88496060586c15b32dcc86ffb0b9f82c3996629f1ef09f128b
Instruction ID: 52e673decaedbe029dc393e5652d093a8dd01090e20aa7599dc7fe93898bb876
Opcode Fuzzy Hash: 754b41f92474be88496060586c15b32dcc86ffb0b9f82c3996629f1ef09f128b
Instruction Fuzzy Hash: 5D41DEB0D00719CBDB24CFA9C984B9EBBF5FF48304F60816AD409AB251DB75694ACF90

Function 024AD2F9 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 024AD387

Memory Dump Source

Source File: 00000000.00000002.2631972093.00000000024A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_ds1bfe33xg.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: bb94b717a13b474c39d789bd64b79b28a146293308badeb151adc6d3f85ebc50
Instruction ID: a423eca535eec58df298b297214c9e3dcc37f4ac7cfa93ed92002b2a05a94b43
Opcode Fuzzy Hash: bb94b717a13b474c39d789bd64b79b28a146293308badeb151adc6d3f85ebc50
Instruction Fuzzy Hash: 4921E6B5D00219DFDB10CF9AD984ADEBFF9EB48324F14841AE914A3310C375A944CFA4

Function 024AD300 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 024AD387

Memory Dump Source

Source File: 00000000.00000002.2631972093.00000000024A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_ds1bfe33xg.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 33792bd90c7ee60d4a948f84e41dcd51aae4472540b28c1de7d0622a6be72dd9
Instruction ID: 0766d8d05b47d37c0188f8bea6b51c899e3890106ac13bafafd7c8792a7506c2
Opcode Fuzzy Hash: 33792bd90c7ee60d4a948f84e41dcd51aae4472540b28c1de7d0622a6be72dd9
Instruction Fuzzy Hash: DC21C4B5D00249DFDB10CF9AD984ADEBFF8EB48310F14841AE918A3350D375A954DFA5

Function 024AB020 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 024AB086

Memory Dump Source

Source File: 00000000.00000002.2631972093.00000000024A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_ds1bfe33xg.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 0f5fc702b37a850b4c4e2e2ce393723f895ef7e78c8c95a9a8f33ea84598c9d7
Instruction ID: 5105dc42eba94e5f2f4b904b01531f91ea74812a7771d9590a15f0e49ba30975
Opcode Fuzzy Hash: 0f5fc702b37a850b4c4e2e2ce393723f895ef7e78c8c95a9a8f33ea84598c9d7
Instruction Fuzzy Hash: 53110FB6C003498FCB20CF9AC844A9FFBF4EB98224F14841AD428B7210C375A545CFA1

Function 05D959D8 Relevance: 1.5, Strings: 1, Instructions: 292
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 05D95C29

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: efce334b0decb73261d8c1af341a611e082b7d107786798c5571fd689280924c
Instruction ID: 54c1aa820ab6428add9dd3d4d5c3c9b1bc633d06a8cca71243922220d79d7c38
Opcode Fuzzy Hash: efce334b0decb73261d8c1af341a611e082b7d107786798c5571fd689280924c
Instruction Fuzzy Hash: EBC14B34600602CFCB29CF19D480D6ABBF2FF89314B59C9AAD55A9B665D730FC46CB90

Function 05D93DE0 Relevance: 1.4, Strings: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'_q, xrefs: 05D93F25

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID: 4'_q
API String ID: 0-2033115326
Opcode ID: b3fb0ab3ada1972ef0168dd39015201b2926f4c3b28af83a9be99c8cb5e70d41
Instruction ID: b053fbb6e78e5ead82defdbbbf9f7767ec31ced76cbf3d49ae6d1442610d4a29
Opcode Fuzzy Hash: b3fb0ab3ada1972ef0168dd39015201b2926f4c3b28af83a9be99c8cb5e70d41
Instruction Fuzzy Hash: E031E6727046504FCB1AA778A45046E7BE6EFC635035649BAE04ACF395DE35EC0783A1

Function 05D9B358 Relevance: 1.3, Strings: 1, Instructions: 40
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'_q, xrefs: 05D9B399

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID: 4'_q
API String ID: 0-2033115326
Opcode ID: 9a7aa7edf0710ca0310f09d1e92de19d2c8e2ea365191e046fd7f82139e4fd54
Instruction ID: b65bf7665c6f737e7b1a653f6a0fa88b33c9321650f64129c0fd5754568bfdfa
Opcode Fuzzy Hash: 9a7aa7edf0710ca0310f09d1e92de19d2c8e2ea365191e046fd7f82139e4fd54
Instruction Fuzzy Hash: E8018C3090524AEFCB05EFB8E85848CBFF2FF45300B1455A9D485D7255DA302A89CF11

Function 05D93EC8 Relevance: 1.3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

Strings

4'_q, xrefs: 05D93F25

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID: 4'_q
API String ID: 0-2033115326
Opcode ID: 5ff8c09ca5d34a2a93d163f8ee0b3a00473b1c116f313819d0c5854206a4d12a
Instruction ID: e5f8dcd00073462f771aec153b8d7cdfe4e92bf0ce6ec36e4e316c18a703e2e3
Opcode Fuzzy Hash: 5ff8c09ca5d34a2a93d163f8ee0b3a00473b1c116f313819d0c5854206a4d12a
Instruction Fuzzy Hash: 2BF090713005014FC609FB6DE4559AE7BE6EFC92103944D29E10ADB319EF60BD4B83E2

Function 05D9B368 Relevance: 1.3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

Strings

4'_q, xrefs: 05D9B399

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID: 4'_q
API String ID: 0-2033115326
Opcode ID: 4888d92e0252cfbacc7f962b976a69dc4d36f04ddb7f505704162853ae8cd1be
Instruction ID: 4c411e9434110e29392cfd915d47cd3df2b0a758a3b31ab9e03915bead3f07e7
Opcode Fuzzy Hash: 4888d92e0252cfbacc7f962b976a69dc4d36f04ddb7f505704162853ae8cd1be
Instruction Fuzzy Hash: 69F08770A01209EFCB08FFB8E45C49CBBB6FF44300B5465A9E80AD7355EA302E888F41

Function 05D948B8 Relevance: .6, Instructions: 597COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1061a6b3236fe0033ad20114751ee26b624a590d2377d07bfa9d76f7b5df99ce
Instruction ID: d36cacd043dbf97a6bcda991bf5e207bb955a9a89a9b349cb8f058b0c482b29a
Opcode Fuzzy Hash: 1061a6b3236fe0033ad20114751ee26b624a590d2377d07bfa9d76f7b5df99ce
Instruction Fuzzy Hash: 30324B747006018FDF18DF29C884A6ABBF6FF89305B1584AAE546CB366DB30EC46CB51

