Windows Analysis Report
2E7ZdlxkOL.exe

Overview

General Information

Sample name: 2E7ZdlxkOL.exe
renamed because original name is a hash value
Original sample name: 6320d63025e1764e578680e24906def3.exe
Analysis ID: 1464578
MD5: 6320d63025e1764e578680e24906def3
SHA1: b452cb8f5fe2b5683b8ea94b90c5d3f415e53832
SHA256: d4b22461e379bba07e2e2f6cf1833884c0ff656b84afdd3b2284be856f598ae0
Tags: 32exe
Infos:

Detection

PureLog Stealer, Vidar, zgRAT
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected Powershell download and execute
Yara detected PureLog Stealer
Yara detected Vidar stealer
Yara detected zgRAT
.NET source code contains method to dynamically call methods (often used by packers)
AI detected suspicious sample
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Injects a PE file into a foreign processes
Machine Learning detection for sample
Sample uses string decryption to hide its real strings
Searches for specific processes (likely to inject)
Sigma detected: Silenttrinity Stager Msbuild Activity
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to record screenshots
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Vidar Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar
Name Description Attribution Blogpost URLs Link
zgRAT zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

AV Detection
barindex
Antivirus detection for URL or domain
Source: https://steamcommunity.com/profiles/76561199707802586 Avira URL Cloud: Label: malware
Source: https://t.me/g067n Avira URL Cloud: Label: malware
Found malware configuration
Source: 00000000.00000002.1661322102.000000000465C000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199707802586", "https://t.me/g067n"], "Botnet": "254862acdd5c5d2dddb209d751490c15"}
Multi AV Scanner detection for submitted file
Source: 2E7ZdlxkOL.exe Virustotal: Detection: 16% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: 2E7ZdlxkOL.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: INSERT_KEY_HERE
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GetProcAddress
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: LoadLibraryA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: lstrcatA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: OpenEventA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: CreateEventA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: CloseHandle
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: Sleep
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GetUserDefaultLangID
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: VirtualAllocExNuma
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: VirtualFree
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GetSystemInfo
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: VirtualAlloc
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: HeapAlloc
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GetComputerNameA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: lstrcpyA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GetProcessHeap
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GetCurrentProcess
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: lstrlenA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: ExitProcess
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GlobalMemoryStatusEx
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GetSystemTime
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: SystemTimeToFileTime
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: advapi32.dll
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: gdi32.dll
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: user32.dll
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: crypt32.dll
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: ntdll.dll
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GetUserNameA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: CreateDCA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GetDeviceCaps
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: ReleaseDC
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: CryptStringToBinaryA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: sscanf
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: NtQueryInformationProcess
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: VMwareVMware
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: HAL9TH
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: JohnDoe
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: DISPLAY
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: %hu/%hu/%hu
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GetEnvironmentVariableA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GetFileAttributesA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GlobalLock
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: HeapFree
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GetFileSize
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GlobalSize
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: CreateToolhelp32Snapshot
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: IsWow64Process
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: Process32Next
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GetLocalTime
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: FreeLibrary
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GetTimeZoneInformation
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GetSystemPowerStatus
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GetVolumeInformationA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GetWindowsDirectoryA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: Process32First
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GetLocaleInfoA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GetUserDefaultLocaleName
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GetModuleFileNameA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: DeleteFileA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: FindNextFileA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: LocalFree
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: FindClose
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: SetEnvironmentVariableA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: LocalAlloc
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GetFileSizeEx
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: ReadFile
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: SetFilePointer
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: WriteFile
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: CreateFileA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: FindFirstFileA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: CopyFileA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: VirtualProtect
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GetLastError
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: lstrcpynA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: MultiByteToWideChar
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GlobalFree
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: WideCharToMultiByte
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GlobalAlloc
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: OpenProcess
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: TerminateProcess
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GetCurrentProcessId
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: gdiplus.dll
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: ole32.dll
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: bcrypt.dll
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: wininet.dll
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: shlwapi.dll
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: shell32.dll
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: psapi.dll
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: rstrtmgr.dll
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: CreateCompatibleBitmap
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: SelectObject
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: BitBlt
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: DeleteObject
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: CreateCompatibleDC
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GdipGetImageEncodersSize
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GdipGetImageEncoders
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GdiplusStartup
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GdiplusShutdown
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GdipSaveImageToStream
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GdipDisposeImage
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GdipFree
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GetHGlobalFromStream
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: CreateStreamOnHGlobal
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: CoUninitialize
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: CoInitialize
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: CoCreateInstance
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: BCryptDecrypt
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: BCryptSetProperty
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: BCryptDestroyKey
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GetWindowRect
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GetDesktopWindow
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GetDC
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: CloseWindow
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: wsprintfA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: EnumDisplayDevicesA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GetKeyboardLayoutList
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: CharToOemW
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: wsprintfW
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: RegQueryValueExA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: RegEnumKeyExA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: RegOpenKeyExA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: RegCloseKey
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: RegEnumValueA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: CryptBinaryToStringA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: CryptUnprotectData
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: SHGetFolderPathA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: ShellExecuteExA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: InternetOpenUrlA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: InternetConnectA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: InternetCloseHandle
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: InternetOpenA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: HttpSendRequestA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: HttpOpenRequestA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: InternetReadFile
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: InternetCrackUrlA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: StrCmpCA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: StrStrA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: StrCmpCW
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: PathMatchSpecA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: GetModuleFileNameExA
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: RmStartSession
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: RmRegisterResources
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: RmGetList
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: RmEndSession
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: sqlite3_open
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: sqlite3_prepare_v2
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: sqlite3_step
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: sqlite3_column_text
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: sqlite3_finalize
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: sqlite3_close
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: sqlite3_column_bytes
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: sqlite3_column_blob
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: encrypted_key
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: PATH
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: NSS_Init
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: NSS_Shutdown
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: PK11_GetInternalKeySlot
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: PK11_FreeSlot
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: PK11_Authenticate
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: PK11SDR_Decrypt
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: C:\ProgramData\
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: Soft:
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: profile:
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: Host:
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: Login:
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: Password:
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: Opera
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: OperaGX
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: Network
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: Cookies
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: .txt
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: TRUE
