Edit tour

Windows Analysis Report
xFk6x2mrd7.exe

Overview

General Information

Sample name:	xFk6x2mrd7.exe renamed because original name is a hash value
Original sample name:	18fd0471029adc5a608cc7c442a97f3a.exe
Analysis ID:	1464974
MD5:	18fd0471029adc5a608cc7c442a97f3a
SHA1:	74854bda1aa3e60c3b6f58e8f77882ac7f958486
SHA256:	1e92e176dd94bb165b9ac9a391ed84ad473ae69a44139d2f9765dd56974cee0d
Tags:	exeRedLineStealer
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected RedLine Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

PE file has nameless sections

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Silenttrinity Stager Msbuild Activity

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

xFk6x2mrd7.exe (PID: 6576 cmdline: "C:\Users\user\Desktop\xFk6x2mrd7.exe" MD5: 18FD0471029ADC5A608CC7C442A97F3A)

conhost.exe (PID: 6596 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MSBuild.exe (PID: 6812 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": "94.228.166.68:80", "Bot Id": "@MarsSellers12", "Message": "Click Close to exit the program. Error code: 1142", "Authorization Header": "e0c4915670bce95535bec15e4bb6341a"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1680080069.000000006CC1E000.00000004.00000001.01000000.00000007.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.1778307837.0000000000192000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: xFk6x2mrd7.exe PID: 6576	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 6812	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 6812	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.xFk6x2mrd7.exe.6cc1e000.5.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2.2.MSBuild.exe.190000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.xFk6x2mrd7.exe.6cc00000.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.xFk6x2mrd7.exe.6cc1e000.5.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 94.228.166.68, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 6812, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Snort Signatures

ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.4 - Destination IP: 94.228.166.68

Timestamp:	07/01/24-03:11:58.328714
SID:	2046045
Source Port:	49731
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 94.228.166.68 - Destination IP: 192.168.2.4

Timestamp:	07/01/24-03:11:58.539624
SID:	2043234
Source Port:	80
Destination Port:	49731
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 94.228.166.68

Timestamp:	07/01/24-03:12:07.139354
SID:	2043231
Source Port:	49731
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: xFk6x2mrd7.exe

Avira: detected

Found malware configuration

Source: 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": "94.228.166.68:80", "Bot Id": "@MarsSellers12", "Message": "Click Close to exit the program. Error code: 1142", "Authorization Header": "e0c4915670bce95535bec15e4bb6341a"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\d3d9.dll

ReversingLabs: Detection: 52%

Multi AV Scanner detection for submitted file

Source: xFk6x2mrd7.exe

ReversingLabs: Detection: 79%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\d3d9.dll

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: xFk6x2mrd7.exe

Joe Sandbox ML: detected

Source: xFk6x2mrd7.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: xFk6x2mrd7.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 0599F6D7h	2_2_0599EF68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then inc dword ptr [ebp-20h]	2_2_059939C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 0599DEBAh	2_2_0599DA87
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 0599E33Ah	2_2_0599DA87
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then inc dword ptr [ebp-20h]	2_2_05993C92
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then inc dword ptr [ebp-20h]	2_2_05993CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 0599B9E5h	2_2_0599B618
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 0599B9E5h	2_2_0599B609
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 0599A953h	2_2_0599A93B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 0599D09Dh	2_2_0599D07C

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) 192.168.2.4:49731 -> 94.228.166.68:80
Source: Traffic	Snort IDS: 2043231 ET TROJAN Redline Stealer TCP CnC Activity 192.168.2.4:49731 -> 94.228.166.68:80
Source: Traffic	Snort IDS: 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response 94.228.166.68:80 -> 192.168.2.4:49731

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 94.228.166.68:80

Source: Joe Sandbox View

ASN Name: PRANET-ASRU PRANET-ASRU

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68
Source: unknown	TCP traffic detected without corresponding DNS query: 94.228.166.68

Source: global traffic

DNS traffic detected: DNS query: api.ip.sb

Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002621000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002621000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002621000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3ResponseD
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002B23000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1781979509.0000000002AC3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1781979509.0000000002B59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb
Source: xFk6x2mrd7.exe, xFk6x2mrd7.exe, 00000000.00000002.1680080069.000000006CC1E000.00000004.00000001.01000000.00000007.sdmp, MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1778307837.0000000000192000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002B23000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1781979509.0000000002AC3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1781979509.0000000002B59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002B23000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1781979509.0000000002AC3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1781979509.0000000002B59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002B23000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1781979509.0000000002AC3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1781979509.0000000002B59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002B23000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1781979509.0000000002AC3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1781979509.0000000002B59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002AC3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1781979509.0000000002B59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002B23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabS
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002B23000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1781979509.0000000002AC3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1781979509.0000000002B59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002B23000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1781979509.0000000002AC3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1781979509.0000000002B59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: MSBuild.exe, 00000002.00000002.1781979509.0000000002B23000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1781979509.0000000002AC3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1781979509.0000000002B59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown

Network traffic detected: HTTP traffic on port 49675 -> 443

System Summary

PE file contains section with special chars

Source: xFk6x2mrd7.exe

Static PE information: section name: hTI<GU

PE file has nameless sections

Source: xFk6x2mrd7.exe

Static PE information: section name:

Source: C:\Users\user\Desktop\xFk6x2mrd7.exe

Code function: 0_2_6CC02760 GetModuleHandleW,GetProcAddress,NtQueryInformationProcess,

0_2_6CC02760

Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Code function: 0_2_6CC01090	0_2_6CC01090
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Code function: 0_2_6CC02D80	0_2_6CC02D80
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Code function: 0_2_6CC02760	0_2_6CC02760
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Code function: 0_2_6CC16285	0_2_6CC16285
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Code function: 0_2_6CC23B17	0_2_6CC23B17
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0085DC74	2_2_0085DC74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_049B8FF8	2_2_049B8FF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_049B6948	2_2_049B6948
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_049B0007	2_2_049B0007
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_049B0040	2_2_049B0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_049B8FE8	2_2_049B8FE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0599E5A8	2_2_0599E5A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05997DE0	2_2_05997DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05997510	2_2_05997510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05990F28	2_2_05990F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0599EF68	2_2_0599EF68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05998E40	2_2_05998E40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0599D130	2_2_0599D130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_059998E8	2_2_059998E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0599F8E8	2_2_0599F8E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0599B028	2_2_0599B028
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0599A050	2_2_0599A050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0599C3D0	2_2_0599C3D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0599DA87	2_2_0599DA87
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_059992A8	2_2_059992A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0599BA69	2_2_0599BA69
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05990F18	2_2_05990F18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0599B618	2_2_0599B618
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0599B609	2_2_0599B609
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05998E30	2_2_05998E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_059971C8	2_2_059971C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0599D12F	2_2_0599D12F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0599F8A1	2_2_0599F8A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_059998E7	2_2_059998E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0599F8E7	2_2_0599F8E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0599B027	2_2_0599B027
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05999298	2_2_05999298
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_059AEA18	2_2_059AEA18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_059A1831	2_2_059A1831
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_059A43C0	2_2_059A43C0

Source: C:\Users\user\Desktop\xFk6x2mrd7.exe

Code function: String function: 6CC0B810 appears 33 times

Source: xFk6x2mrd7.exe	Binary or memory string: OriginalFilename vs xFk6x2mrd7.exe
Source: xFk6x2mrd7.exe, 00000000.00000002.1680080069.000000006CC1E000.00000004.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameSubduer.exe8 vs xFk6x2mrd7.exe
Source: xFk6x2mrd7.exe, 00000000.00000000.1649860138.0000000000E3C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCosmicEdge1195775391.exeT vs xFk6x2mrd7.exe
Source: xFk6x2mrd7.exe	Binary or memory string: OriginalFilenameCosmicEdge1195775391.exeT vs xFk6x2mrd7.exe

Source: xFk6x2mrd7.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: xFk6x2mrd7.exe

Static PE information: Section: hTI<GU ZLIB complexity 1.0003349562198067

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/3@1/1

Source: C:\Users\user\Desktop\xFk6x2mrd7.exe

File created: C:\Users\user\AppData\Roaming\d3d9.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6596:120:WilError_03

Source: xFk6x2mrd7.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\xFk6x2mrd7.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: xFk6x2mrd7.exe

ReversingLabs: Detection: 79%

Source: unknown	Process created: C:\Users\user\Desktop\xFk6x2mrd7.exe "C:\Users\user\Desktop\xFk6x2mrd7.exe"
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\xFk6x2mrd7.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: xFk6x2mrd7.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: xFk6x2mrd7.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\xFk6x2mrd7.exe

Unpacked PE file: 0.2.xFk6x2mrd7.exe.de0000.0.unpack hTI<GU:EW;.text:ER;.rsrc:R;.reloc:R;Unknown_Section4:ER; vs Unknown_Section0:EW;Unknown_Section1:ER;Unknown_Section2:R;Unknown_Section3:R;Unknown_Section4:ER;

Source: xFk6x2mrd7.exe	Static PE information: section name: hTI<GU
Source: xFk6x2mrd7.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Code function: 0_2_6CC169B4 push ecx; ret	0_2_6CC169C7
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Code function: 0_2_6CC23B17 push es; retf	0_2_6CC23B12
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_049BDBF2 push eax; ret	2_2_049BDC01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_059965F5 push cs; ret	2_2_059965FE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05997505 push ss; ret	2_2_0599750E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0599555B push ss; ret	2_2_0599557A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_059954BB push cs; ret	2_2_059954CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0599575A push ds; ret	2_2_05995762
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0599BF7B pushfd ; ret	2_2_0599BF89
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_059956DB push ds; ret	2_2_059956EA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_059958C0 push es; ret	2_2_059958C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0599B01A push ds; ret	2_2_0599B026
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0599AA28 push ds; ret	2_2_0599AA36
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0599C258 push ebx; ret	2_2_0599C272

Source: xFk6x2mrd7.exe

Static PE information: section name: hTI<GU entropy: 7.9991516935950715

Source: C:\Users\user\Desktop\xFk6x2mrd7.exe

File created: C:\Users\user\AppData\Roaming\d3d9.dll

Jump to dropped file

Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Memory allocated: 15C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Memory allocated: 31C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Memory allocated: 30D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Memory allocated: 5750000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Memory allocated: 6750000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Memory allocated: 6880000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Memory allocated: 7880000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Memory allocated: 7D60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Memory allocated: 8D60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Memory allocated: 9D60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 850000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2500000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2310000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Window / User API: threadDelayed 2936

Jump to behavior

Source: C:\Users\user\Desktop\xFk6x2mrd7.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\d3d9.dll

Jump to dropped file

Source: C:\Users\user\Desktop\xFk6x2mrd7.exe TID: 6744	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 4544	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6964	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6892	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: MSBuild.exe, 00000002.00000002.1787447931.0000000005594000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_059945A8 LdrInitializeThunk,

2_2_059945A8

Source: C:\Users\user\Desktop\xFk6x2mrd7.exe

Code function: 0_2_6CC0B69A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CC0B69A

Source: C:\Users\user\Desktop\xFk6x2mrd7.exe

Code function: 0_2_6CC1140B GetProcessHeap,

0_2_6CC1140B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Code function: 0_2_6CC0B1C1 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6CC0B1C1
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Code function: 0_2_6CC0B69A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CC0B69A
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Code function: 0_2_6CC0F637 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CC0F637

Source: C:\Users\user\Desktop\xFk6x2mrd7.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\xFk6x2mrd7.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 190000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\xFk6x2mrd7.exe

Code function: 0_2_6CC02D80 HonorInc,GetConsoleWindow,ShowWindow,CreateProcessW,VirtualAlloc,Wow64GetThreadContext,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,ReadProcessMemory,WriteProcessMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,CloseHandle,CloseHandle,CreateProcessW,WriteProcessMemory,SetThreadContext,CloseHandle,

0_2_6CC02D80

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\xFk6x2mrd7.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 190000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 190000	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 192000	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 1C0000	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 1DE000	Jump to behavior
Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 343008	Jump to behavior

Source: C:\Users\user\Desktop\xFk6x2mrd7.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

Jump to behavior

Source: C:\Users\user\Desktop\xFk6x2mrd7.exe

Code function: 0_2_6CC0B858 cpuid

0_2_6CC0B858

Source: C:\Users\user\Desktop\xFk6x2mrd7.exe	Queries volume information: C:\Users\user\Desktop\xFk6x2mrd7.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\xFk6x2mrd7.exe