Function 05D948A8 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dec5a3d16a7b055a9da48c5c92534685de50106dfed7815b355471a5561ca1b
Instruction ID: db142c857144db5f72f279b61c62ae1d71c1cd97504baacd6ce7a2b65fee3e6f
Opcode Fuzzy Hash: 8dec5a3d16a7b055a9da48c5c92534685de50106dfed7815b355471a5561ca1b
Instruction Fuzzy Hash: 6AB14734B006058FCB19DF29C488A6ABBF6FF89305B1544A9E546DB3B6DB30ED06CB51

Function 05D97D58 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7966be4a218cdb73d9800af98aff673cf4c393e8e3a5223ac9d1e5f475da7ccd
Instruction ID: 794d5b56e67b1ce2a7502949c338508b3b53e2eb40301bc7034c4ffc5452af1c
Opcode Fuzzy Hash: 7966be4a218cdb73d9800af98aff673cf4c393e8e3a5223ac9d1e5f475da7ccd
Instruction Fuzzy Hash: 81512771E10219DBDF18CFA9C845BAEBBF6FF89300F14852AE415AB244DB749946CF90

Function 05D959C8 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5d54bf4300536c0bf583c78c1d70e9154628eef1e6029f8e1be14be85a3cb6f
Instruction ID: edda50e8dea30a5e7d44c78d305b0adc06fee4c6003041961e43c1a7796fb6c7
Opcode Fuzzy Hash: b5d54bf4300536c0bf583c78c1d70e9154628eef1e6029f8e1be14be85a3cb6f
Instruction Fuzzy Hash: E6516635B00606CFCB15CF59D880EAABBF2FF89310B1589AAE559DB261D730F805CB90

Function 05D97D4C Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7af582560e42b19f9ace102739d69025e42639f9173feaa155c5edd16d6caf95
Instruction ID: 2eb4c03204d04a8491410c03c97704d842f2c4f835298611219b561a06c7c507
Opcode Fuzzy Hash: 7af582560e42b19f9ace102739d69025e42639f9173feaa155c5edd16d6caf95
Instruction Fuzzy Hash: A85137B0E1021ADBDF19CFA9C985BADBBF5FF49300F14852AD415AB244D7749846CF90

Function 05D95579 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c82012422b9bd3e51d02b8cd08834f4bf99e622cef33eb80c790c35d67ee415
Instruction ID: b185249cc18df3fd067ce44ffa5027f3c42296512b1f16a68ca941a0b8ac57ae
Opcode Fuzzy Hash: 1c82012422b9bd3e51d02b8cd08834f4bf99e622cef33eb80c790c35d67ee415
Instruction Fuzzy Hash: 99318C75B012109FCB06DF35D88496EBBB2FF89301B5185A9E906CB366DB31ED05CB91

Function 05D95588 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d2589ca27df6cf22f9b54d359b7069634a848e77bc9977be13c225a5d3c8d0d
Instruction ID: dc44a9f147beef69d85667c4c03ada48d3c8214e1a6c3399c0afb706cb8dfcae
Opcode Fuzzy Hash: 8d2589ca27df6cf22f9b54d359b7069634a848e77bc9977be13c225a5d3c8d0d
Instruction Fuzzy Hash: A8316D75B012109FCB16DF39D48496EBBB6FF89301B5084A9E906CB365DB31ED05CB90

Function 05D9F920 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f62eb82c4e5b1ffe5770863c4906854bb2d5ac11241b45e18a95a80e46bcdf2
Instruction ID: b12ae2f3f13ecf466cad919c3f0810c29ff7ca2e1dbee1fa47f638a9ef66e5fd
Opcode Fuzzy Hash: 9f62eb82c4e5b1ffe5770863c4906854bb2d5ac11241b45e18a95a80e46bcdf2
Instruction Fuzzy Hash: 743108347093419FCB1A6F78A8284693FB7FF8631035408ABE506CB355DE714C45CB61

Function 05D987A0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c42186be3b69b1d87ad12fce296743b5608703a446316c0e777ec1d445b6f659
Instruction ID: 8e329c311a683d99cb6ad7f4df0ba654481893f13f6f8ae22ef51b39f6f39d59
Opcode Fuzzy Hash: c42186be3b69b1d87ad12fce296743b5608703a446316c0e777ec1d445b6f659
Instruction Fuzzy Hash: 634102B1D002089FDF18DFAAD944ADEFBB6EF88310F14802AE415B7250DB35A945CFA1

Function 05D98795 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f59c9e24eb0d1c6e8f9e9c256b99a199833c0093c00517124914435c3896977
Instruction ID: 86c94b01c1ced1fbb1ae4cb9cb4b80b80b048eddb0ce5be6b2f1762c36ab4b41
Opcode Fuzzy Hash: 9f59c9e24eb0d1c6e8f9e9c256b99a199833c0093c00517124914435c3896977
Instruction Fuzzy Hash: 0531F1B1D102099FDB18CFAAD985ADEBFF6AF48300F24802AD416B7250DB359945CFA1

Function 05D98A98 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b30c738b022ca3685bfe7fa029a6165d45eacd8f5fa61b0f287df996a0b28f8f
Instruction ID: 0e47e5fc3ccccab8773e58089c033a80698cf012a8386b487dc997bd8f72da1c
Opcode Fuzzy Hash: b30c738b022ca3685bfe7fa029a6165d45eacd8f5fa61b0f287df996a0b28f8f
Instruction Fuzzy Hash: E33112B1D01219DFCF14CFA9D890BDEBBF9EF49314F28802AE409A7240C735A946CB90

Function 008CD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2631589844.00000000008CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8cd000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1346b031d67ac458800f26e638a1e2a85c443d8c4a5d509d80ebf6b849dd3008
Instruction ID: d124a2dcb583861be3bae5623cdd0f31d6fd62382c9c3354a86f288842514990
Opcode Fuzzy Hash: 1346b031d67ac458800f26e638a1e2a85c443d8c4a5d509d80ebf6b849dd3008
Instruction Fuzzy Hash: AE21CF756047049FCB15EF18D984F26BBB5FB88324F24C97DD80A8B286C33AD807CA61