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: FALSE
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: Autofill
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: SELECT name, value FROM autofill
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: History
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: Name:
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: Month:
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: Year:
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: Card:
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: Cookies
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: Login Data
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: Web Data
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: History
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: logins.json
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: formSubmitURL
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: usernameField
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: encryptedUsername
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: encryptedPassword
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: guid
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: cookies.sqlite
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: formhistory.sqlite
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: places.sqlite
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: Plugins
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: Local Extension Settings
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: Sync Extension Settings
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: IndexedDB
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: Opera Stable
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: Opera GX Stable
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: CURRENT
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: chrome-extension_
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: _0.indexeddb.leveldb
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: Local State
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: profiles.ini
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: chrome
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: opera
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: firefox
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: Wallets
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: %08lX%04lX%lu
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: ProductName
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: ProcessorNameString
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: DisplayName
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: DisplayVersion
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: freebl3.dll
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: mozglue.dll
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: msvcp140.dll
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: nss3.dll
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: softokn3.dll
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: vcruntime140.dll
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: \Temp\
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: .exe
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: runas
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: open
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: /c start
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: %DESKTOP%
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: %APPDATA%
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: %LOCALAPPDATA%
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: %USERPROFILE%
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: %DOCUMENTS%
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: %PROGRAMFILES%
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: %PROGRAMFILES_86%
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: %RECENT%
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: *.lnk
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: Files
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: \discord\
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: \Local Storage\leveldb
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: \Telegram Desktop\
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: key_datas
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: D877F783D5D3EF8C*
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: map*
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: A7FDF864FBC10B77*
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: A92DAA6EA6F891F2*
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: F8806DD0C461824F*
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: Telegram
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: *.tox
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: *.ini
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: Password
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: 00000001
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: 00000002
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: 00000003
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: 00000004
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: \Outlook\accounts.txt
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: Pidgin
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: \.purple\
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: accounts.xml
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: dQw4w9WgXcQ
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: token:
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: Software\Valve\Steam
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: SteamPath
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: \config\
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: ssfn*
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: config.vdf
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: DialogConfig.vdf
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: libraryfolders.vdf
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: loginusers.vdf
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: \Steam\
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: sqlite3.dll
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: browsers
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: done
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: Soft
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: \Discord\tokens.txt
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: https
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: POST
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: HTTP/1.1
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: Content-Disposition: form-data; name="
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: hwid
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: build
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: token
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: file_name
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: file
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: message
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack String decryptor: screenshot.jpg
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00407E41 CryptUnprotectData,LocalAlloc,LocalFree, 1_2_00407E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0041302D CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA, 1_2_0041302D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00407DC2 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree, 1_2_00407DC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0040AB80 memset,lstrlenA,CryptStringToBinaryA,memcpy,lstrcatA,lstrcatA,lstrcatA, 1_2_0040AB80
Uses 32bit PE files
Source: 2E7ZdlxkOL.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: 2E7ZdlxkOL.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\uwLSekH.pdb source: 2E7ZdlxkOL.exe, 00000000.00000002.1663654994.0000000005EE3000.00000004.08000000.00040000.00000000.sdmp, 2E7ZdlxkOL.exe, 00000000.00000002.1661322102.0000000004AB7000.00000004.00000800.00020000.00000000.sdmp, 2E7ZdlxkOL.exe, 00000000.00000002.1661322102.000000000476B000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: sharesoft.pdb source: 2E7ZdlxkOL.exe
Source: Binary string: PE.pdbH] source: 2E7ZdlxkOL.exe, 00000000.00000002.1660052063.00000000035F1000.00000004.00000800.00020000.00000000.sdmp, 2E7ZdlxkOL.exe, 00000000.00000002.1663335267.0000000005940000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: PE.pdb source: 2E7ZdlxkOL.exe, 00000000.00000002.1660052063.00000000035F1000.00000004.00000800.00020000.00000000.sdmp, 2E7ZdlxkOL.exe, 00000000.00000002.1663335267.0000000005940000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: MSBuild.exe, 00000001.00000002.2900116919.000000001C339000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2905552991.00000000222A8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00409FC0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 1_2_00409FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00401443 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 1_2_00401443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0040E016 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 1_2_0040E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0040C039 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 1_2_0040C039
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_004164C7 wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcatA,strtok_s,strtok_s,memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,FindNextFileA,FindClose, 1_2_004164C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0040BC98 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, 1_2_0040BC98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00416D7D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose, 1_2_00416D7D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0040D690 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose, 1_2_0040D690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0040C6B5 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA, 1_2_0040C6B5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_004177D3 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 1_2_004177D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0041738D GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA, 1_2_0041738D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_004169EC GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA, 1_2_004169EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h 0_2_061BD0C8

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: https://steamcommunity.com/profiles/76561199707802586
Source: Malware configuration extractor URLs: https://t.me/g067n
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.4:49733 -> 195.201.251.214:9000
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /g067n HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 195.201.251.214 195.201.251.214
Source: Joe Sandbox View IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View IP Address: 149.154.167.99 149.154.167.99
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: TELEGRAMRU TELEGRAMRU
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_004058C4 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,lstrlenA,lstrlenA,GetProcessHeap,HeapAlloc,lstrlenA,memcpy,lstrlenA,lstrlenA,memcpy,lstrlenA,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle, 1_2_004058C4
Source: global traffic HTTP traffic detected: GET /g067n HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic DNS traffic detected: DNS query: t.me
Source: 2E7ZdlxkOL.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: 2E7ZdlxkOL.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 2E7ZdlxkOL.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: 2E7ZdlxkOL.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: 2E7ZdlxkOL.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 2E7ZdlxkOL.exe String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: 2E7ZdlxkOL.exe String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: 2E7ZdlxkOL.exe String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: 2E7ZdlxkOL.exe String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: 2E7ZdlxkOL.exe String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: 2E7ZdlxkOL.exe String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 2E7ZdlxkOL.exe String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: MSBuild.exe, 00000001.00000002.2894948188.0000000001078000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: MSBuild.exe, 00000001.00000002.2894948188.00000000010A8000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.1.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2E7ZdlxkOL.exe String found in binary or memory: http://ocsp.digicert.com0A
Source: 2E7ZdlxkOL.exe String found in binary or memory: http://ocsp.digicert.com0C
Source: 2E7ZdlxkOL.exe String found in binary or memory: http://ocsp.digicert.com0N
Source: 2E7ZdlxkOL.exe String found in binary or memory: http://ocsp.digicert.com0X
Source: 2E7ZdlxkOL.exe String found in binary or memory: http://www.digicert.com/CPS0
Source: MSBuild.exe, 00000001.00000002.2900116919.000000001C339000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2905756495.00000000222DD000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: MSBuild.exe, 00000001.00000002.2894948188.00000000010CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214/
Source: MSBuild.exe, 00000001.00000002.2894948188.00000000010CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214/j.