Code function: 0_2_6CC0B2E3 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6CC0B2E3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.xFk6x2mrd7.exe.6cc1e000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xFk6x2mrd7.exe.6cc00000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xFk6x2mrd7.exe.6cc1e000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1680080069.000000006CC1E000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1778307837.0000000000192000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xFk6x2mrd7.exe PID: 6576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6812, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\binance\	Jump to behavior

Source: Yara match	File source: 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6812, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.xFk6x2mrd7.exe.6cc1e000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xFk6x2mrd7.exe.6cc00000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xFk6x2mrd7.exe.6cc1e000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1680080069.000000006CC1E000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1778307837.0000000000192000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xFk6x2mrd7.exe PID: 6576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6812, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	411 Process Injection	1 Masquerading	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	341 Security Software Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	12 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	411 Process Injection	NTDS	241 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	4 Obfuscated Files or Information	Cached Domain Credentials	124 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
xFk6x2mrd7.exe	79%	ReversingLabs	Win32.Spyware.RedLine
xFk6x2mrd7.exe	100%	Avira	HEUR/AGEN.1311437
xFk6x2mrd7.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\d3d9.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\d3d9.dll	53%	ReversingLabs	Win32.Trojan.LummaStealer

Source	Detection	Scanner	Label
http://tempuri.org/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23ResponseD	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id2Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	0%	Avira URL Cloud	safe
94.228.166.68:80	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id7	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id4	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/sc	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id20	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/trust	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id18	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtabS	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id3ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23Response	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ip.sb	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
94.228.166.68:80	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	MSBuild.exe, 00000002.00000002.1781979509.0000000002AC3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1781979509.0000000002B59000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	MSBuild.exe, 00000002.00000002.1781979509.0000000002B23000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1781979509.0000000002AC3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1781979509.0000000002B59000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	MSBuild.exe, 00000002.00000002.1781979509.0000000002621000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12Response	MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/	MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21Response	MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id9	MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8	MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5	MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id4	MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id7	MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6	MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19Response	MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15Response	MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6Response	MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ip.sb/ip	xFk6x2mrd7.exe, xFk6x2mrd7.exe, 00000000.00000002.1680080069.000000006CC1E000.00000004.00000001.01000000.00000007.sdmp, MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1778307837.0000000000192000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id1ResponseD	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id9Response	MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	MSBuild.exe, 00000002.00000002.1781979509.0000000002B23000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1781979509.0000000002AC3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1781979509.0000000002B59000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id20	MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21	MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id22	MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23	MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id24	MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id24Response	MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	MSBuild.exe, 00000002.00000002.1781979509.0000000002B23000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1781979509.0000000002AC3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1781979509.0000000002B59000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1Response	MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10	MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id11	MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12	MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16Response	MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id13	MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14	MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15	MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16	MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id17	MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id18	MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5Response	MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19	MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10Response	MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8Response	MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	MSBuild.exe, 00000002.00000002.1781979509.0000000002B23000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1781979509.0000000002AC3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1781979509.0000000002B59000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtabS	MSBuild.exe, 00000002.00000002.1781979509.0000000002B23000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id3ResponseD	MSBuild.exe, 00000002.00000002.1781979509.0000000002621000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23Response	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1781979509.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	MSBuild.exe, 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
94.228.166.68	unknown	Russian Federation		48467	PRANET-ASRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1464974
Start date and time:	2024-07-01 03:11:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	xFk6x2mrd7.exe renamed because original name is a hash value
Original Sample Name:	18fd0471029adc5a608cc7c442a97f3a.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/3@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 124 Number of non-executed functions: 28
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): SIHClient.exe
Excluded IPs from analysis (whitelisted): 104.26.12.31, 172.67.75.172, 104.26.13.31, 20.114.59.183
Excluded domains from analysis (whitelisted): api.ip.sb.cdn.cloudflare.net, slscr.update.microsoft.com, sls.update.microsoft.com, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: xFk6x2mrd7.exe

Simulations

Behavior and APIs

Time	Type	Description
21:12:04	API Interceptor	16x Sleep call for process: MSBuild.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
94.228.166.68	qHYHgANDmm.exe	Get hash	malicious	RedLine, Xmrig	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PRANET-ASRU	qHYHgANDmm.exe	Get hash	malicious	RedLine, Xmrig	Browse	94.228.166.68
	1Vkf7silOj.exe	Get hash	malicious	LummaC, Amadey, Mars Stealer, PureLog Stealer, RedLine, SmokeLoader, Stealc	Browse	94.228.166.74
	iYhvVk2ZzV.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	94.228.166.75
	T4LJO0xbse.exe	Get hash	malicious	Quasar	Browse	94.228.166.40
	K3wj3nqr6c.exe	Get hash	malicious	Amadey	Browse	94.228.166.74
	setup.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, PureLog Stealer, RedLine	Browse	94.228.166.74
	CS32G1VhXR.exe	Get hash	malicious	Quasar	Browse	94.228.166.40
	ZXZMRvEA9M.elf	Get hash	malicious	Mirai	Browse	185.46.45.224
	2mim34IfQZ.exe	Get hash	malicious	AsyncRAT, PureLog Stealer, Xmrig, zgRAT	Browse	94.228.162.82
	qk8WDvZhHH.exe	Get hash	malicious	RedLine	Browse	94.228.162.55

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3094
Entropy (8bit):	5.33145931749415
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0atTqdqlq7qV
MD5:	3FD5C0634443FB2EF2796B9636159CB6
SHA1:	366DDE94AEFCFFFAB8E03AD8B448E05D7489EB48
SHA-256:	58307E94C67E2348F5A838DE4FF668983B38B7E9A3B1D61535D3A392814A57D6
SHA-512:	8535E7C0777C6B0876936D84BDE2BDC59963CF0954D4E50D65808E6E806E8B131DF5DB8FA0E030FAE2702143A7C3A70698A2B9A80519C9E2FFC286A71F0B797C
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\xFk6x2mrd7.exe.log

Download File

Process:	C:\Users\user\Desktop\xFk6x2mrd7.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Roaming\d3d9.dll

Download File

Process:	C:\Users\user\Desktop\xFk6x2mrd7.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	429568
Entropy (8bit):	5.884262476306309
Encrypted:	false
SSDEEP:	6144:tfbuDSGUgh8uvy6fyMIHBsxu5wmS3UE9OgiPProBNmu:tgUgtv+Bsxu5o3NIgiPEXx
MD5:	BE83077ACEA269C2187E97BB1B69105D
SHA1:	987759A7153784121F4EF96CF4D78D1E9C552FC3
SHA-256:	4045CE5F58A63DD9CF525424F950F8D6EA8BE2D0B93069B691077480787FFA78
SHA-512:	E9F6DA69AF0730912586D4A8D388069872F1ED27E2E1B0C54570ADD6DED52F5E0E1DA268E55615CD82076FA2FB1DD559CCA7BDA23E45FA2CC5C08E1CFA8C6E94
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C.)...GQ..GQ..GQL.DP..GQL.BP..GQL.CP..GQL.FP..GQ z<Q..GQ..FQe.GQ.=BP..GQ.=CP..GQ.=DP..GQ..GQ..GQj=GP..GQj=EP..GQRich..GQ........................PE..L...$K}f...........!...&.^...6...............p............................................@.............................x...x...<................................... ...............................`...@............p..P............................text....\.......^.................. ..`.rdata...d...p...f...b..............@..@.data...L...........................@....reloc...............z..............@..B................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.166616929707346
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.96% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	xFk6x2mrd7.exe
File size:	364'032 bytes
MD5:	18fd0471029adc5a608cc7c442a97f3a
SHA1:	74854bda1aa3e60c3b6f58e8f77882ac7f958486
SHA256:	1e92e176dd94bb165b9ac9a391ed84ad473ae69a44139d2f9765dd56974cee0d
SHA512:	9cc462178cf8b63b27de90998c3a8cc722cec0bbde604e66482510c3888a78b1e869b4d3e7195c3361bb7fce43392c204c5b760948afd3bbddd6ee225bb61e00
SSDEEP:	6144:MM/FgKFH4ZtKyKtHFrO/ODMruf29AYlxJzZfPkcdeyO9U/PRdygA/g3/FGXIqNPo:MI/FutKyQli/3rtT5zPdeyO9U/PRdygE
TLSH:	847472DDB66076DFC867D462DEA82CA4EA6035BB832F4203912715EDDA4C897DF140F2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%K}f.................D...F...........`... ....@.. ....................... ............@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x46000a
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x667D4B25 [Thu Jun 27 11:21:09 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00460000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x367f0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5c000	0x708	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5e000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x60000	0x8
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x36000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
hTI<GU	0x2000	0x33ad0	0x33c00	9eb466f3bf5b4114a35e46a20c167edd	False	1.0003349562198067	data	7.9991516935950715	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.text	0x36000	0x24130	0x24200	90234ef2e5cd346249b89beaf6466665	False	0.3637745999134948	data	4.658950186278248	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x5c000	0x708	0x800	1d787ed6c4b97baca56d3ff56006a715	False	0.37158203125	data	3.7983394671855426	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x5e000	0xc	0x200	1e37c0bd08615c8250069f61ab34fa51	False	0.044921875	data	0.07763316234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
	0x60000	0x10	0x200	5171f734e1ace2a5e021287851456a44	False	0.044921875	data	0.12227588125913882	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x5c0a0	0x478	data			0.4012237762237762
RT_MANIFEST	0x5c518	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/01/24-03:11:58.328714	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	49731	80	192.168.2.4	94.228.166.68
07/01/24-03:11:58.539624	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	80	49731	94.228.166.68	192.168.2.4
07/01/24-03:12:07.139354	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49731	80	192.168.2.4	94.228.166.68