Function 05D98F42 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e56db62d8a07a2502ecc3bca0d2f764aacb287e711add8f0ec1dde60eb3b6c2a
Instruction ID: 10e605c435a32fea540d3ef2e7869c2126d61599d9e4c90eabd6ffa4cc039a1d
Opcode Fuzzy Hash: e56db62d8a07a2502ecc3bca0d2f764aacb287e711add8f0ec1dde60eb3b6c2a
Instruction Fuzzy Hash: 7B21DEB4D0421ADFCF04CFA8D584AEEBBB1FB49311F2050AAE916A7351D7349A81DF90

Function 05D98A8C Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0563de7d708f31e9a7b9ad73fb9d642c08c0c20a337134a483a5061937e93cfd
Instruction ID: 63bc5b7e83d632a1fdd30dad9eece8199ee7dfc51820676d2164e7a59cdff2d7
Opcode Fuzzy Hash: 0563de7d708f31e9a7b9ad73fb9d642c08c0c20a337134a483a5061937e93cfd
Instruction Fuzzy Hash: FD2146B1D00218DFCF14CFA9C890BDEBBF9EF49314F28842AE405A7240C7349846CB60

Function 05D9BC5F Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ce31cdb7d226e9df4a57f33f3bc7de7061bb6356bca2c2ce65483d8e34f78f5
Instruction ID: 7a70b3b579e5f98a4a9277b7b697afacdddae96489c12e6fa5f6f174ebdd951f
Opcode Fuzzy Hash: 3ce31cdb7d226e9df4a57f33f3bc7de7061bb6356bca2c2ce65483d8e34f78f5
Instruction Fuzzy Hash: 9E1173302146015FC797A738A8585AE7BA3FFC5390398581DE586C7641DD30798ACB96

Function 008CD017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2631589844.00000000008CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8cd000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c74efafe6a787794d2e52374dfad20fc7a218ab120a23d42f416259975cce95d
Instruction ID: 3ce8bd1ff6d3e4b1dca28ce3059d8162ae8b6885465d20ab337ee1369423dac4
Opcode Fuzzy Hash: c74efafe6a787794d2e52374dfad20fc7a218ab120a23d42f416259975cce95d
Instruction Fuzzy Hash: FD11BB75504780DFCB12DF18D5C4B16BBB2FB84314F24C6AED8498B656C33AD80ACBA2

Function 05D9C499 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efac991127ae1e22213f1257cdfbc34ab0808d51d669a8cf0f2f6bad87bd253f
Instruction ID: 379c947d948f1953400aa479d40d4811e926bee14f5a71fd482e74f973a18d21
Opcode Fuzzy Hash: efac991127ae1e22213f1257cdfbc34ab0808d51d669a8cf0f2f6bad87bd253f
Instruction Fuzzy Hash: 0C118E302047048FD725AF75E41865E7BE2EFC9311B148A29D18A87785DFB4A94ACB92

Function 05D96E90 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22a4010a234befd8700449dacb18373badd2bf420131204bba154791b9dd3f19
Instruction ID: 47ce14c4032956b15bbc29d39fe15277df0bb35d14ae41f68ed24778aceafacd
Opcode Fuzzy Hash: 22a4010a234befd8700449dacb18373badd2bf420131204bba154791b9dd3f19
Instruction Fuzzy Hash: 58F0A4732040983FDB114EAA6C00DFB7FEDEB8D165B144166FA99D1241C029C916ABB0

Function 05D9BC70 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eda59bf3c782e4f52b3e5aa5ce58471974802657f4ce38972c62c3a6eee1007a
Instruction ID: a0b837eb8aabf113fd6bde6f3eb17c3000b358575b052860a850974e0db48c15
Opcode Fuzzy Hash: eda59bf3c782e4f52b3e5aa5ce58471974802657f4ce38972c62c3a6eee1007a
Instruction Fuzzy Hash: 6401B131210A015B8687B73CF4585AF3AA3FFC43903845828E207C7741DE30BE8B8B96

Function 05D9E8B0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47513bfc086cedb8c989b17dd42dd1c705a28555a57832f16d3a90fe6735c2c5
Instruction ID: f0b58f11705d2d190f673ef4a9768f8bed51bc705eb037881d36b689518eadc7
Opcode Fuzzy Hash: 47513bfc086cedb8c989b17dd42dd1c705a28555a57832f16d3a90fe6735c2c5
Instruction Fuzzy Hash: AD01D6746183489FCB02DF74D8144697FBAEF96300B1448EAE581CB762DA32DD51DB91

Function 05D95508 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d859e71cce2511dfa4b2d4cf0b14e31f256adf13c13b8b6e3568b1f3ebc17844
Instruction ID: 3cb677d7dc6c8232f462eff15ce6fe865b08d29b450767216bce07ae75ca0444
Opcode Fuzzy Hash: d859e71cce2511dfa4b2d4cf0b14e31f256adf13c13b8b6e3568b1f3ebc17844
Instruction Fuzzy Hash: 53016230605701CFCBAEDE26B80492777E7FF84205714883AD4478665ADA75E481CB90

Function 05D9C4A8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4228d75c0e231f479d15ab9bb1337cafdfc4fa9545a5dddf5cc9f47d7d526e74
Instruction ID: 133b5d341570ca60dbd4e8c7cdec00cbeb7215c45683a5a5e909037d3013265a
Opcode Fuzzy Hash: 4228d75c0e231f479d15ab9bb1337cafdfc4fa9545a5dddf5cc9f47d7d526e74
Instruction Fuzzy Hash: 86015E302007048FD325AF69E45865E7BE3FFC9315B508A29E14A97785DFB4A90ACF92

Function 008BD5F3 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2631517981.00000000008BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bd000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91c9eeb15feba9511dbd4712c4406ec43e33aa540e1cf436779e27cf785f60a1
Instruction ID: 300e7a2009f28749e453908c87621806b65ed417f15d71098ba5d5a2ff4a597c
Opcode Fuzzy Hash: 91c9eeb15feba9511dbd4712c4406ec43e33aa540e1cf436779e27cf785f60a1
Instruction Fuzzy Hash: EAF0F9B6200604AF97208F0AD884C67FBADFBD5774759C55AE84A8B712D671EC42CAA0

Function 05D9ADE9 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 671ad798db8a3f7442643f5f962e628cd27b1a7917837f5d6bec7b8630071fc2
Instruction ID: e481b316db5e83dcb95461440e52c58f2339583505c5a9fa6dac3ae2c2db1939
Opcode Fuzzy Hash: 671ad798db8a3f7442643f5f962e628cd27b1a7917837f5d6bec7b8630071fc2
Instruction Fuzzy Hash: 8CF02E312093406FD7516B79A859ADF7FEAEFCB314B44046EF549C3343CA65184A87B2