Source: MSBuild.exe, 00000001.00000002.2893345551.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000
Source: MSBuild.exe, 00000001.00000002.2895536190.000000000113C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2893345551.0000000000445000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2894948188.00000000010CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/
Source: MSBuild.exe, 00000001.00000002.2894948188.0000000001078000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/;jj
Source: MSBuild.exe, 00000001.00000002.2894948188.00000000010EE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/Mac
Source: MSBuild.exe, 00000001.00000002.2894948188.0000000001078000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/Rk
Source: MSBuild.exe, 00000001.00000002.2894948188.00000000010CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/al
Source: MSBuild.exe, 00000001.00000002.2893345551.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/c3osoft
Source: MSBuild.exe, 00000001.00000002.2894948188.00000000010A8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2893345551.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/freebl3.dll
Source: MSBuild.exe, 00000001.00000002.2894948188.00000000010A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/freebl3.dll;
Source: MSBuild.exe, 00000001.00000002.2893345551.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/freebl3.dllge
Source: MSBuild.exe, 00000001.00000002.2895536190.000000000113C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/h
Source: MSBuild.exe, 00000001.00000002.2893345551.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/icrosoft
Source: MSBuild.exe, 00000001.00000002.2894948188.00000000010CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/ivaldi
Source: MSBuild.exe, 00000001.00000002.2894948188.00000000010A8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2893345551.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/mozglue.dll
Source: MSBuild.exe, 00000001.00000002.2894948188.00000000010A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/mozglue.dllK
Source: MSBuild.exe, 00000001.00000002.2893345551.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/mozglue.dllge
Source: MSBuild.exe, 00000001.00000002.2895536190.0000000001146000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/msvcp140.dll
Source: MSBuild.exe, 00000001.00000002.2894948188.00000000010A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/msvcp140.dllc
Source: MSBuild.exe, 00000001.00000002.2893345551.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/msvcp140.dlle
Source: MSBuild.exe, 00000001.00000002.2893345551.0000000000445000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2894948188.00000000010CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/nss3.dll
Source: MSBuild.exe, 00000001.00000002.2894948188.00000000010EE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/nss3.dllM
Source: MSBuild.exe, 00000001.00000002.2894948188.00000000010A8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2893345551.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/softokn3.dll
Source: MSBuild.exe, 00000001.00000002.2894948188.0000000001078000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/softokn3.dll7i
Source: MSBuild.exe, 00000001.00000002.2893345551.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/softokn3.dlle
Source: MSBuild.exe, 00000001.00000002.2894948188.00000000010A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/sqlt.dll
Source: MSBuild.exe, 00000001.00000002.2894948188.00000000010A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/sqlt.dll9
Source: MSBuild.exe, 00000001.00000002.2893345551.0000000000539000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2893345551.0000000000445000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2894948188.00000000010CE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2895536190.0000000001146000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/vcruntime140.dll
Source: MSBuild.exe, 00000001.00000002.2894948188.00000000010CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/vcruntime140.dllN$8
Source: MSBuild.exe, 00000001.00000002.2895536190.0000000001146000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/vcruntime140.dllU
Source: MSBuild.exe, 00000001.00000002.2893345551.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/vcruntime140.dller
Source: MSBuild.exe, 00000001.00000002.2893345551.0000000000539000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/vcruntime140.dllrv:129.0)
Source: MSBuild.exe, 00000001.00000002.2895536190.0000000001146000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/vcruntime140.dllz
Source: MSBuild.exe, 00000001.00000002.2895536190.000000000113C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2894948188.00000000010CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/y
Source: MSBuild.exe, 00000001.00000002.2893345551.0000000000539000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2893345551.00000000005C8000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:90007c3le
Source: MSBuild.exe, 00000001.00000002.2893345551.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000Microsoft
Source: MSBuild.exe, 00000001.00000002.2893345551.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000g
Source: MSBuild.exe, 00000001.00000002.2893345551.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000ontent-Disposition:
Source: JKEHII.1.dr String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: JKEHII.1.dr String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: JKEHII.1.dr String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: JKEHII.1.dr String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: JKEHII.1.dr String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: JKEHII.1.dr String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: JKEHII.1.dr String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 2E7ZdlxkOL.exe String found in binary or memory: https://github.com/mullvad/mullvadvpn-app#readme0
Source: 2E7ZdlxkOL.exe, 00000000.00000002.1661322102.000000000465C000.00000004.00000800.00020000.00000000.sdmp, 2E7ZdlxkOL.exe, 00000000.00000002.1661322102.0000000004BE2000.00000004.00000800.00020000.00000000.sdmp, 2E7ZdlxkOL.exe, 00000000.00000002.1660052063.0000000003773000.00000004.00000800.00020000.00000000.sdmp, 2E7ZdlxkOL.exe, 00000000.00000002.1661322102.00000000045F4000.00000004.00000800.00020000.00000000.sdmp, 2E7ZdlxkOL.exe, 00000000.00000002.1661322102.0000000004C16000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, MSBuild.exe, 00000001.00000002.2893345551.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199707802586
Source: 2E7ZdlxkOL.exe, 00000000.00000002.1661322102.000000000465C000.00000004.00000800.00020000.00000000.sdmp, 2E7ZdlxkOL.exe, 00000000.00000002.1661322102.0000000004BE2000.00000004.00000800.00020000.00000000.sdmp, 2E7ZdlxkOL.exe, 00000000.00000002.1660052063.0000000003773000.00000004.00000800.00020000.00000000.sdmp, 2E7ZdlxkOL.exe, 00000000.00000002.1661322102.00000000045F4000.00000004.00000800.00020000.00000000.sdmp, 2E7ZdlxkOL.exe, 00000000.00000002.1661322102.0000000004C16000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2893345551.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199707802586hellosqlt.dllsqlite3.dll