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 1, 2024 03:11:50.325644970 CEST	49675	443	192.168.2.4	173.222.162.32
Jul 1, 2024 03:11:57.432231903 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:11:57.442897081 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:11:57.442986965 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:11:57.467086077 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:11:57.472150087 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:11:58.298468113 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:11:58.328713894 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:11:58.334120035 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:11:58.539623976 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:11:58.591370106 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:11:59.935131073 CEST	49675	443	192.168.2.4	173.222.162.32
Jul 1, 2024 03:12:03.579365015 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:03.584655046 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:03.798269987 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:03.798331022 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:03.798368931 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:03.798403978 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:03.798404932 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:03.798441887 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:03.798477888 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:03.798491955 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:03.798568010 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:03.892632008 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:03.935038090 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.254082918 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.259042978 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.259057999 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.259073019 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.259079933 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.259087086 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.259114027 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.259135008 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.259151936 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.259160042 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.259172916 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.259182930 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.259191990 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.259202957 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.259206057 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.259258032 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.263915062 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.263933897 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.263978958 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.263986111 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.263993979 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.263997078 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.264050007 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.264055967 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.264147043 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.264194965 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.264236927 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.264307022 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.264420986 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.268491030 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.273493052 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.273554087 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.273577929 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.273610115 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.273662090 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.273689032 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.273716927 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.273741007 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.273761988 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.273766994 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.273804903 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.273813009 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.273857117 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.273859978 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.273899078 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.273906946 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.273906946 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.273967028 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.273973942 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.273982048 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.274009943 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.274019003 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.274071932 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.274072886 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.274080992 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.274121046 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.274148941 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.274157047 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.274174929 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.274202108 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.274223089 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.274259090 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.274264097 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.274271965 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.274312973 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.274358988 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.274373055 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.274411917 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.274415970 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.274455070 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.274456978 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.274506092 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.278378963 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.278425932 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.278434038 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.278440952 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.278449059 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.278466940 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.278484106 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.278491020 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.278501987 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.278505087 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.278523922 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.278554916 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.278558016 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.278563023 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.278570890 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.278604031 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.278613091 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.278614998 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.278628111 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.278635025 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.278662920 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.278671026 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.278755903 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.278764009 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.278784990 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.278791904 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.278850079 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.278856993 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.278870106 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.278877974 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.278915882 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.278923035 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.278969049 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.278976917 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.279037952 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.279046059 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.279052973 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.279061079 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.279088974 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.279165983 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.279174089 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.279181004 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.279189110 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.279223919 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.279232025 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.279272079 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.279278994 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.279290915 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.279299974 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.279313087 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.279371023 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.279378891 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.279422998 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.279431105 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.279443979 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.279450893 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.279459000 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.279489994 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.279496908 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.279532909 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.279541016 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.283137083 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.283144951 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.283209085 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.283216953 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.283252001 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.283258915 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.283358097 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.283366919 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.283373117 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.283380032 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.283392906 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.283401012 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.283413887 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.283421040 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.283463955 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.283473015 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.283535004 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.283543110 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.283672094 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.283679008 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.283682108 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.283685923 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.283693075 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.283699989 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.283781052 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.283788919 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.283796072 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.283802986 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.283816099 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.283823013 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.283862114 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.283869028 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.283876896 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.283906937 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.283962011 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.283968925 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.283976078 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.284143925 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.284207106 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.284286022 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.284293890 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.284315109 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.284322023 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.284343958 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.284370899 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.284378052 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.284415960 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.284451008 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.284459114 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.284467936 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.284533978 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.284542084 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.284559965 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.284567118 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.284595966 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.284603119 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.284666061 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.284673929 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.284682035 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.284696102 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.284703970 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.284734011 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.284742117 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.284785032 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.284792900 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.284800053 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.284813881 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.284822941 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.284828901 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.284836054 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.284856081 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.284863949 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.284885883 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.284894943 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.285248995 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.285257101 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.285264015 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.285270929 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.285276890 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.285286903 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.285294056 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.285300970 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.285307884 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.285315037 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.285321951 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.285329103 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.285336018 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.287940979 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.287981987 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.287988901 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.288218975 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.288227081 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.289316893 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.289324045 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.289395094 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.289403915 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.289489985 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.289496899 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.289506912 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.289557934 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.289558887 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.289566994 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.289697886 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.289731026 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.289763927 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.289771080 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.289911985 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.289920092 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.289938927 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.289982080 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.289989948 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.289998055 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.290045023 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.290051937 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.290064096 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.290071964 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.290096998 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.290194035 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.290200949 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.290209055 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.290230036 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.290236950 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.290271044 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.290330887 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.290338993 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.290345907 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.290370941 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.290378094 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.290390968 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.290399075 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.290436983 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.290445089 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.290474892 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.290482044 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.290504932 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.290513039 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.290527105 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.290596962 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.290604115 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.290611029 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.290616989 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.290633917 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.290642023 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.290647984 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.291135073 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.291142941 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.291150093 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.295583963 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.295651913 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.295660019 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.295663118 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.295666933 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.295698881 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.295770884 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.295819998 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.295829058 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.295838118 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.295838118 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.295881033 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.295891047 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.295897961 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.295907021 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.295934916 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.295943022 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.295973063 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.295980930 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.295984030 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.296021938 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.296030998 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.296123981 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.296130896 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.296139002 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.296145916 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.296153069 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.296155930 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.296226978 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.296235085 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.296241045 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.296247959 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.296255112 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.296262026 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.296268940 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.296276093 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.296355963 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.296365023 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.296371937 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.296377897 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.296385050 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.296391964 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.296520948 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.296528101 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.296535969 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.296541929 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.296549082 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.296555996 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.296622038 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.296631098 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.296633959 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.296639919 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.296643019 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.296650887 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.296755075 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.302541971 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.302560091 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.302567005 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.302576065 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.302608013 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.302615881 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.302656889 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.302664995 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.302697897 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.302706003 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.302714109 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.302736998 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.302746058 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.302772999 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.302773952 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.302809954 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.302817106 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.302819967 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.302844048 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.302850962 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.302918911 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.302927017 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.302944899 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.302994013 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.303083897 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.303091049 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.303097963 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.303105116 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.303112984 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.303272963 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.303333044 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.303340912 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.303349018 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.303390980 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.303397894 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.303507090 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.303514957 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.303524017 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.303531885 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.303539038 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.303545952 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.303553104 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.303620100 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.303627968 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.303634882 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.303641081 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.303648949 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.303656101 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.303663015 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.303669930 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.303710938 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.303719044 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.303725004 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.303731918 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.303739071 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.310240984 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.310254097 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.310270071 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.310277939 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.310285091 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.310292959 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.310302973 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.310344934 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.310353041 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.310357094 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.310384989 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.310415983 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.310435057 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.310445070 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.310448885 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.310478926 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.310501099 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.310508966 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.310523033 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.310529947 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.310590982 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.310599089 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.310651064 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.310658932 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.310699940 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.310707092 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.311275959 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.311284065 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.311316967 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.311376095 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.311383963 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.311388016 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.311451912 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.311460018 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.311465979 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.311480999 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.311489105 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.356884003 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.356900930 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.357223034 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.357305050 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.357305050 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.357362032 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.361762047 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.362158060 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.362185001 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.362231016 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.362257957 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.362284899 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.362312078 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.362360954 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.362386942 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.362412930 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.362440109 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.362489939 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.362515926 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.362543106 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.362569094 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.362595081 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.362653017 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.362679005 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.362705946 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.362735987 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.362762928 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.362875938 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.362904072 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.362931013 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.362978935 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.363004923 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.363032103 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.363059044 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.363085985 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.363114119 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.363140106 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.363166094 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.363192081 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.363218069 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.388139963 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.393495083 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.393665075 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.398561954 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.398614883 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.398643017 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.398694038 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.398722887 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.398747921 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.398775101 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.398822069 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.398849010 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.398878098 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.398905039 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.398932934 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.398958921 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.398987055 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.399013042 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:06.435015917 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:06.440149069 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:07.138489008 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:07.139353991 CEST	49731	80	192.168.2.4	94.228.166.68
Jul 1, 2024 03:12:07.144371986 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:07.456034899 CEST	80	49731	94.228.166.68	192.168.2.4
Jul 1, 2024 03:12:07.484842062 CEST	49731	80	192.168.2.4	94.228.166.68

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 1, 2024 03:12:04.121299982 CEST	59861	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 1, 2024 03:12:04.121299982 CEST	192.168.2.4	1.1.1.1	0x8ca	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 1, 2024 03:12:04.128079891 CEST	1.1.1.1	192.168.2.4	0x8ca	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	94.228.166.68	80	6812	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 03:11:57.467086077 CEST	37	OUT	Data Raw: 00 01 00 01 02 02 1b 6e 65 74 2e 74 63 70 3a 2f 2f 39 34 2e 32 32 38 2e 31 36 36 2e 36 38 3a 38 30 2f 03 08 0c Data Ascii: net.tcp://94.228.166.68:80/
Jul 1, 2024 03:11:58.298468113 CEST	1	IN	Data Raw: 0b Data Ascii:
Jul 1, 2024 03:11:58.328713894 CEST	202	OUT	Data Raw: 06 c7 01 52 1d 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 45 6e 74 69 74 79 2f 49 64 31 1b 6e 65 74 2e 74 63 70 3a 2f 2f 39 34 2e 32 32 38 2e 31 36 36 2e 36 38 3a 38 30 2f 03 49 64 31 13 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e Data Ascii: Rhttp://tempuri.org/Entity/Id1net.tcp://94.228.166.68:80/Id1http://tempuri.org/VsaVD@Authorizationns1 e0c4915670bce95535bec15e4bb6341aDGWcDxJ_DK]D,D*DVB
Jul 1, 2024 03:11:58.539623976 CEST	142	IN	Data Raw: 06 8b 01 50 25 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 45 6e 74 69 74 79 2f 49 64 31 52 65 73 70 6f 6e 73 65 0b 49 64 31 52 65 73 70 6f 6e 73 65 13 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 09 49 64 31 52 65 73 75 Data Ascii: P%http://tempuri.org/Entity/Id1ResponseId1Responsehttp://tempuri.org/Id1ResultVsaVDDGWcDxJ_DK]DVBB
Jul 1, 2024 03:12:03.579365015 CEST	154	OUT	Data Raw: 06 97 01 22 1d 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 45 6e 74 69 74 79 2f 49 64 32 03 49 64 32 56 02 0b 01 73 04 0b 01 61 06 56 08 44 0a 1e 00 82 ab 09 40 0d 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 08 03 6e 73 31 99 20 65 30 63 Data Ascii: "http://tempuri.org/Entity/Id2Id2VsaVD@Authorizationns1 e0c4915670bce95535bec15e4bb6341aD4FRO8:D,D*DVB
Jul 1, 2024 03:12:03.798269987 CEST	1236	IN	Data Raw: 06 ff 33 f8 01 25 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 45 6e 74 69 74 79 2f 49 64 32 52 65 73 70 6f 6e 73 65 0b 49 64 32 52 65 73 70 6f 6e 73 65 09 49 64 32 52 65 73 75 6c 74 06 45 6e 74 69 74 79 29 68 74 74 70 3a 2f 2f 77 77 Data Ascii: 3%http://tempuri.org/Entity/Id2ResponseId2ResponseId2ResultEntity)http://www.w3.org/2001/XMLSchema-instanceId1Id109http://schemas.microsoft.com/2003/10/Serialization/ArraysstringId11Id12Id13Entity17Id2Id3Entity16Id4Id5Id6I
Jul 1, 2024 03:12:03.798331022 CEST	1236	IN	Data Raw: 46 19 99 2d 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 49 72 69 64 69 75 6d 5c 55 73 65 72 20 44 61 74 61 46 19 99 31 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 37 Data Ascii: F-%USERPROFILE%\AppData\Local\Iridium\User DataF1%USERPROFILE%\AppData\Local\7Star\7Star\User DataF1%USERPROFILE%\AppData\Local\CentBrowser\User DataF,%USERPROFILE%\AppData\Local\Chedot\User DataF-%USERPROFILE%\AppData\Local\Vivaldi\
Jul 1, 2024 03:12:03.798368931 CEST	448	IN	Data Raw: 5c 55 73 65 72 20 44 61 74 61 46 19 99 35 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 53 70 75 74 6e 69 6b 5c 53 70 75 74 6e 69 6b 5c 55 73 65 72 20 44 61 74 61 46 19 99 2e 25 55 53 45 52 50 52 4f 46 49 4c Data Ascii: \User DataF5%USERPROFILE%\AppData\Local\Sputnik\Sputnik\User DataF.%USERPROFILE%\AppData\Local\Nichrome\User DataF4%USERPROFILE%\AppData\Local\CocCoc\Browser\User DataF*%USERPROFILE%\AppData\Local\Uran\User DataF.%USERPROFILE%\AppDat
Jul 1, 2024 03:12:03.798403978 CEST	1236	IN	Data Raw: 46 19 99 48 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 4e 56 49 44 49 41 20 43 6f 72 70 6f 72 61 74 69 6f 6e 5c 4e 56 49 44 49 41 20 47 65 46 6f 72 63 65 20 45 78 70 65 72 69 65 6e 63 65 46 19 99 21 25 55 Data Ascii: FH%USERPROFILE%\AppData\Local\NVIDIA Corporation\NVIDIA GeForce ExperienceF!%USERPROFILE%\AppData\Local\SteamF-%USERPROFILE%\AppData\Local\CryptoTab BrowserF2%USERPROFILE%\AppData\Local\MapleStudio\ChromePlusF)%USERPROFILE%\AppData\L
Jul 1, 2024 03:12:03.798441887 CEST	1236	IN	Data Raw: 44 61 74 61 5c 4c 6f 63 61 6c 5c 42 72 61 76 65 53 6f 66 74 77 61 72 65 5c 42 72 61 76 65 2d 42 72 6f 77 73 65 72 2d 4e 69 67 68 74 6c 79 5c 55 73 65 72 20 44 61 74 61 46 19 99 2c 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c Data Ascii: Data\Local\BraveSoftware\Brave-Browser-Nightly\User DataF,%USERPROFILE%\AppData\Roaming\Lulumi-browserF+%USERPROFILE%\AppData\Local\Xvast\User DataF,%USERPROFILE%\AppData\Roaming\kingpinbrowserF7%USERPROFILE%\AppData\Local\Tencent\QQBr

Target ID:	0
Start time:	21:11:53
Start date:	30/06/2024
Path:	C:\Users\user\Desktop\xFk6x2mrd7.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\xFk6x2mrd7.exe"
Imagebase:	0xde0000
File size:	364'032 bytes
MD5 hash:	18FD0471029ADC5A608CC7C442A97F3A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1680080069.000000006CC1E000.00000004.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	21:11:53
Start date:	30/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:11:53
Start date:	30/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x90000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.1778307837.0000000000192000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.1781979509.0000000002595000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	18.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.5%
Total number of Nodes:	1865
Total number of Limit Nodes:	10