Function 05D98F50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bda0a4e037230d746dbd215c23cd7873494e304dc4edd9141e9757fed23eb33
Instruction ID: 01e0ab8c23360b6595ee369b0637534202723fa9eff55edbad224e334e16c63c
Opcode Fuzzy Hash: 3bda0a4e037230d746dbd215c23cd7873494e304dc4edd9141e9757fed23eb33
Instruction Fuzzy Hash: E101C0B4D0421AEFCF08DFA9D944AAEBBF5FB49301F1090AA9915A3351E7784A40DF90

Function 05D967C8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c1953d7560aea1185d45736a761695e219f2f7d35159966453203891b3b54eb
Instruction ID: 3890adc5174d4278714ca847c2346efccb16dfaa8f3f5817bd968f119013b25e
Opcode Fuzzy Hash: 5c1953d7560aea1185d45736a761695e219f2f7d35159966453203891b3b54eb
Instruction Fuzzy Hash: AFF0F031700300AFDB208A69AC44FA27FE9EF86710F018266F210CF5E2D2B1E805D381

Function 05D9C170 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a7286e9498574b82912560aa9647a083b02a8562f619b7d90ff321e91efe5d2
Instruction ID: b03351b3938305e105a5df67bcd836e72c6014396b9573972f37abf89aba93ab
Opcode Fuzzy Hash: 4a7286e9498574b82912560aa9647a083b02a8562f619b7d90ff321e91efe5d2
Instruction Fuzzy Hash: 3A01AD31402B018FD7269F32E40D061BBF6FF893047148A2FE4C683A55DB74A58ACF84

Function 008BD5E4 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2631517981.00000000008BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bd000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 199a34f2b756bde70dbd7b387af71f69dcd3c2d1a4875a437cd5dbd8be7674ae
Instruction ID: 75fbdf0038294598ba989ba3588dd4b7a8538c09dcb935a4bde1ccab3751b420
Opcode Fuzzy Hash: 199a34f2b756bde70dbd7b387af71f69dcd3c2d1a4875a437cd5dbd8be7674ae
Instruction Fuzzy Hash: F3F0EC75104780AFD7158F16C984C63BFB9FF967607198589E88A8B352C671FC42DBA0

Function 05D9ACB8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed661ac40d6f0d2d168832de831fada2b662431fd5fd5c062ca841b9d1d1962a
Instruction ID: 7087b5e0b4d9e2ad98468ab003c29f770c8e24ca668f33fd420e58fd5dd98d49
Opcode Fuzzy Hash: ed661ac40d6f0d2d168832de831fada2b662431fd5fd5c062ca841b9d1d1962a
Instruction Fuzzy Hash: 2EF0E97230D2945FCB1757786C240AE3FB6DEC665534804DFE1C2CB253DA54554AC3E1

Function 05D96EA0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18c48215b44b5af89afd9fbe82b5b08e7e6f2de6d085617047898b43f964704b
Instruction ID: 53eba92839c0951858771acdba1699da1d2b1246e64a4ccd7f93d720c373c58c
Opcode Fuzzy Hash: 18c48215b44b5af89afd9fbe82b5b08e7e6f2de6d085617047898b43f964704b
Instruction Fuzzy Hash: 49F012722041E83F8B515EAA5C10CFB7FEDDB8E1627084156FF98D2251C429C921ABB0

Function 05D954F8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 119eb21edb2e8d8e9050479923393f214fbdf237923d663b16188c788bafafd7
Instruction ID: 3181f8c46eec95e7eef4c15b1dae9929dc1a714434bee26e96c78f892c6ca3cf
Opcode Fuzzy Hash: 119eb21edb2e8d8e9050479923393f214fbdf237923d663b16188c788bafafd7
Instruction Fuzzy Hash: 69F09631505741CFCB6ACE61E540B6BBBB7FF80315F04887ED44246916D6B5E585CB40

Function 05D9C110 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 610aa140a9f58dd5feb5da319527e1411554147f8f99e0562b1f735e293fbdc0
Instruction ID: 6f514ed3a0bb45412eb319efc12c5e2cdf07542d2ede3349656430129d171442
Opcode Fuzzy Hash: 610aa140a9f58dd5feb5da319527e1411554147f8f99e0562b1f735e293fbdc0
Instruction Fuzzy Hash: 5DF02B30209BD04FC312DB3DE82C69A7FF6DF82304B08099EE1C6C7243CAA56949CB91

Function 05D98FC0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bde739d0db5c4845484fb34efffc88c64f12dda7bad88688eff405c0750c90f7
Instruction ID: de3ed8d4631eaf55b0919aef59b153f1abcc08c5e69fa84798917c4bbdf7e285
Opcode Fuzzy Hash: bde739d0db5c4845484fb34efffc88c64f12dda7bad88688eff405c0750c90f7
Instruction Fuzzy Hash: 66F0A9B0C081499FCF01CFA4C8140AEBFB1EB5A301F00518BE446E7292E2398A41DB10

Function 05D9AC60 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14ef748ecf0c63d26a4adea561590445a92970d5d3396bd593d8c93197bcf8c4
Instruction ID: 3b4b053efdeff023402bea729a174f715f0b7830031ab04067ce0ad50366f545
Opcode Fuzzy Hash: 14ef748ecf0c63d26a4adea561590445a92970d5d3396bd593d8c93197bcf8c4
Instruction Fuzzy Hash: 9CF082712096E45FC6175B2868340ED3F76DFCA21470804DBE1C5C7293CA540A49C7E9

Function 05D9ADF8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 087e256f7b10d9173830c6a750e8a6e6a2a18610b6f20091dd8631ae09d5c4c4
Instruction ID: 27782a5914e8b58752fed499ddcfa825f3108cebe66589e0ce87cb98a172989b
Opcode Fuzzy Hash: 087e256f7b10d9173830c6a750e8a6e6a2a18610b6f20091dd8631ae09d5c4c4
Instruction Fuzzy Hash: C9E09231304200AFDB246A5AA449A9F7ADAEFC9351B40452CF60ED3342CEA1684A47A6

Function 05D9C180 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ee82828a1cc6ab9dbef8501b00addaf1917844c74852f23f66aadb474a38a84
Instruction ID: bb6f3c164734ccc62d7677f756a29a221834fc0fee131b51d8c950d2266f91f4
Opcode Fuzzy Hash: 9ee82828a1cc6ab9dbef8501b00addaf1917844c74852f23f66aadb474a38a84
Instruction Fuzzy Hash: EEF06D35501B01CFE729DF26E40C522BBF6FB88300700962AE88B82A54DB70A54ACF84