Source: MSBuild.exe, 00000001.00000002.2899808496.00000000197AD000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2893345551.0000000000445000.00000040.00000400.00020000.00000000.sdmp, FCBFBG.1.dr String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: FCBFBG.1.dr String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: MSBuild.exe, 00000001.00000002.2893345551.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe
Source: MSBuild.exe, 00000001.00000002.2899808496.00000000197AD000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2893345551.0000000000445000.00000040.00000400.00020000.00000000.sdmp, FCBFBG.1.dr String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: FCBFBG.1.dr String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: MSBuild.exe, 00000001.00000002.2893345551.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe
Source: MSBuild.exe, 00000001.00000002.2894948188.0000000001078000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/
Source: MSBuild.exe, 00000001.00000002.2894948188.0000000001078000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me//
Source: 2E7ZdlxkOL.exe, 00000000.00000002.1661322102.000000000465C000.00000004.00000800.00020000.00000000.sdmp, 2E7ZdlxkOL.exe, 00000000.00000002.1661322102.0000000004BE2000.00000004.00000800.00020000.00000000.sdmp, 2E7ZdlxkOL.exe, 00000000.00000002.1660052063.0000000003773000.00000004.00000800.00020000.00000000.sdmp, 2E7ZdlxkOL.exe, 00000000.00000002.1661322102.00000000045F4000.00000004.00000800.00020000.00000000.sdmp, 2E7ZdlxkOL.exe, 00000000.00000002.1661322102.0000000004C16000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, MSBuild.exe, 00000001.00000002.2894948188.0000000001038000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2893345551.0000000000400000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2894948188.0000000001078000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2893345551.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://t.me/g067n
Source: MSBuild.exe, 00000001.00000002.2894948188.0000000001078000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/g067n8
Source: 2E7ZdlxkOL.exe, 00000000.00000002.1661322102.000000000465C000.00000004.00000800.00020000.00000000.sdmp, 2E7ZdlxkOL.exe, 00000000.00000002.1661322102.0000000004BE2000.00000004.00000800.00020000.00000000.sdmp, 2E7ZdlxkOL.exe, 00000000.00000002.1660052063.0000000003773000.00000004.00000800.00020000.00000000.sdmp, 2E7ZdlxkOL.exe, 00000000.00000002.1661322102.00000000045F4000.00000004.00000800.00020000.00000000.sdmp, 2E7ZdlxkOL.exe, 00000000.00000002.1661322102.0000000004C16000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2893345551.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://t.me/g067nry1neMozilla/5.0
Source: MSBuild.exe, 00000001.00000002.2894948188.0000000001078000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://web.telegram.org
Source: 2E7ZdlxkOL.exe String found in binary or memory: https://www.digicert.com/CPS0
Source: JKEHII.1.dr String found in binary or memory: https://www.ecosia.org/newtab/
Source: JKEHII.1.dr String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49732 version: TLS 1.2
Contains functionality to record screenshots
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00413160 memset,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GlobalFix,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow, 1_2_00413160

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 2E7ZdlxkOL.exe, type: SAMPLE Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.0.2E7ZdlxkOL.exe.be0000.0.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Detected potential crypto function
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Code function: 0_2_01B0EFB8 0_2_01B0EFB8
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Code function: 0_2_01B09E48 0_2_01B09E48
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Code function: 0_2_05999CB8 0_2_05999CB8
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Code function: 0_2_05990006 0_2_05990006
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Code function: 0_2_05990040 0_2_05990040
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Code function: 0_2_05995ADF 0_2_05995ADF
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Code function: 0_2_059D36F0 0_2_059D36F0
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Code function: 0_2_059DC070 0_2_059DC070
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Code function: 0_2_059D8BF8 0_2_059D8BF8
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Code function: 0_2_059D4F28 0_2_059D4F28
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Code function: 0_2_059D36E1 0_2_059D36E1
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Code function: 0_2_059DFB60 0_2_059DFB60
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Code function: 0_2_061B1B10 0_2_061B1B10
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Code function: 0_2_061B3036 0_2_061B3036
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0041ECEC 1_2_0041ECEC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0041E919 1_2_0041E919
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0041EEC1 1_2_0041EEC1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0041F6CF 1_2_0041F6CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_220A4CF0 1_2_220A4CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_2211A0B0 1_2_2211A0B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_2209209F 1_2_2209209F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_220A66C0 1_2_220A66C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_220947AF 1_2_220947AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_220BA560 1_2_220BA560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_2218A590 1_2_2218A590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_2209AA40 1_2_2209AA40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_2209EA80 1_2_2209EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_221CE800 1_2_221CE800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_22093E3B 1_2_22093E3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_2209481D 1_2_2209481D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_221AA900 1_2_221AA900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_2218A940 1_2_2218A940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_221769C0 1_2_221769C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_220D6E80 1_2_220D6E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_2226AEBE 1_2_2226AEBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_220F2EE0 1_2_220F2EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_220919DD 1_2_220919DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_220C3370 1_2_220C3370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_2209F160 1_2_2209F160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_2209174E 1_2_2209174E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_220BBAB0 1_2_220BBAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_2209251D 1_2_2209251D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_2209290A 1_2_2209290A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_22093AB2 1_2_22093AB2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_221B8030 1_2_221B8030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_22110090 1_2_22110090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_22118120 1_2_22118120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_220B8680 1_2_220B8680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_220B8763 1_2_220B8763