Executed Functions

Function 6CC02D80 Relevance: 86.1, APIs: 20, Strings: 25, Instructions: 7368injectionthreadmemoryCOMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNELBASE(?,?,?,?,?,?,?), ref: 6CC05194
ShowWindow.USER32 ref: 6CC051AA
CreateProcessW.KERNELBASE ref: 6CC089E7
VirtualAlloc.KERNELBASE ref: 6CC08AC5
Wow64GetThreadContext.KERNEL32 ref: 6CC08AF0
VirtualAllocEx.KERNELBASE ref: 6CC08C43
VirtualAllocEx.KERNELBASE ref: 6CC08D81
WriteProcessMemory.KERNELBASE ref: 6CC08DD6
WriteProcessMemory.KERNELBASE ref: 6CC0911E
ReadProcessMemory.KERNEL32 ref: 6CC09CD4
WriteProcessMemory.KERNEL32 ref: 6CC09D5B
WriteProcessMemory.KERNELBASE ref: 6CC0A04D
Wow64SetThreadContext.KERNEL32 ref: 6CC0A089
ResumeThread.KERNELBASE ref: 6CC0A0FE
CloseHandle.KERNEL32 ref: 6CC0A11C
CloseHandle.KERNEL32 ref: 6CC0A191
CreateProcessW.KERNEL32 ref: 6CC0A7B9
WriteProcessMemory.KERNEL32 ref: 6CC0AA15
SetThreadContext.KERNEL32 ref: 6CC0AA51
CloseHandle.KERNEL32 ref: 6CC0AA6F

Strings

D, xrefs: 6CC08879
~(69, xrefs: 6CC06E4E
ntdll.dll, xrefs: 6CC051C4
YjoI, xrefs: 6CC083E3
HS/7, xrefs: 6CC0A8E0
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe, xrefs: 6CC088F5
HKHJ, xrefs: 6CC06713
-Vq`, xrefs: 6CC06B4C
\'+, xrefs: 6CC09957
HS/7, xrefs: 6CC095A0
z, xrefs: 6CC057C9
?(F}, xrefs: 6CC06371
+mnL, xrefs: 6CC08BEE
&A+, xrefs: 6CC05E3B
\'+, xrefs: 6CC098B0
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 6CC088C4
~(69, xrefs: 6CC06EA7
kernel32.dll, xrefs: 6CC051B0
&A+, xrefs: 6CC05E9C
;%yK, xrefs: 6CC09B5F
@, xrefs: 6CC08D79
Q@E^, xrefs: 6CC081B3
Fl, xrefs: 6CC07B39
S`, xrefs: 6CC055C9
H*t, xrefs: 6CC06FDE

Memory Dump Source

Source File: 00000000.00000002.1680031775.000000006CC01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CC00000, based on PE: true

Associated: 00000000.00000002.1680010952.000000006CC00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680060715.000000006CC17000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680080069.000000006CC1E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680141425.000000006CC6A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc00000_xFk6x2mrd7.jbxd

Yara matches

Similarity

API ID: Process$Memory$Write$Thread$AllocCloseContextHandleVirtual$CreateWindowWow64$ConsoleReadResumeShow
String ID: +mnL$-Vq`$;%yK$?(F}$@$C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe$D$Fl$H*t$HKHJ$HS/7$HS/7$Q@E^$YjoI$\'+$\'+$kernel32.dll$ntdll.dll$z$~(69$~(69$&A+$&A+$S`
API String ID: 1302184485-2554451919
Opcode ID: b4237b6a17e052ea0d92a6b3f58a16447fd9fd0d525268441b88b96a4166a171
Instruction ID: 009976f0f76a341506d5cdf5dc448b37821a40083a92c351a588ac45fd58d7f0
Opcode Fuzzy Hash: b4237b6a17e052ea0d92a6b3f58a16447fd9fd0d525268441b88b96a4166a171
Instruction Fuzzy Hash: ADD30332B55215CFCB28CE3ECAD53D977F1BB86310F108295D41D9BAA4E6368AC58F81

Function 6CC01090 Relevance: 45.1, APIs: 19, Strings: 6, Instructions: 1361filememoryCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 6CC01C26
MapViewOfFile.KERNELBASE ref: 6CC01CCB
FindCloseChangeNotification.KERNELBASE ref: 6CC02408
CloseHandle.KERNEL32 ref: 6CC02497
CloseHandle.KERNEL32 ref: 6CC024A9
VirtualProtect.KERNEL32 ref: 6CC02640
VirtualProtect.KERNEL32 ref: 6CC02702
CloseHandle.KERNEL32 ref: 6CC02749

Strings

.text, xrefs: 6CC01FB6, 6CC025FA
%T', xrefs: 6CC0257A
%T', xrefs: 6CC01C04
;za, xrefs: 6CC01A2E
@, xrefs: 6CC02634
=280, xrefs: 6CC02251

Memory Dump Source

Source File: 00000000.00000002.1680031775.000000006CC01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CC00000, based on PE: true

Associated: 00000000.00000002.1680010952.000000006CC00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680060715.000000006CC17000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680080069.000000006CC1E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680141425.000000006CC6A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc00000_xFk6x2mrd7.jbxd

Yara matches

Similarity

API ID: Close$Handle$ProtectVirtual$ChangeFileFindNotificationView
String ID: %T'$%T'$.text$;za$=280$@
API String ID: 583408516-1086100020
Opcode ID: 93d3d2499eb1adb3e450e2e0f4c90d248d562fc8d27d6c85f63b349fb00b9abb
Instruction ID: 13a32b124e237eb5dd48364ab21f6f4e2f98a5ddc565efb5108375a72d1ad4da
Opcode Fuzzy Hash: 93d3d2499eb1adb3e450e2e0f4c90d248d562fc8d27d6c85f63b349fb00b9abb
Instruction Fuzzy Hash: C4C2DA75B06224CFDB14CF3DC9987D9BBF1AB8A304F008199E459EB750E6369E858F42

Function 6CC02760 Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 371
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?), ref: 6CC0290C
GetProcAddress.KERNEL32 ref: 6CC02924

Strings

ntdll.dll, xrefs: 6CC02900
Qq:-, xrefs: 6CC02A45
NtQueryInformationProcess, xrefs: 6CC02914
?KZ8, xrefs: 6CC02A9D

Memory Dump Source

Source File: 00000000.00000002.1680031775.000000006CC01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CC00000, based on PE: true

Associated: 00000000.00000002.1680010952.000000006CC00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680060715.000000006CC17000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680080069.000000006CC1E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680141425.000000006CC6A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc00000_xFk6x2mrd7.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: ?KZ8$NtQueryInformationProcess$Qq:-$ntdll.dll
API String ID: 1646373207-3084369345
Opcode ID: 1b1329ddd724cc78c5ba4d03b4dbd197054471a6c288de99187836046e989fcc
Instruction ID: 187a1436644eb10acf1fa6511ff38547cd946c996c345c7432811648dbcc4a17
Opcode Fuzzy Hash: 1b1329ddd724cc78c5ba4d03b4dbd197054471a6c288de99187836046e989fcc
Instruction Fuzzy Hash: FED199B6F152058FDB04CFBDD5A97DDBBF2BB8A304F119119E411DBA50E63A8909CB01

Function 6CC0AFB8 Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6CC0AFFF
___scrt_uninitialize_crt.LIBCMT ref: 6CC0B019

Memory Dump Source

Source File: 00000000.00000002.1680031775.000000006CC01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CC00000, based on PE: true

Associated: 00000000.00000002.1680010952.000000006CC00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680060715.000000006CC17000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680080069.000000006CC1E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680141425.000000006CC6A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc00000_xFk6x2mrd7.jbxd

Yara matches

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 6873a07aa22ad82c138268969c6b355e45bcb0f5096199bf127f3a3e054ec9ae
Instruction ID: 491e0729ec49783fe5519b6fb2ec2f6af67afe58fec61f8372d01e51271b420b
Opcode Fuzzy Hash: 6873a07aa22ad82c138268969c6b355e45bcb0f5096199bf127f3a3e054ec9ae
Instruction Fuzzy Hash: 1E41E572F05219EBCB10CF66CD50BEE7778EF80BA8F114115E82597B50F7328A469BA4

Function 6CC0B068 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 6CC0B0A5
dllmain_crt_dispatch.LIBCMT ref: 6CC0B0BC
dllmain_raw.LIBCMT ref: 6CC0B104
dllmain_crt_dispatch.LIBCMT ref: 6CC0B117
dllmain_raw.LIBCMT ref: 6CC0B12A

Memory Dump Source

Source File: 00000000.00000002.1680031775.000000006CC01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CC00000, based on PE: true

Associated: 00000000.00000002.1680010952.000000006CC00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680060715.000000006CC17000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680080069.000000006CC1E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680141425.000000006CC6A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc00000_xFk6x2mrd7.jbxd

Yara matches

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: d34f4e527dddcdb7b2b775e8c525026f236227a36b56a2bc7006c83408acdab9
Instruction ID: 01c61f9e8175e1a3b5f738f1e22ad85acc8dab613d1761525e517d808b9c6c4b
Opcode Fuzzy Hash: d34f4e527dddcdb7b2b775e8c525026f236227a36b56a2bc7006c83408acdab9
Instruction Fuzzy Hash: 59217171F41115EBCB21CF56CD50AAF3A79EB80B98F114115F82597B51E7328D429BE0

Function 6CC0AEB1 Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6CC0AEFE

Part of subcall function 6CC0B37B: InitializeSListHead.KERNEL32(6CC69420,6CC0AF08,6CC1C650,00000010,6CC0AE99,?,?,?,6CC0B0C1,?,00000001,?,?,00000001,?,6CC1C698), ref: 6CC0B380

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6CC0AF68

Memory Dump Source

Source File: 00000000.00000002.1680031775.000000006CC01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CC00000, based on PE: true

Associated: 00000000.00000002.1680010952.000000006CC00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680060715.000000006CC17000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680080069.000000006CC1E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680141425.000000006CC6A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc00000_xFk6x2mrd7.jbxd

Yara matches

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: 07b649b9b3424987e913a4bf9eacf87eb439539bf3302fa0b50d538cbc79acc4
Instruction ID: 15a8b815241396dffc555a206463ea28f62e39b6b2b4af5e504caa1da92df575
Opcode Fuzzy Hash: 07b649b9b3424987e913a4bf9eacf87eb439539bf3302fa0b50d538cbc79acc4
Instruction Fuzzy Hash: 3D210F717492019ECB05EBB6C8207ED37709F8222CF200859D894A7FC1FF238249D675

Function 6CC114DC Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 6CC11528
GetFileType.KERNELBASE(00000000), ref: 6CC1153A

Memory Dump Source

Source File: 00000000.00000002.1680031775.000000006CC01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CC00000, based on PE: true

Associated: 00000000.00000002.1680010952.000000006CC00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680060715.000000006CC17000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680080069.000000006CC1E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680141425.000000006CC6A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc00000_xFk6x2mrd7.jbxd

Yara matches

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 3f8a62c8c4e4d78e83cf1b41f8dd1f5e50d6ef3689bab36d46a2e832b542a2f1
Instruction ID: 4e5a08f3430387b475f34a89c4e66a85882d48fd43be638b2e3d8f2b18827345
Opcode Fuzzy Hash: 3f8a62c8c4e4d78e83cf1b41f8dd1f5e50d6ef3689bab36d46a2e832b542a2f1
Instruction Fuzzy Hash: E111727160C7518AC7308E7F8C856127AA4A767274B341719D4B786DF1F238D586F251

Function 6CC11E9A Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,6CC107E7,6CC11BB4,?,6CC107E7,00000220,?,?,6CC11BB4), ref: 6CC11ECC

Memory Dump Source

Source File: 00000000.00000002.1680031775.000000006CC01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CC00000, based on PE: true