Function 05D95698 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c14f6007c5b3fcf92b422b80208a8b5eae9c5076e4ad43efd047fe048edca6da
Instruction ID: 24daf58b642992ef93f5053a27518874330aa20c9ce525d47946ac09bd3fbbf8
Opcode Fuzzy Hash: c14f6007c5b3fcf92b422b80208a8b5eae9c5076e4ad43efd047fe048edca6da
Instruction Fuzzy Hash: 8EE06DB210C2509FD315DF24E804C877FA8EF95220B01887EF485C7151E631D840C7A5

Function 05D9B500 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ceb04d4753aeb49a44b7640ab19de8e6b1970b07c83ea242c6fb6fc0094378c9
Instruction ID: 0a3e81eca5c2903d2c62335682ffff2b6db7a310ce8a2cd0fadd4d41263e4a35
Opcode Fuzzy Hash: ceb04d4753aeb49a44b7640ab19de8e6b1970b07c83ea242c6fb6fc0094378c9
Instruction Fuzzy Hash: 2CF0A575D0120DAFCB41DFB4E9598CDBBB9EB88300F1042AAD945E3244EA305B55DF91

Function 05D9C120 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1ec4de6aafee18644eb333706c9a0067ccd34ec1244040480a0b33eeb24f4c6
Instruction ID: 998c31247ce9c8d7d95953b53761c0b050380f2373ddbd2ed4a876e5c8c9817b
Opcode Fuzzy Hash: c1ec4de6aafee18644eb333706c9a0067ccd34ec1244040480a0b33eeb24f4c6
Instruction Fuzzy Hash: 8AE0E530200B908FC711E72DE41C79E7FE6EF81304F04082DE246C7741CBA168058B91

Function 05D9CC38 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c6667221487a931601360210fee6b2e008eba5bf68b52990c5660d0f8480132
Instruction ID: fbc4f0cc0f334452d392e27145a54e5b79358640977bf242aa3d0744a423919e
Opcode Fuzzy Hash: 1c6667221487a931601360210fee6b2e008eba5bf68b52990c5660d0f8480132
Instruction Fuzzy Hash: EEE09231205241CFCB12FE35FC185D97BE1EF55790B00645AD080CB65ACE7008CACBD2

Function 05D9E280 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bcc5ad0238e12f975b516482109e3518f3ea4ee5d1bf0ddda6c45170fa1e163
Instruction ID: 3efa08e984b2a99f87b7cb636a6514703ba989946f839b4e6620c6a5da77bd62
Opcode Fuzzy Hash: 8bcc5ad0238e12f975b516482109e3518f3ea4ee5d1bf0ddda6c45170fa1e163
Instruction Fuzzy Hash: D7E0D831009740EFCB06F724FD126843BA5FB4BB44B012055E8108F6BDC7A42E468BD2

Function 05D9CE88 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d03680d69bc4bb13be6c20c5426ab2912e1e923e99849ca2a3b8d97ccab4cbba
Instruction ID: 59cbb785445fcd6342434b0f71727558033df6265506189f3093313eb173de6d
Opcode Fuzzy Hash: d03680d69bc4bb13be6c20c5426ab2912e1e923e99849ca2a3b8d97ccab4cbba
Instruction Fuzzy Hash: A4E09270109341EFC702EF34F8189943BA1EF067507051559D8818F61ECAB458858B85

Function 05D9E1FF Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e82b93e124329bd6f3addd7d4ea8240d1a6e98689dd6065c5bced971a7304f5
Instruction ID: 78523c67ae3d18b628e1ce6031fcaa65d4a002210f00acfab758d7057a4eaf0f
Opcode Fuzzy Hash: 9e82b93e124329bd6f3addd7d4ea8240d1a6e98689dd6065c5bced971a7304f5
Instruction Fuzzy Hash: 03E0DF71A09208FFCB01EFA8F800ADD3BB1DF82300F2045DAE809E7251D5701F158792

Function 05D9F910 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c766ae4b5e5e706bc3eb8aa2b51881599a4beb53bbaf61535c1938699f87927e
Instruction ID: 1c9320fde81bd6d2202f984184bed7d31aeda507496746f3d5673425c6043d45
Opcode Fuzzy Hash: c766ae4b5e5e706bc3eb8aa2b51881599a4beb53bbaf61535c1938699f87927e
Instruction Fuzzy Hash: 93E07D352043129FCB151F7990140D77BE7EF8621031940ABD5C1CB106DE7448468745

Function 05D9AC80 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e1201f20b72058c1ac199de49d5a5f787c9077bc3f2db1b3ef1bfbd4845d09b
Instruction ID: 6bcf5addcab0d9d5b7fd655aa226452668d6210d4df342592d150ce203199604
Opcode Fuzzy Hash: 2e1201f20b72058c1ac199de49d5a5f787c9077bc3f2db1b3ef1bfbd4845d09b
Instruction Fuzzy Hash: 1FD05B31300518579E05376DB4184AE77BBEFC9661344052AF607C3342CFB51D4A87D5

Function 05D9E8F8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea650b7977d493180b9bfd100f584079772b442ecc4e55d3a531db23012cb7e9
Instruction ID: 4b7881d24b8fe5062955fa95ba5b499c16671be0db76ce930fa17064fd0a2848
Opcode Fuzzy Hash: ea650b7977d493180b9bfd100f584079772b442ecc4e55d3a531db23012cb7e9
Instruction Fuzzy Hash: 9AE08C392583459FC7129F74C8008547FF5BF5A61031840CAF5C08B672C231D8A1DB51

Function 05D9B510 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9a774e4cb81b957a728af14fb2be72806d330eac57dbbae85be9127a47d114d
Instruction ID: 273b0911db8699ef2ca9524979ce327df38f9559ccb97ccaa518a146e28a5873
Opcode Fuzzy Hash: f9a774e4cb81b957a728af14fb2be72806d330eac57dbbae85be9127a47d114d
Instruction Fuzzy Hash: ADE09275D0020DEFCB40DFE5E9598DEBBB9EB48300F1082AAD909A3200EB306B55DF80

Function 05D9E210 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06f4cacd1d37ff15b08186280589fcbf3d3b3db6969b112b3a3515e21855104c
Instruction ID: d7a5610180554c87084c11e2ba91431d7bbd62085e5c48f1ad999eb06609c54b
Opcode Fuzzy Hash: 06f4cacd1d37ff15b08186280589fcbf3d3b3db6969b112b3a3515e21855104c
Instruction Fuzzy Hash: 88D017B1A0020CFBCB40EFA8F90199DB7B9EF45304B5055A9E809E7201EA712F009B91