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_220F4760 1_2_220F4760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_22128760 1_2_22128760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_221D0480 1_2_221D0480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_22194A60 1_2_22194A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_22091EF1 1_2_22091EF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_220B8D2A 1_2_220B8D2A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_2226D209 1_2_2226D209
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_221253B0 1_2_221253B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_22093580 1_2_22093580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_220A9000 1_2_220A9000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_221B5040 1_2_221B5040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_22139690 1_2_22139690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_2214D6D0 1_2_2214D6D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_221F9430 1_2_221F9430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_22092018 1_2_22092018
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_221B9A20 1_2_221B9A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_22091C9E 1_2_22091C9E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_22145940 1_2_22145940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_22092AA9 1_2_22092AA9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_220912A8 1_2_220912A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_2209292D 1_2_2209292D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_221F9CC0 1_2_221F9CC0
Found potential string decryption / allocating functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: String function: 00404239 appears 287 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: String function: 2209395E appears 78 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: String function: 22093AF3 appears 37 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: String function: 22091F5A appears 31 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: String function: 2209415B appears 133 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: String function: 222706B1 appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: String function: 22091C2B appears 47 times
PE / OLE file has an invalid certificate
Source: 2E7ZdlxkOL.exe Static PE information: invalid certificate
Sample file is different than original file name gathered from version info
Source: 2E7ZdlxkOL.exe, 00000000.00000002.1660052063.00000000036FC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclrjit.dllT vs 2E7ZdlxkOL.exe
Source: 2E7ZdlxkOL.exe, 00000000.00000002.1660052063.00000000036FC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename vs 2E7ZdlxkOL.exe
Source: 2E7ZdlxkOL.exe, 00000000.00000002.1660052063.00000000036FC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: $^q,\\StringFileInfo\\040904B0\\OriginalFilename vs 2E7ZdlxkOL.exe
Source: 2E7ZdlxkOL.exe, 00000000.00000002.1660052063.00000000035F1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamePE.dll& vs 2E7ZdlxkOL.exe
Source: 2E7ZdlxkOL.exe, 00000000.00000002.1663335267.0000000005940000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenamePE.dll& vs 2E7ZdlxkOL.exe
Source: 2E7ZdlxkOL.exe, 00000000.00000002.1663654994.0000000005EE3000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameuwLSekH.dll0 vs 2E7ZdlxkOL.exe
Source: 2E7ZdlxkOL.exe, 00000000.00000000.1654488937.0000000001081000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamesharesoft.exe$ vs 2E7ZdlxkOL.exe
Source: 2E7ZdlxkOL.exe, 00000000.00000002.1661322102.0000000004AB7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameuwLSekH.dll0 vs 2E7ZdlxkOL.exe
Source: 2E7ZdlxkOL.exe, 00000000.00000002.1659207761.000000000186E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs 2E7ZdlxkOL.exe
Source: 2E7ZdlxkOL.exe, 00000000.00000002.1661322102.000000000476B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameuwLSekH.dll0 vs 2E7ZdlxkOL.exe
Source: 2E7ZdlxkOL.exe Binary or memory string: OriginalFilenamesharesoft.exe$ vs 2E7ZdlxkOL.exe
Uses 32bit PE files
Source: 2E7ZdlxkOL.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Yara signature match
Source: 2E7ZdlxkOL.exe, type: SAMPLE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.0.2E7ZdlxkOL.exe.be0000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.2E7ZdlxkOL.exe.5940000.13.raw.unpack, fDX9tehJ5EFemhKZwc.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.2E7ZdlxkOL.exe.5940000.13.raw.unpack, fDX9tehJ5EFemhKZwc.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.2E7ZdlxkOL.exe.366ba4c.0.raw.unpack, fDX9tehJ5EFemhKZwc.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.2E7ZdlxkOL.exe.366ba4c.0.raw.unpack, fDX9tehJ5EFemhKZwc.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.2E7ZdlxkOL.exe.3657024.2.raw.unpack, fDX9tehJ5EFemhKZwc.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.2E7ZdlxkOL.exe.3657024.2.raw.unpack, fDX9tehJ5EFemhKZwc.cs Cryptographic APIs: 'CreateDecryptor'
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@3/11@1/2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0041246A CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle, 1_2_0041246A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_004129BF CoInitializeEx,CoInitializeSecurity,CoCreateInstance,CoSetProxyBlanket,VariantInit,VariantClear, 1_2_004129BF
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2E7ZdlxkOL.exe.log Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Mutant created: NULL
Source: 2E7ZdlxkOL.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 2E7ZdlxkOL.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: MSBuild.exe, 00000001.00000002.2900116919.000000001C339000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2905552991.00000000222A8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: MSBuild.exe, 00000001.00000002.2894948188.0000000001030000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cardss*;B
Source: MSBuild.exe, 00000001.00000002.2900116919.000000001C339000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2905552991.00000000222A8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: MSBuild.exe, MSBuild.exe, 00000001.00000002.2900116919.000000001C339000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2905552991.00000000222A8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: MSBuild.exe, 00000001.00000002.2900116919.000000001C339000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2905552991.00000000222A8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: MSBuild.exe, MSBuild.exe, 00000001.00000002.2900116919.000000001C339000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2905552991.00000000222A8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: MSBuild.exe, 00000001.00000002.2900116919.000000001C339000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2905552991.00000000222A8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: MSBuild.exe, 00000001.00000002.2900116919.000000001C339000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2905552991.00000000222A8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: MSBuild.exe, 00000001.00000002.2900116919.000000001C339000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2905552991.00000000222A8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: MSBuild.exe, 00000001.00000002.2900116919.000000001C339000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2905552991.00000000222A8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: GIJECG.1.dr Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: MSBuild.exe, MSBuild.exe, 00000001.00000002.2900116919.000000001C339000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2905552991.00000000222A8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: MSBuild.exe, 00000001.00000002.2900116919.000000001C339000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2905552991.00000000222A8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: 2E7ZdlxkOL.exe Virustotal: Detection: 16%