Associated: 00000000.00000002.1680010952.000000006CC00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680060715.000000006CC17000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680080069.000000006CC1E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680141425.000000006CC6A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc00000_xFk6x2mrd7.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 14b5ab7405dca47f119ac4147f8e9ef9490e3c7f2877bd4e24c01fa47403a0df
Instruction ID: 246ffb34cadd75eb95d2754d4c9c6fe9b6d44a3d8285857b8e7fbb324b9b1d6c
Opcode Fuzzy Hash: 14b5ab7405dca47f119ac4147f8e9ef9490e3c7f2877bd4e24c01fa47403a0df
Instruction Fuzzy Hash: CFE0E52224D2145AEF111AEF9C0CF8B369CAF233A5F110124EC1892E80FB28C400A2A5

Non-executed Functions

Function 6CC0B69A Relevance: 6.1, APIs: 4, Instructions: 70COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,00000000), ref: 6CC0B6A6
IsDebuggerPresent.KERNEL32 ref: 6CC0B772
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6CC0B78B
UnhandledExceptionFilter.KERNEL32(?), ref: 6CC0B795

Memory Dump Source

Source File: 00000000.00000002.1680031775.000000006CC01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CC00000, based on PE: true

Associated: 00000000.00000002.1680010952.000000006CC00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680060715.000000006CC17000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680080069.000000006CC1E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680141425.000000006CC6A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc00000_xFk6x2mrd7.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 7966c730fc5706b823221c8ceb857e8656a2b0362726a0f73ddb7f2162697afc
Instruction ID: 54535094615043772ea81fbaa703475fff55a21b4f487149480c7399e9d9d809
Opcode Fuzzy Hash: 7966c730fc5706b823221c8ceb857e8656a2b0362726a0f73ddb7f2162697afc
Instruction Fuzzy Hash: F1311475E01318DBDF21DFA5C989BCDBBB8AF08304F1041AAE40DAB240EB719B858F54

Function 6CC0F637 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 6CC0F72F
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 6CC0F739
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 6CC0F746

Memory Dump Source

Source File: 00000000.00000002.1680031775.000000006CC01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CC00000, based on PE: true

Associated: 00000000.00000002.1680010952.000000006CC00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680060715.000000006CC17000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680080069.000000006CC1E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680141425.000000006CC6A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc00000_xFk6x2mrd7.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 1de2840e2621ba630077f679a512961417da5aa603b0534c3944207b548a8ed4
Instruction ID: 2798ff2e8902c7fe2d8243af9ae61c84e62a8e986c2575f80d3fa73c2a64e332
Opcode Fuzzy Hash: 1de2840e2621ba630077f679a512961417da5aa603b0534c3944207b548a8ed4
Instruction Fuzzy Hash: 0431E474A0132C9BCB61DF69D988BCDBBB8BF48314F5041EAE41CA7290E7319B858F55

Function 6CC16285 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,6CC16280,?,?,00000008,?,?,6CC15E83,00000000), ref: 6CC164B2

Memory Dump Source

Source File: 00000000.00000002.1680031775.000000006CC01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CC00000, based on PE: true

Associated: 00000000.00000002.1680010952.000000006CC00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680060715.000000006CC17000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680080069.000000006CC1E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680141425.000000006CC6A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc00000_xFk6x2mrd7.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: f16d7a4085304eeb9e3a00ea59a333aeb28ee057cd7ffc8c36209333b17a2762
Instruction ID: ef90cc882dfac188f70a7c0531dabdd840e4b8a9b1fc2923c57d00cfc72d14b7
Opcode Fuzzy Hash: f16d7a4085304eeb9e3a00ea59a333aeb28ee057cd7ffc8c36209333b17a2762
Instruction Fuzzy Hash: 03B16E31214A08DFD705CF2AC486B947BE0FF45368F258658E8E9CFAA1D335E992DB40

Function 6CC0B858 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6CC0B86E

Memory Dump Source

Source File: 00000000.00000002.1680031775.000000006CC01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CC00000, based on PE: true

Associated: 00000000.00000002.1680010952.000000006CC00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680060715.000000006CC17000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680080069.000000006CC1E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680141425.000000006CC6A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc00000_xFk6x2mrd7.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: ddf0fbe4406282680f05ff3bd2c4d042674f726c2b874084bbb7f15b1262d7bc
Instruction ID: 38510df00fe8259fdb49f813dc9277346a08f44b1020a2b03822eb597c35f482
Opcode Fuzzy Hash: ddf0fbe4406282680f05ff3bd2c4d042674f726c2b874084bbb7f15b1262d7bc
Instruction Fuzzy Hash: F85149B1B11A098BEB04CF5AC5917BABBF4FB49318F20856AD515EBB80E3759940CB50

Function 6CC1140B Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 6CC1140B

Memory Dump Source

Source File: 00000000.00000002.1680031775.000000006CC01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CC00000, based on PE: true

Associated: 00000000.00000002.1680010952.000000006CC00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680060715.000000006CC17000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680080069.000000006CC1E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680141425.000000006CC6A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc00000_xFk6x2mrd7.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 68a1a9088f134e56b2c0195e9becc1a3a1beb3bc01be7d7e91bf0eaaf279968a
Instruction ID: 5d6416000e3a03fa7d4b860c49d9b5eaf66cab1f60e327c8fc50adb548216e3f
Opcode Fuzzy Hash: 68a1a9088f134e56b2c0195e9becc1a3a1beb3bc01be7d7e91bf0eaaf279968a
Instruction Fuzzy Hash: B3A001707452018BAF508F3B870A2197AF9AA4BAA1B1984A9A809C9655EA248450AF12

Function 6CC23B17 Relevance: .8, Instructions: 814COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680080069.000000006CC1E000.00000004.00000001.01000000.00000007.sdmp, Offset: 6CC1E000, based on PE: true

Associated: 00000000.00000002.1680141425.000000006CC6A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc00000_xFk6x2mrd7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 161b052c6f8f28aa8eb581e2d29508f1625a35a28dfff6ea84b9b1789e712dd4
Instruction ID: 596368332bef1a09cc0c47e4a3ef8969573fd54da00a3f44100438afaf40d41d
Opcode Fuzzy Hash: 161b052c6f8f28aa8eb581e2d29508f1625a35a28dfff6ea84b9b1789e712dd4
Instruction Fuzzy Hash: D462442144E3C29FD7138B749C746E27FB4AE5721471E09DBD8C08F4A3E2291A6AD772

Function 6CC0D0CA Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

type_info::operator==.LIBVCRUNTIME ref: 6CC0D1E9
___TypeMatch.LIBVCRUNTIME ref: 6CC0D2F7
_UnwindNestedFrames.LIBCMT ref: 6CC0D449
CallUnexpected.LIBVCRUNTIME ref: 6CC0D464

Strings

csm, xrefs: 6CC0D107
csm, xrefs: 6CC0D174
csm, xrefs: 6CC0D220

Memory Dump Source

Source File: 00000000.00000002.1680031775.000000006CC01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CC00000, based on PE: true

Associated: 00000000.00000002.1680010952.000000006CC00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680060715.000000006CC17000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680080069.000000006CC1E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680141425.000000006CC6A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc00000_xFk6x2mrd7.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: cb3cf301d74cfecc71e02320870acdb131bd336829a08d67df6a36196752a853
Instruction ID: 279eff788c29daf45e5b577c6c543f1209eb812e3532814976c706717f710bcc
Opcode Fuzzy Hash: cb3cf301d74cfecc71e02320870acdb131bd336829a08d67df6a36196752a853
Instruction Fuzzy Hash: 8DB1AE75E00209DFCF04DFA5C88099EBBB5FF04319F14465AE8116BA15E732EA55CFA2

Function 6CC0C170 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_ValidateLocalCookies.LIBCMT ref: 6CC0C1A7
___except_validate_context_record.LIBVCRUNTIME ref: 6CC0C1AF
_ValidateLocalCookies.LIBCMT ref: 6CC0C238
__IsNonwritableInCurrentImage.LIBCMT ref: 6CC0C263
_ValidateLocalCookies.LIBCMT ref: 6CC0C2B8

Strings

csm, xrefs: 6CC0C24D

Memory Dump Source

Source File: 00000000.00000002.1680031775.000000006CC01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CC00000, based on PE: true

Associated: 00000000.00000002.1680010952.000000006CC00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680060715.000000006CC17000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680080069.000000006CC1E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680141425.000000006CC6A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc00000_xFk6x2mrd7.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 3fbce5662d9f7795f63455af9cd2a80c82b704d3cd45717027e42d9c24a92c1b
Instruction ID: 716aa71e249c5c98dc4381bd1d28947ee3a0c250f2df17a56fde879b2a5c1cf3
Opcode Fuzzy Hash: 3fbce5662d9f7795f63455af9cd2a80c82b704d3cd45717027e42d9c24a92c1b
Instruction Fuzzy Hash: 78419534B011199BCF00EFA9C880A9E7BB5FF45318F148155E9249BF51E732D959CFA2

Function 6CC1103A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,6CC11149,00000000,6CC0E950,00000000,00000000,00000001,?,6CC112C2,00000022,FlsSetValue,6CC18898,6CC188A0,00000000), ref: 6CC110FB

Strings

ext-ms-, xrefs: 6CC110A5
api-ms-, xrefs: 6CC11091

Memory Dump Source

Source File: 00000000.00000002.1680031775.000000006CC01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CC00000, based on PE: true

Associated: 00000000.00000002.1680010952.000000006CC00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680060715.000000006CC17000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680080069.000000006CC1E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680141425.000000006CC6A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc00000_xFk6x2mrd7.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 53014073b5b6a6f1480dac90ca1ebef976ae8ca371baeef44c0c9cd611da9537
Instruction ID: 2fd270f42c3330c7571b40b18717e186f3cc57fe2b1e6fa3167c2a4e3ca78ef4
Opcode Fuzzy Hash: 53014073b5b6a6f1480dac90ca1ebef976ae8ca371baeef44c0c9cd611da9537
Instruction Fuzzy Hash: B121EB35F09211AFCB218B6BCC40A8A77B8AB52364F250255E815A7E80F734EA06F7D0

Function 6CC0C71C Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6CC0C351,6CC0B470,6CC0AE89,?,6CC0B0C1,?,00000001,?,?,00000001,?,6CC1C698,0000000C,6CC0B1BA), ref: 6CC0C72A
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6CC0C738
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6CC0C751
SetLastError.KERNEL32(00000000,6CC0B0C1,?,00000001,?,?,00000001,?,6CC1C698,0000000C,6CC0B1BA,?,00000001,?), ref: 6CC0C7A3

Memory Dump Source

Source File: 00000000.00000002.1680031775.000000006CC01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CC00000, based on PE: true

Associated: 00000000.00000002.1680010952.000000006CC00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680060715.000000006CC17000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680080069.000000006CC1E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680141425.000000006CC6A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc00000_xFk6x2mrd7.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: def639a02a88267ba2d24d7fe991c840916826d31e77d4ec12e73ba6d3eb4c73
Instruction ID: 88ab3e3812005ee6f98a2d781a585726f41ff064780eed206e9c9185cc6c07d3
Opcode Fuzzy Hash: def639a02a88267ba2d24d7fe991c840916826d31e77d4ec12e73ba6d3eb4c73
Instruction Fuzzy Hash: 1F01D83230D3255EE704367B9D849562BB4EB0777D320032AE51491AD0FF534845A3A6

Function 6CC1026E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\xFk6x2mrd7.exe, xrefs: 6CC1028A

Memory Dump Source

Source File: 00000000.00000002.1680031775.000000006CC01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CC00000, based on PE: true

Associated: 00000000.00000002.1680010952.000000006CC00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680060715.000000006CC17000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680080069.000000006CC1E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680141425.000000006CC6A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc00000_xFk6x2mrd7.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\xFk6x2mrd7.exe
API String ID: 0-3240530527
Opcode ID: 24de5d26c4e69050668f13d5512d34d13ab5bb657bb6d533ac5f7af2f31de6e0
Instruction ID: 21574eada3569dca61fcde18e5ba2120c9c8916da195525556ebe37d735e3ec1
Opcode Fuzzy Hash: 24de5d26c4e69050668f13d5512d34d13ab5bb657bb6d533ac5f7af2f31de6e0
Instruction Fuzzy Hash: AD216F3120C2C5AFDB04DF77C89099B77A9FF053687448629E91897E40FB31E860EBA0