Function 05D9F8EB Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b794c034decb6aa1333944928fba5ec06132ebefbfbb9d0e6ccfa49113a47ada
Instruction ID: 54b213139dedf9ec2f7f002bf12584c5f0a09cf5315b84279840ca006e0834b3
Opcode Fuzzy Hash: b794c034decb6aa1333944928fba5ec06132ebefbfbb9d0e6ccfa49113a47ada
Instruction Fuzzy Hash: 91C012327142200B0A84BE6C70140AE66E7E6C82E3395012AEA0EE7348CEA08D464795

Function 05D93721 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0399b50ee63c021bf5979949fc9c7c1a3e30f8241aa14a5f4d81dd57f02fa4ce
Instruction ID: 5506b1171be5c06b382197b38d3c6f121b2e8b0805904f6049d8229c8b64d19b
Opcode Fuzzy Hash: 0399b50ee63c021bf5979949fc9c7c1a3e30f8241aa14a5f4d81dd57f02fa4ce
Instruction Fuzzy Hash: 45C08CB104A380AFCF060750AC01D327E20ABAA700F030083B6858A0B3C1610928E3B3

Function 05D9DFD1 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48e843de270ba5865ac2b39161776df2eb242ff773581141665f4c53b0a3135a
Instruction ID: 6f375cbeabd1d09a280c08b04ece6afc866843777c58fc4fcb878d5cd6034b6e
Opcode Fuzzy Hash: 48e843de270ba5865ac2b39161776df2eb242ff773581141665f4c53b0a3135a
Instruction Fuzzy Hash: 10C09B7558A7D09FDB028F74D91D8003F61EF86714B1501CAD385CF4B7C6714405CB51

Non-executed Functions

Function 05D96FE8 Relevance: .8, Instructions: 786COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cae4d0b2bf16084960fe24a2810373b057eda009af48847f9bba729d9b16600
Instruction ID: f02a0b5a98fe80d98253260efbec958c648a7567735e32368c0e6dd52c975d49
Opcode Fuzzy Hash: 5cae4d0b2bf16084960fe24a2810373b057eda009af48847f9bba729d9b16600
Instruction Fuzzy Hash: 3A6241B07006009FD749EF18D45875A7AE6EF84308FA4C85CD10D9F396DBBAE94B8B91

Function 05D96FF8 Relevance: .8, Instructions: 780COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36e4ef2e643ab3a75974e16ec9a26f8ccbbffece01a4f591da561b4b8e0faff1
Instruction ID: 31212a825062ab9b32d7393f5423417e5f57085dd61a8153d9dc21d541492ade
Opcode Fuzzy Hash: 36e4ef2e643ab3a75974e16ec9a26f8ccbbffece01a4f591da561b4b8e0faff1
Instruction Fuzzy Hash: 596230B07006009FD749EF18D45875A7AE6EF84308FA4C85CD10D9F396DBBAE94B8B91

Function 024ADC74 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2631972093.00000000024A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fdcf544244254b065e577796dec66c211b0c38c74783831853bd13f2aa01be9
Instruction ID: f70b908adb130657fa90e364bde91f24eb9b396b4233ae530c842a5670e777d8
Opcode Fuzzy Hash: 7fdcf544244254b065e577796dec66c211b0c38c74783831853bd13f2aa01be9
Instruction Fuzzy Hash: 97A18C36E00205CFCF05DFB5C85059EB7B2FF98304B15856AE806AB265DB76E95ACF80

Function 05D9E2C7 Relevance: 46.6, Strings: 37, Instructions: 391COMMON

Download Yara Rule

Strings

Dzj, xrefs: 05D9E7C3
Dzj, xrefs: 05D9E4F3
Dzj, xrefs: 05D9E630
Dzj, xrefs: 05D9E543
Dzj, xrefs: 05D9E6F8
Dzj, xrefs: 05D9E5BB
Dzj, xrefs: 05D9E6A8
Dzj, xrefs: 05D9E56B
Dzj, xrefs: 05D9E680
Dzj, xrefs: 05D9E3E7
Dzj, xrefs: 05D9E748
Dzj, xrefs: 05D9E4CB
Dzj, xrefs: 05D9E593
Dzj, xrefs: 05D9E608
Dzj, xrefs: 05D9E819
Dzj, xrefs: 05D9E720
Dzj, xrefs: 05D9E456
Dzj, xrefs: 05D9E658
Dzj, xrefs: 05D9E431
Dzj, xrefs: 05D9E6D0
Dzj, xrefs: 05D9E2E4
Dzj, xrefs: 05D9E32E
Dzj, xrefs: 05D9E40C
Dzj, xrefs: 05D9E353
Dzj, xrefs: 05D9E5E3
Dzj, xrefs: 05D9E770
Dzj, xrefs: 05D9E51B
Dzj, xrefs: 05D9E39D
Dzj, xrefs: 05D9E309
Dzj, xrefs: 05D9E844
Dzj, xrefs: 05D9E378
Dzj, xrefs: 05D9E798
Dzj, xrefs: 05D9E47B
Dzj, xrefs: 05D9E7EE
Dzj, xrefs: 05D9E4A3
Dzj, xrefs: 05D9E86F
Dzj, xrefs: 05D9E3C2

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID: Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj
API String ID: 0-1840911277
Opcode ID: 0330bdecf55f9b5d9dfbc8e88da936409c6d7276da344d9245aabca5d652b41a
Instruction ID: 01ee7bdc7921827cae8c1f7e8e6e0f21ea0281858df2a38eaec3339169bd9535
Opcode Fuzzy Hash: 0330bdecf55f9b5d9dfbc8e88da936409c6d7276da344d9245aabca5d652b41a
Instruction Fuzzy Hash: 68D17C30300A157BD30A77A4DD56AADB6A3FF86700BD04928E2054F79ADF712E1E4397