Source: unknown Process created: C:\Users\user\Desktop\2E7ZdlxkOL.exe "C:\Users\user\Desktop\2E7ZdlxkOL.exe"
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Section loaded: mscorjit.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: cryptnet.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: 2E7ZdlxkOL.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: 2E7ZdlxkOL.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: 2E7ZdlxkOL.exe Static file information: File size 4954328 > 1048576
Source: 2E7ZdlxkOL.exe Static PE information: Raw size of .text is bigger than: 0x100000 < 0x498e00
Source: 2E7ZdlxkOL.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: 2E7ZdlxkOL.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\uwLSekH.pdb source: 2E7ZdlxkOL.exe, 00000000.00000002.1663654994.0000000005EE3000.00000004.08000000.00040000.00000000.sdmp, 2E7ZdlxkOL.exe, 00000000.00000002.1661322102.0000000004AB7000.00000004.00000800.00020000.00000000.sdmp, 2E7ZdlxkOL.exe, 00000000.00000002.1661322102.000000000476B000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: sharesoft.pdb source: 2E7ZdlxkOL.exe
Source: Binary string: PE.pdbH] source: 2E7ZdlxkOL.exe, 00000000.00000002.1660052063.00000000035F1000.00000004.00000800.00020000.00000000.sdmp, 2E7ZdlxkOL.exe, 00000000.00000002.1663335267.0000000005940000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: PE.pdb source: 2E7ZdlxkOL.exe, 00000000.00000002.1660052063.00000000035F1000.00000004.00000800.00020000.00000000.sdmp, 2E7ZdlxkOL.exe, 00000000.00000002.1663335267.0000000005940000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: MSBuild.exe, 00000001.00000002.2900116919.000000001C339000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2905552991.00000000222A8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: 0.2.2E7ZdlxkOL.exe.5940000.13.raw.unpack, fDX9tehJ5EFemhKZwc.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 0.2.2E7ZdlxkOL.exe.366ba4c.0.raw.unpack, fDX9tehJ5EFemhKZwc.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 0.2.2E7ZdlxkOL.exe.3657024.2.raw.unpack, fDX9tehJ5EFemhKZwc.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Contains functionality to dynamically determine API calls
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0041B050 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 1_2_0041B050
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Code function: 0_2_01B04B7E push es; ret 0_2_01B04B81
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Code function: 0_2_05990526 push ss; ret 0_2_05990527
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Code function: 0_2_0599449F pushfd ; retf 0_2_059944A0
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Code function: 0_2_05992BEB pushad ; retf 0_2_05992BEC
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Code function: 0_2_05993707 pushad ; retf 0_2_05993708
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00421EF5 push ecx; ret 1_2_00421F08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_220910C8 push ecx; ret 1_2_22293552
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_22091BF9 push ecx; ret 1_2_22234C03
Source: 0.2.2E7ZdlxkOL.exe.5940000.13.raw.unpack, fDX9tehJ5EFemhKZwc.cs High entropy of concatenated method names: 'ce4DmfsmSrOT856tDgfrkMb', 'NvQOxwsIFR', 'QsUuklFoHUiQD', 'MCRoDX9te', 'l5EbFemhK', 'uwcnnhQXJ', 'J3PigtLyh', 'PwdNpFGeB', 'XCj67ZIOy', 'w09DYCs5D'
Source: 0.2.2E7ZdlxkOL.exe.5940000.13.raw.unpack, zcrmeG4DKc05Qj8A7l.cs High entropy of concatenated method names: 'Ys7O1WDVbX', 'EIxO3RK2jf', 'ov3OzJmFFU', 'KJS0ILfinW', 'Gtt0O5H9rf', 'Gvj00KAYqN', 'hUG0r1tocH', 'PBb0lrpBsM', 'pGy05VOh0y', 'j3M0RfBB5l'
Source: 0.2.2E7ZdlxkOL.exe.366ba4c.0.raw.unpack, fDX9tehJ5EFemhKZwc.cs High entropy of concatenated method names: 'ce4DmfsmSrOT856tDgfrkMb', 'NvQOxwsIFR', 'QsUuklFoHUiQD', 'MCRoDX9te', 'l5EbFemhK', 'uwcnnhQXJ', 'J3PigtLyh', 'PwdNpFGeB', 'XCj67ZIOy', 'w09DYCs5D'
Source: 0.2.2E7ZdlxkOL.exe.366ba4c.0.raw.unpack, zcrmeG4DKc05Qj8A7l.cs High entropy of concatenated method names: 'Ys7O1WDVbX', 'EIxO3RK2jf', 'ov3OzJmFFU', 'KJS0ILfinW', 'Gtt0O5H9rf', 'Gvj00KAYqN', 'hUG0r1tocH', 'PBb0lrpBsM', 'pGy05VOh0y', 'j3M0RfBB5l'
Source: 0.2.2E7ZdlxkOL.exe.3657024.2.raw.unpack, fDX9tehJ5EFemhKZwc.cs High entropy of concatenated method names: 'ce4DmfsmSrOT856tDgfrkMb', 'NvQOxwsIFR', 'QsUuklFoHUiQD', 'MCRoDX9te', 'l5EbFemhK', 'uwcnnhQXJ', 'J3PigtLyh', 'PwdNpFGeB', 'XCj67ZIOy', 'w09DYCs5D'
Source: 0.2.2E7ZdlxkOL.exe.3657024.2.raw.unpack, zcrmeG4DKc05Qj8A7l.cs High entropy of concatenated method names: 'Ys7O1WDVbX', 'EIxO3RK2jf', 'ov3OzJmFFU', 'KJS0ILfinW', 'Gtt0O5H9rf', 'Gvj00KAYqN', 'hUG0r1tocH', 'PBb0lrpBsM', 'pGy05VOh0y', 'j3M0RfBB5l'
Drops PE files
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sqlt[1].dll Jump to dropped file
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0041B050 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 1_2_0041B050
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: 2E7ZdlxkOL.exe PID: 6520, type: MEMORYSTR
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Memory allocated: 1B00000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Memory allocated: 35F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Memory allocated: 32C0000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sqlt[1].dll Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe TID: 6560 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00409FC0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 1_2_00409FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00401443 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 1_2_00401443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0040E016 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 1_2_0040E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0040C039 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 1_2_0040C039