Function 6CC0E27E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,04D34F2F,00000000,?,00000000,6CC16B82,000000FF,?,6CC0E218,?,?,6CC0E1EC,?), ref: 6CC0E2B3
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6CC0E2C5
FreeLibrary.KERNEL32(00000000,?,00000000,6CC16B82,000000FF,?,6CC0E218,?,?,6CC0E1EC,?), ref: 6CC0E2E7

Strings

mscoree.dll, xrefs: 6CC0E2AC
CorExitProcess, xrefs: 6CC0E2BD

Memory Dump Source

Source File: 00000000.00000002.1680031775.000000006CC01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CC00000, based on PE: true

Associated: 00000000.00000002.1680010952.000000006CC00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680060715.000000006CC17000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680080069.000000006CC1E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680141425.000000006CC6A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc00000_xFk6x2mrd7.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: a46cf0be965165137609d2446de852f4df779efd312f7942a360d063a9610d8a
Instruction ID: 6a362d189182b8ddf50735d57fbf82c1c0d1e8f78557fe22ae09d0f1a41e33fe
Opcode Fuzzy Hash: a46cf0be965165137609d2446de852f4df779efd312f7942a360d063a9610d8a
Instruction Fuzzy Hash: 64018F31A08619EFDF019F52CC05FAE7BB9FB05714F01452AE821A2E80EB359900DBD0

Function 6CC12CF5 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 6CC12D7A
__alloca_probe_16.LIBCMT ref: 6CC12E43
__freea.LIBCMT ref: 6CC12EAA

Part of subcall function 6CC11E9A: RtlAllocateHeap.NTDLL(00000000,6CC107E7,6CC11BB4,?,6CC107E7,00000220,?,?,6CC11BB4), ref: 6CC11ECC

__freea.LIBCMT ref: 6CC12EBD
__freea.LIBCMT ref: 6CC12ECA

Memory Dump Source

Source File: 00000000.00000002.1680031775.000000006CC01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CC00000, based on PE: true

Associated: 00000000.00000002.1680010952.000000006CC00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680060715.000000006CC17000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680080069.000000006CC1E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680141425.000000006CC6A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc00000_xFk6x2mrd7.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 83bf94459dd6f045c71286b67672251be6f53d11f19d96aab79ed4a3ab29cc22
Instruction ID: 6bb44c22a6336abaa9cb0ab14e70fe12b4186ab841179ff4243188342f252f99
Opcode Fuzzy Hash: 83bf94459dd6f045c71286b67672251be6f53d11f19d96aab79ed4a3ab29cc22
Instruction Fuzzy Hash: 4B51E676608246AFEB158FA7CC58EEB36ADEF46719B114128FD14D6E40F734CC60E660

Function 6CC0CCF2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,6CC0CCA3,00000000,?,00000001,?,?,?,6CC0CD92,00000001,FlsFree,6CC17F70,FlsFree), ref: 6CC0CCFF
GetLastError.KERNEL32(?,6CC0CCA3,00000000,?,00000001,?,?,?,6CC0CD92,00000001,FlsFree,6CC17F70,FlsFree,00000000,?,6CC0C7F1), ref: 6CC0CD09
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 6CC0CD31

Strings

api-ms-, xrefs: 6CC0CD16

Memory Dump Source

Source File: 00000000.00000002.1680031775.000000006CC01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CC00000, based on PE: true

Associated: 00000000.00000002.1680010952.000000006CC00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680060715.000000006CC17000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680080069.000000006CC1E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680141425.000000006CC6A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc00000_xFk6x2mrd7.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 6d4dcac3eef13aa0d45a20b8d661d4dc0175ecb49f6a44db40958a466f5deaa6
Instruction ID: 4d1df35fa21755f78a4f84e43e93285804b881c20c1c81c956d7b2feedd2cc31
Opcode Fuzzy Hash: 6d4dcac3eef13aa0d45a20b8d661d4dc0175ecb49f6a44db40958a466f5deaa6
Instruction Fuzzy Hash: E5E04F34388308BBEF002F62DC06B4A3E75BB01B44F104461F91DA8CD1F7B29511E6A6

Function 6CC13402 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(04D34F2F,00000000,00000000,?), ref: 6CC13465

Part of subcall function 6CC10E3C: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6CC12EA0,?,00000000,-00000008), ref: 6CC10E9D

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6CC136B7
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6CC136FD
GetLastError.KERNEL32 ref: 6CC137A0

Memory Dump Source

Source File: 00000000.00000002.1680031775.000000006CC01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CC00000, based on PE: true

Associated: 00000000.00000002.1680010952.000000006CC00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680060715.000000006CC17000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680080069.000000006CC1E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680141425.000000006CC6A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc00000_xFk6x2mrd7.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 6dc6d157ce82a6a46c034d82b22cd743223e41eca73d6de26ffddc8b223fe778
Instruction ID: c754264717e2cce3b6485aaa8b28f8a0bf8d75d9a40ee20942520fe075fc7121
Opcode Fuzzy Hash: 6dc6d157ce82a6a46c034d82b22cd743223e41eca73d6de26ffddc8b223fe778
Instruction Fuzzy Hash: EAD17DB5E04248AFCF05CFAAC9809EDBBB5FF09318F18456AE415EBB41E730A941DB50

Function 6CC0CE73 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6CC0CF3A
___AdjustPointer.LIBCMT ref: 6CC0CF5D
___AdjustPointer.LIBCMT ref: 6CC0CFF9

Memory Dump Source

Source File: 00000000.00000002.1680031775.000000006CC01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CC00000, based on PE: true

Associated: 00000000.00000002.1680010952.000000006CC00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680060715.000000006CC17000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680080069.000000006CC1E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680141425.000000006CC6A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc00000_xFk6x2mrd7.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: c123748cfe9d0ce9badb30f4933847edc3106d2aa74b10d884807b9f3562dea5
Instruction ID: b2041f5e6e707ba946ed18befa8cf1b518608d0e886094787e2037ea1ddcd3e2
Opcode Fuzzy Hash: c123748cfe9d0ce9badb30f4933847edc3106d2aa74b10d884807b9f3562dea5
Instruction Fuzzy Hash: 6651C2B2706606AFEB15AF55D440BAAB7B4FF05318F20452DE81547E90F733E884CBA2

Function 6CC0FA88 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 6CC10E3C: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6CC12EA0,?,00000000,-00000008), ref: 6CC10E9D

GetLastError.KERNEL32 ref: 6CC0FAEC
__dosmaperr.LIBCMT ref: 6CC0FAF3
GetLastError.KERNEL32(?,?,?,?), ref: 6CC0FB2D
__dosmaperr.LIBCMT ref: 6CC0FB34

Memory Dump Source

Source File: 00000000.00000002.1680031775.000000006CC01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CC00000, based on PE: true

Associated: 00000000.00000002.1680010952.000000006CC00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680060715.000000006CC17000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680080069.000000006CC1E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680141425.000000006CC6A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc00000_xFk6x2mrd7.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 75e60f303789a4e4fc3b29af46d728d35dca0c704d6c435d5685a605983f1d21
Instruction ID: bd649e115b3bbda35207de4fd5a0dff4fb34bf17ae8867abfff602ecbe053d30
Opcode Fuzzy Hash: 75e60f303789a4e4fc3b29af46d728d35dca0c704d6c435d5685a605983f1d21
Instruction Fuzzy Hash: F821AC31704205AF9B109F6B88909ABB7BDFF053687148629E85987E00F736EC948BA4

Function 6CC10EDF Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6CC10EE7

Part of subcall function 6CC10E3C: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6CC12EA0,?,00000000,-00000008), ref: 6CC10E9D

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6CC10F1F
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6CC10F3F

Memory Dump Source

Source File: 00000000.00000002.1680031775.000000006CC01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CC00000, based on PE: true

Associated: 00000000.00000002.1680010952.000000006CC00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680060715.000000006CC17000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680080069.000000006CC1E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680141425.000000006CC6A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc00000_xFk6x2mrd7.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 8a6f280bdeececa41c4e96960466e930c228979d52d6018c782a7371fdef7e7d
Instruction ID: 779dfd3384d31379991a9545c451a60fb1d569ae512580f545c2fe8da7eb208b
Opcode Fuzzy Hash: 8a6f280bdeececa41c4e96960466e930c228979d52d6018c782a7371fdef7e7d
Instruction Fuzzy Hash: 7311C4B160D6597EAB0117B78D8ECEF6A7CEF8A2AD7140514F805D1E00FB30DD16A6B1

Function 6CC14D76 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,6CC14536,00000000,00000001,00000000,?,?,6CC137F4,?,00000000,00000000), ref: 6CC14D8D
GetLastError.KERNEL32(?,6CC14536,00000000,00000001,00000000,?,?,6CC137F4,?,00000000,00000000,?,?,?,6CC13D97,00000000), ref: 6CC14D99

Part of subcall function 6CC14D5F: CloseHandle.KERNEL32(FFFFFFFE,6CC14DA9,?,6CC14536,00000000,00000001,00000000,?,?,6CC137F4,?,00000000,00000000,?,?), ref: 6CC14D6F

___initconout.LIBCMT ref: 6CC14DA9

Part of subcall function 6CC14D21: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6CC14D50,6CC14523,?,?,6CC137F4,?,00000000,00000000,?), ref: 6CC14D34

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,6CC14536,00000000,00000001,00000000,?,?,6CC137F4,?,00000000,00000000,?), ref: 6CC14DBE

Memory Dump Source

Source File: 00000000.00000002.1680031775.000000006CC01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CC00000, based on PE: true

Associated: 00000000.00000002.1680010952.000000006CC00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680060715.000000006CC17000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680080069.000000006CC1E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680141425.000000006CC6A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc00000_xFk6x2mrd7.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 2432f17d0f488de37e67f681c17dd43fa88e1bfc93079a9252ebb3cb87aa470c
Instruction ID: 253dbaac0becd43d728ac5072cf9a7ad520229991c756e0ac00f0d0e3357e63d
Opcode Fuzzy Hash: 2432f17d0f488de37e67f681c17dd43fa88e1bfc93079a9252ebb3cb87aa470c
Instruction Fuzzy Hash: E5F01C36214118BBCF12AFE3CC08A893F76FB0A3B5B054194FA1C85D20D6328821FB90

Function 6CC0D46F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 6CC0D494

Strings

RCC, xrefs: 6CC0D4AE
MOC, xrefs: 6CC0D4A6

Memory Dump Source

Source File: 00000000.00000002.1680031775.000000006CC01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CC00000, based on PE: true

Associated: 00000000.00000002.1680010952.000000006CC00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680060715.000000006CC17000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680080069.000000006CC1E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1680141425.000000006CC6A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc00000_xFk6x2mrd7.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 9f20972818f41d3fc66c051fcbb792ae841340e1b2ae37d1c811ab210e60820c
Instruction ID: 34783f143bfb8e1e682116930edc3e1e5dbdb072646042b44f26c3ae392d9f6e
Opcode Fuzzy Hash: 9f20972818f41d3fc66c051fcbb792ae841340e1b2ae37d1c811ab210e60820c
Instruction Fuzzy Hash: BD413BB1A00209AFCF05CF94CC80AEEBBB5FF48308F248159F915A7651E336E951DB51

Analysis Process: MSBuild.exePID: 6812, Parent PID: 6576COMMON

Execution Graph

Execution Coverage:	17%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	179
Total number of Limit Nodes:	11

Executed Functions

Function 059AEA18 Relevance: 8.3, Strings: 6, Instructions: 772
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(bq, xrefs: 059AEF70
Dqs, xrefs: 059AF311
(bq, xrefs: 059AEAF6
Ljs, xrefs: 059AF4A6
(bq, xrefs: 059AEAA8
0os, xrefs: 059AF305

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID: (bq$(bq$(bq$0os$Dqs$Ljs
API String ID: 0-3974489700
Opcode ID: aebbcf24649552356d22519bb109c3ed06c0f685ae5e2c447f8828db73f661bf
Instruction ID: a313c91d3bbf330689263043627e49c48e5194d4e35745961599615a395b85a7
Opcode Fuzzy Hash: aebbcf24649552356d22519bb109c3ed06c0f685ae5e2c447f8828db73f661bf
Instruction Fuzzy Hash: 54622A35A002188FCB14DF68D598AADBBF6FF88310F158069E506EB365DB35ED46CB90

Function 0599DA87 Relevance: 5.5, Strings: 4, Instructions: 504
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0599DE81
$^q, xrefs: 0599E2FE
$^q, xrefs: 0599DDBD
$^q, xrefs: 0599E231