Function 05D9E2D8 Relevance: 46.6, Strings: 37, Instructions: 383COMMON

Download Yara Rule

Strings

Dzj, xrefs: 05D9E7C3
Dzj, xrefs: 05D9E4F3
Dzj, xrefs: 05D9E630
Dzj, xrefs: 05D9E543
Dzj, xrefs: 05D9E6F8
Dzj, xrefs: 05D9E5BB
Dzj, xrefs: 05D9E6A8
Dzj, xrefs: 05D9E56B
Dzj, xrefs: 05D9E680
Dzj, xrefs: 05D9E3E7
Dzj, xrefs: 05D9E748
Dzj, xrefs: 05D9E4CB
Dzj, xrefs: 05D9E593
Dzj, xrefs: 05D9E608
Dzj, xrefs: 05D9E819
Dzj, xrefs: 05D9E720
Dzj, xrefs: 05D9E456
Dzj, xrefs: 05D9E658
Dzj, xrefs: 05D9E431
Dzj, xrefs: 05D9E6D0
Dzj, xrefs: 05D9E2E4
Dzj, xrefs: 05D9E32E
Dzj, xrefs: 05D9E40C
Dzj, xrefs: 05D9E353
Dzj, xrefs: 05D9E5E3
Dzj, xrefs: 05D9E770
Dzj, xrefs: 05D9E51B
Dzj, xrefs: 05D9E39D
Dzj, xrefs: 05D9E309
Dzj, xrefs: 05D9E844
Dzj, xrefs: 05D9E378
Dzj, xrefs: 05D9E798
Dzj, xrefs: 05D9E47B
Dzj, xrefs: 05D9E7EE
Dzj, xrefs: 05D9E4A3
Dzj, xrefs: 05D9E86F
Dzj, xrefs: 05D9E3C2

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID: Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj
API String ID: 0-1840911277
Opcode ID: e7ca56e23f4cbeae5bc3ca6a52150c0165dbc3e1d0e1648054cc1d93a2cf9d1a
Instruction ID: a76d0e0779cd4973ea96cb255d8e844246a49015d7c2ff2d0b0c4b97d7e0c527
Opcode Fuzzy Hash: e7ca56e23f4cbeae5bc3ca6a52150c0165dbc3e1d0e1648054cc1d93a2cf9d1a
Instruction Fuzzy Hash: CAD17D30300A157BD30A77A4D956AADB693FF8A700BD04928E2054F79ADF712E1E4397

Function 05D9CC7F Relevance: 16.4, Strings: 13, Instructions: 150COMMON

Download Yara Rule

Strings

Dzj, xrefs: 05D9CD0B
Dzj, xrefs: 05D9CDE9
Dzj, xrefs: 05D9CD55
Dzj, xrefs: 05D9CCC1
Dzj, xrefs: 05D9CCE6
Dzj, xrefs: 05D9CDC4
Dzj, xrefs: 05D9CD9F
Dzj, xrefs: 05D9CE0E
Dzj, xrefs: 05D9CD30
Dzj, xrefs: 05D9CC9C
Dzj, xrefs: 05D9CE33
Dzj, xrefs: 05D9CD7A
Dzj, xrefs: 05D9CE58

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID: Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj
API String ID: 0-1877730170
Opcode ID: aa9efa79c6990b3875dc1aec25045aa1f7e168b7912fe9be7ac98858ec5e7cf3
Instruction ID: 51fd6a0bb5b35300a5cf00b6bd9e650aa29296acde76343db4071db19e3150f7
Opcode Fuzzy Hash: aa9efa79c6990b3875dc1aec25045aa1f7e168b7912fe9be7ac98858ec5e7cf3
Instruction Fuzzy Hash: 28418F30300A057BD3067BA4D9556AEB693FF87300BD04929E2094F78ADFB52E4E479B

Function 05D9CC90 Relevance: 16.4, Strings: 13, Instructions: 143COMMON

Download Yara Rule

Strings

Dzj, xrefs: 05D9CD0B
Dzj, xrefs: 05D9CDE9
Dzj, xrefs: 05D9CD55
Dzj, xrefs: 05D9CCC1
Dzj, xrefs: 05D9CCE6
Dzj, xrefs: 05D9CDC4
Dzj, xrefs: 05D9CD9F
Dzj, xrefs: 05D9CE0E
Dzj, xrefs: 05D9CD30
Dzj, xrefs: 05D9CC9C
Dzj, xrefs: 05D9CE33
Dzj, xrefs: 05D9CD7A
Dzj, xrefs: 05D9CE58

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID: Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj
API String ID: 0-1877730170
Opcode ID: f7252ff209aac9f9c40b9e8241fbfdbb38569e5823f5249927ed902dcc2746b5
Instruction ID: b17e8d9272d305daf16bfe530a2af7b6f1ef740c7c55011b7a8c72e33ed19472
Opcode Fuzzy Hash: f7252ff209aac9f9c40b9e8241fbfdbb38569e5823f5249927ed902dcc2746b5
Instruction Fuzzy Hash: CC417F30300A147BD30677A499466AE7653FF86300BD04938E2094F78ADFB56E1E479B

Function 05D9CED1 Relevance: 10.1, Strings: 8, Instructions: 103COMMON

Download Yara Rule

Strings

Dzj, xrefs: 05D9CEEC
Dzj, xrefs: 05D9CF5B
Dzj, xrefs: 05D9CFEF
Dzj, xrefs: 05D9CFA5
Dzj, xrefs: 05D9CF11
Dzj, xrefs: 05D9CFCA
Dzj, xrefs: 05D9CF36
Dzj, xrefs: 05D9CF80

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID: Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj
API String ID: 0-3572161617
Opcode ID: eca4dbbf32e82844ec96f59d9c09aca66bb17106b48387fc077f45aef231d96f
Instruction ID: c38e71d3a98ce424276315c1da687d6d9af450805e0ad661114a30f6996e14c8
Opcode Fuzzy Hash: eca4dbbf32e82844ec96f59d9c09aca66bb17106b48387fc077f45aef231d96f
Instruction Fuzzy Hash: D131A2303006057BC7066BB49955ABDB697FF86300BD04938E2098F78ADFB52E4E4797

Function 05D9CEE0 Relevance: 10.1, Strings: 8, Instructions: 93COMMON

Download Yara Rule

Strings

Dzj, xrefs: 05D9CEEC
Dzj, xrefs: 05D9CF5B
Dzj, xrefs: 05D9CFEF
Dzj, xrefs: 05D9CFA5
Dzj, xrefs: 05D9CF11
Dzj, xrefs: 05D9CFCA
Dzj, xrefs: 05D9CF36
Dzj, xrefs: 05D9CF80

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID: Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj
API String ID: 0-3572161617
Opcode ID: f8dfb7d56c1a67dfc47b3c83d4ba1064526d7bd957acce28deec23322e279d4c
Instruction ID: 01b3cd0a2e1551ea464e6516e07c30d982a8a00078d8c3c46d349ce753d2b95f
Opcode Fuzzy Hash: f8dfb7d56c1a67dfc47b3c83d4ba1064526d7bd957acce28deec23322e279d4c
Instruction Fuzzy Hash: 42216F31300A157BD70677A49951ABDB653FF86700BD04938E2094F78ACFB62E4E439B