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_004164C7 wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcatA,strtok_s,strtok_s,memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,FindNextFileA,FindClose, 1_2_004164C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0040BC98 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, 1_2_0040BC98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00416D7D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose, 1_2_00416D7D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0040D690 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose, 1_2_0040D690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0040C6B5 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA, 1_2_0040C6B5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_004177D3 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 1_2_004177D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0041738D GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA, 1_2_0041738D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_004169EC GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA, 1_2_004169EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00411F21 GetSystemInfo,wsprintfA, 1_2_00411F21
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Source: MSBuild.exe, 00000001.00000002.2894948188.0000000001038000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: MSBuild.exe, 00000001.00000002.2894948188.0000000001038000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2894948188.0000000001093000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00421C0B memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 1_2_00421C0B
Contains functionality to dynamically determine API calls
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0041B050 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 1_2_0041B050
Contains functionality to read the PEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0041ACF3 mov eax, dword ptr fs:[00000030h] 1_2_0041ACF3
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_004058C4 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,lstrlenA,lstrlenA,GetProcessHeap,HeapAlloc,lstrlenA,memcpy,lstrlenA,lstrlenA,memcpy,lstrlenA,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle, 1_2_004058C4
Enables debug privileges
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00421C0B memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 1_2_00421C0B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00423DCD SetUnhandledExceptionFilter, 1_2_00423DCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0042224F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 1_2_0042224F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_220942AF SetUnhandledExceptionFilter, 1_2_220942AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_22092C8E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 1_2_22092C8E
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: 2E7ZdlxkOL.exe PID: 6520, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MSBuild.exe PID: 6624, type: MEMORYSTR
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write Jump to behavior
Contains functionality to inject code into remote processes
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00410A14 memset,memset,CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,VirtualAllocEx,ResumeThread,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread, 1_2_00410A14
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A Jump to behavior
Searches for specific processes (likely to inject)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_004138BA CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,FindCloseChangeNotification, 1_2_004138BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_004137BD CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle, 1_2_004137BD
Writes to foreign memory regions
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000 Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 425000 Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 42E000 Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 643000 Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: B24008 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" Jump to behavior
Contains functionality to query CPU information (cpuid)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00401000 cpuid 1_2_00401000
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree, 1_2_00411D31
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: EnumSystemLocalesW, 1_2_22282CB6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: EnumSystemLocalesW, 1_2_22282D38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: EnumSystemLocalesW, 1_2_22282DF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 1_2_22283300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 1_2_22093AA3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: EnumSystemLocalesW, 1_2_2226FF17
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: GetLocaleInfoW, 1_2_22092112
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: GetLocaleInfoW, 1_2_22092112
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Queries volume information: C:\Users\user\Desktop\2E7ZdlxkOL.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00411C63 GetProcessHeap,HeapAlloc,GetLocalTime,wsprintfA, 1_2_00411C63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00411BEC GetProcessHeap,HeapAlloc,GetUserNameA, 1_2_00411BEC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00411CBF GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA, 1_2_00411CBF
Source: C:\Users\user\Desktop\2E7ZdlxkOL.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: MSBuild.exe, 00000001.00000002.2894948188.00000000010EE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected PureLog Stealer
Source: Yara match File source: 2E7ZdlxkOL.exe, type: SAMPLE
Source: Yara match File source: 0.0.2E7ZdlxkOL.exe.be0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000000.1653989209.0000000000BE2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Yara detected Vidar stealer
Source: Yara match File source: 0.2.2E7ZdlxkOL.exe.4c16540.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.2E7ZdlxkOL.exe.4c16540.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.2E7ZdlxkOL.exe.465cdf0.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.2E7ZdlxkOL.exe.46293c0.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.2E7ZdlxkOL.exe.465cdf0.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.2E7ZdlxkOL.exe.46293c0.12.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.1661322102.000000000465C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.2893345551.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1660052063.0000000003773000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1661322102.00000000045F4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1661322102.0000000004BE2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1661322102.0000000004C16000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.2893345551.0000000000445000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 2E7ZdlxkOL.exe PID: 6520, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MSBuild.exe PID: 6624, type: MEMORYSTR
Yara detected zgRAT
Source: Yara match File source: 2E7ZdlxkOL.exe, type: SAMPLE
Source: Yara match File source: 0.0.2E7ZdlxkOL.exe.be0000.0.unpack, type: UNPACKEDPE
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: Process Memory Space: MSBuild.exe PID: 6624, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected PureLog Stealer
Source: Yara match File source: 2E7ZdlxkOL.exe, type: SAMPLE
Source: Yara match File source: 0.0.2E7ZdlxkOL.exe.be0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000000.1653989209.0000000000BE2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Yara detected Vidar stealer