Memory Dump Source

Source File: 00000002.00000002.1788156147.0000000005990000.00000040.00000800.00020000.00000000.sdmp, Offset: 05990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5990000_MSBuild.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: f1ae093a1a1fc8eb564d5d54c45ed25a4102d721617e315331442b565865e884
Instruction ID: 7255feb58c58781618089f78a01070df215fe3854fbb6e64a5277121c307716e
Opcode Fuzzy Hash: f1ae093a1a1fc8eb564d5d54c45ed25a4102d721617e315331442b565865e884
Instruction Fuzzy Hash: D332B674E01228CFDB68DF68C894BDEB7B2BF89300F1095A9D009AB254DB359E85CF50

Function 059939C0 Relevance: 2.7, Strings: 2, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 05993AB3
$^q, xrefs: 05993B71

Memory Dump Source

Source File: 00000002.00000002.1788156147.0000000005990000.00000040.00000800.00020000.00000000.sdmp, Offset: 05990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5990000_MSBuild.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 655e5b76d00c1a7919c737b4cdeaf2a6860278516c61c1cdc289243974f8deca
Instruction ID: d785a211f15f46394026423c60f2dbfbf9a03a32bdb38830524c440bda7316c0
Opcode Fuzzy Hash: 655e5b76d00c1a7919c737b4cdeaf2a6860278516c61c1cdc289243974f8deca
Instruction Fuzzy Hash: B561B074E00208DFDB04DFA9C884A9DBBB6FF89300F249569E505BB365DB34A946CF54

Function 059945A8 Relevance: 1.6, APIs: 1, Instructions: 60libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0599460D

Memory Dump Source

Source File: 00000002.00000002.1788156147.0000000005990000.00000040.00000800.00020000.00000000.sdmp, Offset: 05990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5990000_MSBuild.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5e1afa01aadf3c872c7d49d9125bf99b12c214957d3cdbc12839796141ffaaf2
Instruction ID: 3a903d7ae3fd6440ba42b2f66d8c482e307546676e1b7cbea9eeec4ed12af516
Opcode Fuzzy Hash: 5e1afa01aadf3c872c7d49d9125bf99b12c214957d3cdbc12839796141ffaaf2
Instruction Fuzzy Hash: B921DEB4E012189FCF18DFA9E484ADDBBB6FB89311F10902AE419B7360DB315846CF20

Function 0599EF68 Relevance: .4, Instructions: 434COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788156147.0000000005990000.00000040.00000800.00020000.00000000.sdmp, Offset: 05990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5990000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e8064ab66882f8c637fc2d66dde1ddbfe0bd14a682913293aa4f0985e4c52f0
Instruction ID: 84dfa23f3618b12b39102e8a1526ad8f6fff4c7b0ec0cb98f988f7d5849d2c0e
Opcode Fuzzy Hash: 2e8064ab66882f8c637fc2d66dde1ddbfe0bd14a682913293aa4f0985e4c52f0
Instruction Fuzzy Hash: F2227F74E01229CFDB69DF68C994BD9B7B2BF49300F1085EAD549AB250EB316E85CF40

Function 0085D0A8 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0085D136
GetCurrentThread.KERNEL32 ref: 0085D173
GetCurrentProcess.KERNEL32 ref: 0085D1B0
GetCurrentThreadId.KERNEL32 ref: 0085D209

Memory Dump Source

Source File: 00000002.00000002.1781158862.0000000000850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_850000_MSBuild.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: c5aa03f015760e22ec7a3f99d2594deb9647ffad68b6850bbbd726f744dc8386
Instruction ID: b4877b11e8fb5b0608b8b472fbd72ef265b3acc18e5b2d517c2fd28152b1e1fb
Opcode Fuzzy Hash: c5aa03f015760e22ec7a3f99d2594deb9647ffad68b6850bbbd726f744dc8386
Instruction Fuzzy Hash: 1A5179B0900749CFDB14CFA9D948B9EBBF1EB48304F208069D819A73A0DB749988CF65

Function 0085D0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0085D136
GetCurrentThread.KERNEL32 ref: 0085D173
GetCurrentProcess.KERNEL32 ref: 0085D1B0
GetCurrentThreadId.KERNEL32 ref: 0085D209

Memory Dump Source

Source File: 00000002.00000002.1781158862.0000000000850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_850000_MSBuild.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 4e563a889e1c857119861cc631f493c9b8e04ca3a424681b6ef23c2dba6203fd
Instruction ID: 4482cb2d9d27cd452193260c3550d9fc0fa836d71241abcafe264f9280438ecc
Opcode Fuzzy Hash: 4e563a889e1c857119861cc631f493c9b8e04ca3a424681b6ef23c2dba6203fd
Instruction Fuzzy Hash: 6F5168B0900709CFDB14DFA9D948B9EBBF1FB48305F208459E819A73A0DB749988CF65

Function 059A0660 Relevance: 2.9, Strings: 2, Instructions: 406
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

t]6j, xrefs: 059A07ED
4a6j, xrefs: 059A08B7

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID: 4a6j$t]6j
API String ID: 0-2068480990
Opcode ID: e5cd1970eafcfa9d9965d6e48f7058605f59658657ee2b1f6aa5880dc736b264
Instruction ID: 7537ffbe462bf05f83f18563dc6ab07d117b9e8a1af09035f0472d7c051f635e
Opcode Fuzzy Hash: e5cd1970eafcfa9d9965d6e48f7058605f59658657ee2b1f6aa5880dc736b264
Instruction Fuzzy Hash: C6F14B35B002489FDB15DFA8D458AADBBF6FF88300F144469E9069B3A5DB35EC45CB90

Function 059A84A8 Relevance: 2.8, Strings: 2, Instructions: 303
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

D6j, xrefs: 059A858B
D6j, xrefs: 059A851E

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID: D6j$D6j
API String ID: 0-1248428422
Opcode ID: 42a92f975e74db22a065513856ae018aa64de389d3e69d18b8991a50fbe4353b
Instruction ID: 1cdcfcfdd530e537715b0e2ff4853fdbfe05aa94eb72355b7a067389da13276a
Opcode Fuzzy Hash: 42a92f975e74db22a065513856ae018aa64de389d3e69d18b8991a50fbe4353b
Instruction Fuzzy Hash: 6FC1D2B6218904CFC318EF18E988C6677F6B7553407054996E1238FB6DC771EE4AABE0

Function 059AC618 Relevance: 2.8, Strings: 2, Instructions: 294
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(bq, xrefs: 059AC952
(bq, xrefs: 059AC916

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID: (bq$(bq
API String ID: 0-4224401849
Opcode ID: fc7267ec48b9c41d8ca34d8efd7abc8a398b2645343096fc0074c0435447807e
Instruction ID: f7474ef70afb932803bdbdb5dca5e24f7b6891b8df5f3ad895ae28b913176b78
Opcode Fuzzy Hash: fc7267ec48b9c41d8ca34d8efd7abc8a398b2645343096fc0074c0435447807e
Instruction Fuzzy Hash: 1BA17135B002488FDB15EB789458A7D7BF7AFC9340F1844A9E506EB392DE39DC058B91

Function 059A0040 Relevance: 2.8, Strings: 2, Instructions: 287
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(_^q, xrefs: 059A01D5
4'^q, xrefs: 059A038F

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID: (_^q$4'^q
API String ID: 0-2508332758
Opcode ID: d78fbd6ba713d1bbeae859814c18536cbc228ec616c797e42634a252639db179
Instruction ID: f1af82df65868bab285b7b2fbe209dba952a93709f1f3e04fd371b1b9f4d9848
Opcode Fuzzy Hash: d78fbd6ba713d1bbeae859814c18536cbc228ec616c797e42634a252639db179
Instruction Fuzzy Hash: 56B17F31B106088FCB14EFB9D459AADBBF6FF89300F158469E506AB351DF34A946CB90

Function 059AF618 Relevance: 2.7, Strings: 2, Instructions: 226
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(bq, xrefs: 059AF72C
(bq, xrefs: 059AF77A

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID: (bq$(bq
API String ID: 0-4224401849
Opcode ID: 917b4278f6bf40abb4a1407525ed631a7fd871ab2b0b5c82b1130c4d15c42ae6
Instruction ID: 40f206255a98c154e54828372e3728753ba0f247c6c767e4cba5ee38cfa944c6
Opcode Fuzzy Hash: 917b4278f6bf40abb4a1407525ed631a7fd871ab2b0b5c82b1130c4d15c42ae6
Instruction Fuzzy Hash: 9A815F357002158FDB05DF78D498A2E7BEAAFC9741B188069E506DB3A5DF35DD01CBA0

Function 059A33F7 Relevance: 2.7, Strings: 2, Instructions: 205
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(bq, xrefs: 059A35D4
(bq, xrefs: 059A362A

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID: (bq$(bq
API String ID: 0-4224401849
Opcode ID: aec59dabd6f17016ebaf850a185c11cee6f99bd7f3fb0cd7784ce46f0eac14b2
Instruction ID: 0a79e53374cc0eb2863cc9ba889afb1f273d2836960a97a1a119de7ad7833f3b
Opcode Fuzzy Hash: aec59dabd6f17016ebaf850a185c11cee6f99bd7f3fb0cd7784ce46f0eac14b2
Instruction Fuzzy Hash: 3A71CD30B002499FDB05EB789458A2EBBF6AFC5340F2485A9D505DB392DE39DE058B91

Function 059A76A8 Relevance: 2.6, Strings: 2, Instructions: 67COMMON

Download Yara Rule

Strings

|6j, xrefs: 059A7704
Z7j, xrefs: 059A76EA

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID: Z7j$|6j
API String ID: 0-4225415791
Opcode ID: 0f3b9a277e3e32fcb07df44f03ef009c4867215534252d630d6889bb98ce3b0a
Instruction ID: b3227e1103e4d66df3ea484dee86238a38a3a52a2770a866e46c18c5e8558409
Opcode Fuzzy Hash: 0f3b9a277e3e32fcb07df44f03ef009c4867215534252d630d6889bb98ce3b0a
Instruction Fuzzy Hash: D52196363402048FCB05EB68D9556ADBBA2EFC4311B144539E106CB765DF71ED4A8BD0

Function 0085AE30 Relevance: 1.7, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0085B086

Memory Dump Source

Source File: 00000002.00000002.1781158862.0000000000850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_850000_MSBuild.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 604d680bd60f68aebfc6c633cf9b2721a76e9842a1b8f8ffa06d6e34f39dc427
Instruction ID: 58e8fbef2ecb4ba6820299f7dce804d10ab8bfe7c0b717e5967d3e2bb90e2a35
Opcode Fuzzy Hash: 604d680bd60f68aebfc6c633cf9b2721a76e9842a1b8f8ffa06d6e34f39dc427
Instruction Fuzzy Hash: BB7126B0A00B058FD728DF29D48575ABBF1FF48305F008A2DD88AD7A50DB75E949CB92

Function 059AC050 Relevance: 1.7, Strings: 1, Instructions: 411COMMON

Download Yara Rule

Strings

u\, xrefs: 059AC153, 059AC2DE

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID: u\
API String ID: 0-4154003358
Opcode ID: 23b8c1138638e292f2eaaef288409eacf37720ebd13a5f9bba1104080139e8e0
Instruction ID: 1afa7d1d550abc666418736dc6a2ed5badaee8422d88328a9a08af19c6cd5838
Opcode Fuzzy Hash: 23b8c1138638e292f2eaaef288409eacf37720ebd13a5f9bba1104080139e8e0
Instruction Fuzzy Hash: EB027C71A006058FDB21DF68C844BAABBF6FF85300F158599E449AB352DB35ED85CF90

Function 049B1CE4 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 049B1E02

Memory Dump Source

Source File: 00000002.00000002.1786498868.00000000049B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_49b0000_MSBuild.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: ab4ea91da8d905796e91a0ad24fac12300cdd3d8ed46ad74416772ba03f9aafd
Instruction ID: 3c68607caa0940bc80b32ff111037bd1fe586b40466f62ccb005e65961991f18
Opcode Fuzzy Hash: ab4ea91da8d905796e91a0ad24fac12300cdd3d8ed46ad74416772ba03f9aafd
Instruction Fuzzy Hash: E851E2B1D00319DFDB14CF99C995ADEBBB5FF88350F24812AE818AB210D770A945CF91