Function 05D9C968 Relevance: 8.8, Strings: 7, Instructions: 88COMMON

Download Yara Rule

Strings

Dzj, xrefs: 05D9C984
Dzj, xrefs: 05D9C9D6
Dzj, xrefs: 05D9CA51
Dzj, xrefs: 05D9CA28
Dzj, xrefs: 05D9C9FF
Dzj, xrefs: 05D9C9AD
Dzj, xrefs: 05D9CA7A

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID: Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj
API String ID: 0-410062309
Opcode ID: 3ad89bdb0564f140d80b01e6c93f56ef7e7379d232668b4e26542b17dbea6a59
Instruction ID: 17d0fb6f807c56cca37452e8737aea1ca8f213d45bf9686a127836946a5c85d2
Opcode Fuzzy Hash: 3ad89bdb0564f140d80b01e6c93f56ef7e7379d232668b4e26542b17dbea6a59
Instruction Fuzzy Hash: EF31A730305A467BC7062BA598559AD7B63FF873007844538E20A8F6A6CE715E8F8787

Function 05D9C978 Relevance: 8.8, Strings: 7, Instructions: 83COMMON

Download Yara Rule

Strings

Dzj, xrefs: 05D9C984
Dzj, xrefs: 05D9C9D6
Dzj, xrefs: 05D9CA51
Dzj, xrefs: 05D9CA28
Dzj, xrefs: 05D9C9FF
Dzj, xrefs: 05D9C9AD
Dzj, xrefs: 05D9CA7A

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID: Dzj$Dzj$Dzj$Dzj$Dzj$Dzj$Dzj
API String ID: 0-410062309
Opcode ID: aedc5d9320a4ebf22a8888ef7e69769803cd312f68a11701954fe77b0aa9d5d3
Instruction ID: 1325736d265f1a75aec7872eb6259c63695a41505a87f9f2bd77526396fc63f2
Opcode Fuzzy Hash: aedc5d9320a4ebf22a8888ef7e69769803cd312f68a11701954fe77b0aa9d5d3
Instruction Fuzzy Hash: F02196303009557BCB053BA5D8558AD7753FF86300B844538F20A8F799DEB16E8E8783

Function 05D9ED10 Relevance: 7.9, Strings: 6, Instructions: 378COMMON

Download Yara Rule

Strings

(__q, xrefs: 05D9ED7A
(__q, xrefs: 05D9EF79
(__q, xrefs: 05D9EEFA
(__q, xrefs: 05D9F0F9
(__q, xrefs: 05D9F07A
(__q, xrefs: 05D9EDF9

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID: (__q$(__q$(__q$(__q$(__q$(__q
API String ID: 0-1985298857
Opcode ID: 993666b00bb80131febc5fed8a8f305dcc885a5d1d415c466f31ba6934addf1b
Instruction ID: 25ddabb9ed04139dd5ec14025ddfe2a4789aec230ee67e3b9db9e0aa2456a493
Opcode Fuzzy Hash: 993666b00bb80131febc5fed8a8f305dcc885a5d1d415c466f31ba6934addf1b
Instruction Fuzzy Hash: E5D1DE75B04304AFCB05EF78D4145AE7BB6FFC6310B6484AAE846DB381DA319E46CB91

Function 05D9D538 Relevance: 7.6, Strings: 6, Instructions: 81COMMON

Download Yara Rule

Strings

Dzj, xrefs: 05D9D554
Dzj, xrefs: 05D9D5C3
Dzj, xrefs: 05D9D5E8
Dzj, xrefs: 05D9D59E
Dzj, xrefs: 05D9D579
Dzj, xrefs: 05D9D60D

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID: Dzj$Dzj$Dzj$Dzj$Dzj$Dzj
API String ID: 0-1686505541
Opcode ID: 59c3c4bd31863e507fd428dda646f3580a52e02cd1ffeae51227f6c9973b23ae
Instruction ID: 9f8240d86bbe17a47be7c15115aca184402f27ccfca417ac4121df552bd1fb11
Opcode Fuzzy Hash: 59c3c4bd31863e507fd428dda646f3580a52e02cd1ffeae51227f6c9973b23ae
Instruction Fuzzy Hash: 9021B530304A047BC3066BB599516A9B793FF87700F904939E2058F78ACFB52E5E4397

Function 05D9D548 Relevance: 7.6, Strings: 6, Instructions: 73COMMON

Download Yara Rule

Strings

Dzj, xrefs: 05D9D554
Dzj, xrefs: 05D9D5C3
Dzj, xrefs: 05D9D5E8
Dzj, xrefs: 05D9D59E
Dzj, xrefs: 05D9D579
Dzj, xrefs: 05D9D60D

Memory Dump Source

Source File: 00000000.00000002.2633178869.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ds1bfe33xg.jbxd

Similarity

API ID:
String ID: Dzj$Dzj$Dzj$Dzj$Dzj$Dzj
API String ID: 0-1686505541
Opcode ID: 69d8093cbdb121e013b3e67073ee7fb296f8f20fac2c8c79ccd00e24ec1d8b32
Instruction ID: e7f297f038413923d573c0bcb3e0c434140d6724509a58b145be89c1dae58bfe
Opcode Fuzzy Hash: 69d8093cbdb121e013b3e67073ee7fb296f8f20fac2c8c79ccd00e24ec1d8b32
Instruction Fuzzy Hash: DF116F31300A147BD30677A99951AAEB657FF86700FD04A28E2054F78ACFB22E5E4397

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ds1bfe33xg.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Desktop\Google Chrome.lnk

C:\Users\user\AppData\Local\Temp\Tmp9AC1.tmp

C:\Users\user\AppData\Local\Temp\Tmp9AD2.tmp

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

Windows Analysis Report
ds1bfe33xg.exe

Function 05D93F50 Relevance: 1.8, Strings: 1, Instructions: 528
COMMON

Function 024AD0A8 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Function 024AD0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 024AAE30 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Function 024A5935 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Function 024A4248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 024AD2F9 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Function 024AD300 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 024AB020 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 05D959D8 Relevance: 1.5, Strings: 1, Instructions: 292
COMMON

Function 05D93DE0 Relevance: 1.4, Strings: 1, Instructions: 113
COMMON

Function 05D9B358 Relevance: 1.3, Strings: 1, Instructions: 40
COMMON