Source: Yara match File source: 0.2.2E7ZdlxkOL.exe.4c16540.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.2E7ZdlxkOL.exe.4c16540.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.2E7ZdlxkOL.exe.4be2b10.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.2E7ZdlxkOL.exe.465cdf0.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.2E7ZdlxkOL.exe.46293c0.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.2E7ZdlxkOL.exe.465cdf0.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.2E7ZdlxkOL.exe.46293c0.12.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.1661322102.000000000465C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.2893345551.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1660052063.0000000003773000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1661322102.00000000045F4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1661322102.0000000004BE2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1661322102.0000000004C16000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.2893345551.0000000000445000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 2E7ZdlxkOL.exe PID: 6520, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MSBuild.exe PID: 6624, type: MEMORYSTR
Yara detected zgRAT
Source: Yara match File source: 2E7ZdlxkOL.exe, type: SAMPLE
Source: Yara match File source: 0.0.2E7ZdlxkOL.exe.be0000.0.unpack, type: UNPACKEDPE
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_220FE200 sqlite3_initialize,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset, 1_2_220FE200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_220FE090 sqlite3_bind_int64,sqlite3_bind_value,sqlite3_step,sqlite3_reset, 1_2_220FE090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_2210E170 sqlite3_bind_int64,sqlite3_step,sqlite3_reset, 1_2_2210E170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_220A66C0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_null,sqlite3_bind_blob,sqlite3_bind_value,sqlite3_free,sqlite3_bind_value,sqlite3_step,sqlite3_reset, 1_2_220A66C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_2210A6F0 sqlite3_mprintf,sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value, 1_2_2210A6F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_220EEF30 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_result_error_code, 1_2_220EEF30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_22153770 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset, 1_2_22153770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_221737E0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset, 1_2_221737E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_220BB400 sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,sqlite3_reset,sqlite3_step,sqlite3_reset,sqlite3_column_int64, 1_2_220BB400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_22108200 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset, 1_2_22108200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_220B8680 sqlite3_mprintf,sqlite3_mprintf,sqlite3_initialize,sqlite3_finalize,sqlite3_free,sqlite3_mprintf,sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_int64, 1_2_220B8680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_220E06E0 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset, 1_2_220E06E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_220E8550 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset, 1_2_220E8550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_220A4820 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,sqlite3_initialize, 1_2_220A4820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_220C0FB0 sqlite3_result_int64,sqlite3_result_double,sqlite3_result_int,sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset, 1_2_220C0FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_22174D40 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,InitOnceBeginInitialize,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free, 1_2_22174D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_2214D3B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset, 1_2_2214D3B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_22129090 sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_errmsg,sqlite3_mprintf, 1_2_22129090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_221351D0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset, 1_2_221351D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_2216D610 sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset, 1_2_2216D610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_221B14D0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log, 1_2_221B14D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_221BD4F0 sqlite3_bind_value,sqlite3_log,sqlite3_log,sqlite3_log, 1_2_221BD4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_221355B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset, 1_2_221355B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_2210DB10 sqlite3_initialize,sqlite3_bind_int64,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free, 1_2_2210DB10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_22135910 sqlite3_mprintf,sqlite3_bind_int64, 1_2_22135910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_221BD9E0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log, 1_2_221BD9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_2210DFC0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_mprintf,sqlite3_bind_text,sqlite3_step,sqlite3_reset, 1_2_2210DFC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_22111FE0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset, 1_2_22111FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_220A5C70 sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset, 1_2_220A5C70
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1464578 Sample: 2E7ZdlxkOL.exe Startdate: 29/06/2024 Architecture: WINDOWS Score: 100 20 t.me 2->20 22 fp2e7a.wpc.phicdn.net 2->22 24 fp2e7a.wpc.2be4.phicdn.net 2->24 30 Found malware configuration 2->30 32 Malicious sample detected (through community Yara rule) 2->32 34 Antivirus detection for URL or domain 2->34 36 12 other signatures 2->36 7 2E7ZdlxkOL.exe 3 2->7         started        signatures3 process4 file5 16 C:\Users\user\AppData\...\2E7ZdlxkOL.exe.log, ASCII 7->16 dropped 38 Writes to foreign memory regions 7->38 40 Allocates memory in foreign processes 7->40 42 Injects a PE file into a foreign processes 7->42 11 MSBuild.exe 28 7->11         started        signatures6 process7 dnsIp8 26 t.me 149.154.167.99, 443, 49732 TELEGRAMRU United Kingdom 11->26 28 195.201.251.214, 49733, 49735, 49736 HETZNER-ASDE Germany 11->28 18 C:\Users\user\AppData\Local\...\sqlt[1].dll, PE32 11->18 dropped 44 Contains functionality to inject code into remote processes 11->44 46 Tries to harvest and steal browser information (history, passwords, etc) 11->46 48 Searches for specific processes (likely to inject) 11->48 file9 signatures10
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
195.201.251.214
 unknown Germany
24940 HETZNER-ASDE false
149.154.167.99
 t.me United Kingdom
62041 TELEGRAMRU true

Contacted Domains

Name IP Active
t.me 149.154.167.99 true
fp2e7a.wpc.phicdn.net 192.229.221.95 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://steamcommunity.com/profiles/76561199707802586 true
  • Avira URL Cloud: malware
 unknown
https://t.me/g067n true
  • Avira URL Cloud: malware
 unknown