Function 049B1CF0 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 049B1E02

Memory Dump Source

Source File: 00000002.00000002.1786498868.00000000049B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_49b0000_MSBuild.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 33be2f10a8455f8e64f95b3f519e55cdb0528a5d9ac72f8d392bef2f8c78929b
Instruction ID: c92708f696d6709fbb7b79fa6b85eb80ca4757db1deaa6a73fd3926106080c52
Opcode Fuzzy Hash: 33be2f10a8455f8e64f95b3f519e55cdb0528a5d9ac72f8d392bef2f8c78929b
Instruction Fuzzy Hash: 0541B0B1D00309DFDB14CF99C995ADEBBB5BF88350F24812AE819AB210D771A945CF91

Function 00855935 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 008559F1

Memory Dump Source

Source File: 00000002.00000002.1781158862.0000000000850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_850000_MSBuild.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: c4e221591b1b8b8a333c2a3ca2192932a8d42064d123a20124743ff80e0b1faf
Instruction ID: 933aacf7f39c821e66a98b5a04c1bc484bdcf88801676d4a08b89c4d39d2bf39
Opcode Fuzzy Hash: c4e221591b1b8b8a333c2a3ca2192932a8d42064d123a20124743ff80e0b1faf
Instruction Fuzzy Hash: 1941D3B0C00619CFDB24CFA9C88478DBBF5FF45304F24819AD408AB255DBB5694ACF91

Function 049B0BFC Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 049B4381

Memory Dump Source

Source File: 00000002.00000002.1786498868.00000000049B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_49b0000_MSBuild.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: c7b22c1bc377bb8d95d52e6295ac4c4eaa62aa17f688389192922fda95890326
Instruction ID: b132241bb7d71f5b848e2fda09c1355d400db1d67c9fefada6fb9ab2f268c006
Opcode Fuzzy Hash: c7b22c1bc377bb8d95d52e6295ac4c4eaa62aa17f688389192922fda95890326
Instruction Fuzzy Hash: 624139B4900305CFCB14CF99C548AAABBF5FF88314F18C499D559AB321D771A841CFA0

Function 00854248 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 008559F1

Memory Dump Source

Source File: 00000002.00000002.1781158862.0000000000850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_850000_MSBuild.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: d8358c8a7f35acdc4f2695c015345bc06bf2e88cb2cd93d8fbeb4c7ded46aef2
Instruction ID: f2bcbbb1b8ca3dfae995531d1c95ddc99792448167c4f74e8b2f15831d84dd9c
Opcode Fuzzy Hash: d8358c8a7f35acdc4f2695c015345bc06bf2e88cb2cd93d8fbeb4c7ded46aef2
Instruction Fuzzy Hash: 5341D2B0C00619CFDB24CFA9C884B9DBBF5FF48305F6481AAD808AB255DB756949CF90

Function 059A6258 Relevance: 1.6, Strings: 1, Instructions: 337COMMON

Download Yara Rule

Strings

t]6j, xrefs: 059A62C0

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID: t]6j
API String ID: 0-2231782407
Opcode ID: 9cffe54861cec446cf7ab121c1fa968a57ab984a7256b860d039e21cd33840e2
Instruction ID: e3729eede0e4f570ea909556938337387c925a1ede10cd9fbfc0a461d10f8b6c
Opcode Fuzzy Hash: 9cffe54861cec446cf7ab121c1fa968a57ab984a7256b860d039e21cd33840e2
Instruction Fuzzy Hash: ADC13675B002049FCB14DF78D498A6ABBF6EF89300F148569E5069B3A5DF35EC46CBA0

Function 0085D2F9 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0085D387

Memory Dump Source

Source File: 00000002.00000002.1781158862.0000000000850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_850000_MSBuild.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e813b9ad457a1bfd4071c4c20cc36b52d10880bceac9504458c8539ef7b157e9
Instruction ID: f51931d77509a91194197e0cbff25b805d60b23c74579f47af843f10b32018fc
Opcode Fuzzy Hash: e813b9ad457a1bfd4071c4c20cc36b52d10880bceac9504458c8539ef7b157e9
Instruction Fuzzy Hash: E22103B5901319DFDB10CF9AD984AEEBBF4FB48310F10802AE918A7350D374AA45CFA5

Function 0085D300 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0085D387

Memory Dump Source

Source File: 00000002.00000002.1781158862.0000000000850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_850000_MSBuild.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6c2c35f847664cec026b0266082e86cc6ddc3c414b8e04079868d1358b7a35d6
Instruction ID: 74416fe55b5f7205074a9ff45e9ef437702fe3d9331332d01cd1b5be852745cd
Opcode Fuzzy Hash: 6c2c35f847664cec026b0266082e86cc6ddc3c414b8e04079868d1358b7a35d6
Instruction Fuzzy Hash: 4221E2B5900308DFDB10CFAAD984ADEBBF8FB48320F14801AE918A3310D374A944CFA5

Function 059AC041 Relevance: 1.6, Strings: 1, Instructions: 308COMMON

Download Yara Rule

Strings

u\, xrefs: 059AC153, 059AC2DE

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID: u\
API String ID: 0-4154003358
Opcode ID: 02a31d342b856896a6e5e88dc295f7f88ea078e54fe687be325fc074cc113825
Instruction ID: cadce98f13cf970b2d9bef1077524ff86512132be8aa834957a2d9436cc12d44
Opcode Fuzzy Hash: 02a31d342b856896a6e5e88dc295f7f88ea078e54fe687be325fc074cc113825
Instruction Fuzzy Hash: 6DE13671A006198FCB21DF68C484BA9BBB2FF45304F158699E849AB352DB34ED85CF90

Function 0085A870 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0085B101,00000800,00000000,00000000), ref: 0085B312

Memory Dump Source

Source File: 00000002.00000002.1781158862.0000000000850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_850000_MSBuild.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b493e206293e845589e6a8202d1ed12d04a46ac08e796bb25a095f57f94aa155
Instruction ID: 67cd20204e4c6ac4cccc66f117ba01e11828d0da196c00f1853b92b9cfde67d5
Opcode Fuzzy Hash: b493e206293e845589e6a8202d1ed12d04a46ac08e796bb25a095f57f94aa155
Instruction Fuzzy Hash: 5C11D3B69003499FDB20CF9AC444AEEFBF4EB58311F10846AD959A7310C375A949CFA5

Function 0085B2A0 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0085B101,00000800,00000000,00000000), ref: 0085B312

Memory Dump Source

Source File: 00000002.00000002.1781158862.0000000000850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_850000_MSBuild.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c24516f2fed15af477c3ca049703c34eebea9c130cdda6ede1e022058fc8f7c7
Instruction ID: e2e27714eea1db7d911741fb408cd5068befec0a397bb17c2d306492f34df633
Opcode Fuzzy Hash: c24516f2fed15af477c3ca049703c34eebea9c130cdda6ede1e022058fc8f7c7
Instruction Fuzzy Hash: 2F11E2B69003498FDB10CFAAC844ADEFBF4EB98310F14846AD969A7211C375A545CFA5

Function 059941F0 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetKeyboardLayout.USER32(00000000), ref: 05994266

Memory Dump Source

Source File: 00000002.00000002.1788156147.0000000005990000.00000040.00000800.00020000.00000000.sdmp, Offset: 05990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5990000_MSBuild.jbxd

Similarity

API ID: KeyboardLayout
String ID:
API String ID: 194098044-0
Opcode ID: 7063d230f8acb68e6b8ba33e7fb2dc69c465f05bb3fb7c6cbcb05c228bb5c1f3
Instruction ID: 5e6bd3120b2a0339ad662e3ca5539a54598d2583a986f9beb83a6a40cca04d97
Opcode Fuzzy Hash: 7063d230f8acb68e6b8ba33e7fb2dc69c465f05bb3fb7c6cbcb05c228bb5c1f3
Instruction Fuzzy Hash: DA1146B1A043089FCB10EFA9D4497DEBBF4FB48324F108459D559A7340C739A545CFA5

Function 059935AF Relevance: 1.6, APIs: 1, Instructions: 51comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 05994355

Memory Dump Source

Source File: 00000002.00000002.1788156147.0000000005990000.00000040.00000800.00020000.00000000.sdmp, Offset: 05990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5990000_MSBuild.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 7583ed9b0208dbca3d9c56d5dc4a85cad311f50504ad05d45b237fc021073c81
Instruction ID: 2133df4b0352ea35095309ba28e9e0a456735b74a76e151bb5680eb3bad28359
Opcode Fuzzy Hash: 7583ed9b0208dbca3d9c56d5dc4a85cad311f50504ad05d45b237fc021073c81
Instruction Fuzzy Hash: 421143B19047488FCB20CFAAD54ABDEBBF4EB48314F248459D519A7211C374A945CFA5

Function 0085B020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0085B086

Memory Dump Source

Source File: 00000002.00000002.1781158862.0000000000850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_850000_MSBuild.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 45b5d5077234e488f36c608f3d335ae2efdbc6a65a33520efc81c7adcac77e62
Instruction ID: 9cc72317b4427e901c0d5d801248914ccba35a52d04fd480671f93e5abab6d24
Opcode Fuzzy Hash: 45b5d5077234e488f36c608f3d335ae2efdbc6a65a33520efc81c7adcac77e62
Instruction Fuzzy Hash: 3511DFB5C007498FCB20DF9AC444ADEFBF4EB88324F10846AD969A7250C375A649CFA5

Function 059935B8 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 05994355

Memory Dump Source

Source File: 00000002.00000002.1788156147.0000000005990000.00000040.00000800.00020000.00000000.sdmp, Offset: 05990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5990000_MSBuild.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: cc3d755931cf80d9daa4a766b88aad751f173d4cbe92ab4203a53739913e1e70
Instruction ID: af3e79e5b76fcce87bf7072c7a6396f305a6af67f7d50aed7c570eb0bb214bdc
Opcode Fuzzy Hash: cc3d755931cf80d9daa4a766b88aad751f173d4cbe92ab4203a53739913e1e70
Instruction Fuzzy Hash: 871130B18047488FCB20DFAAD549B9EBBF8EB48324F208459D519A7310C374A945CFA5

Function 059942F9 Relevance: 1.5, APIs: 1, Instructions: 45comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 05994355

Memory Dump Source

Source File: 00000002.00000002.1788156147.0000000005990000.00000040.00000800.00020000.00000000.sdmp, Offset: 05990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5990000_MSBuild.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: ca2f00281792cb3b19091deeca2e2279fc214f0fa3a876775b316251a61d8043
Instruction ID: 52e8b1e313d598f31f5e3e1a5195870ad7cb0b0f3283c2675d96f854fb781576
Opcode Fuzzy Hash: ca2f00281792cb3b19091deeca2e2279fc214f0fa3a876775b316251a61d8043
Instruction Fuzzy Hash: 301112B19007498FCB20DFAAC589BDEFBF8EB48324F24845AD519A7310C378A545CFA5

Function 059A2080 Relevance: 1.4, Strings: 1, Instructions: 179COMMON

Download Yara Rule

Strings

d^6j, xrefs: 059A2210

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID: d^6j
API String ID: 0-3612976577
Opcode ID: 5116f37b139808a9aeb7be9284793d88a2a471be01a080368a1f4eb624fc50cd
Instruction ID: 8e9d008431fddb6f6f73a9d7ea411e242da70f57ea22c938fc3ad019047f3529
Opcode Fuzzy Hash: 5116f37b139808a9aeb7be9284793d88a2a471be01a080368a1f4eb624fc50cd
Instruction Fuzzy Hash: 62514D35B007049FCB259F79D88896EBBF6FFC92107148629E54AD7365DB34EC058B90

Function 059A6247 Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

t]6j, xrefs: 059A62C0

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID: t]6j
API String ID: 0-2231782407
Opcode ID: 6a7fa95496be2d1d2431415487de27f1b3441f242706849299c4cc36fff442e4
Instruction ID: b3b095698f3c979c3f7412d423af260ff4e8fd7fedc9b40ad19ba837ead1691b
Opcode Fuzzy Hash: 6a7fa95496be2d1d2431415487de27f1b3441f242706849299c4cc36fff442e4
Instruction Fuzzy Hash: E1614C35A00205DFCB14DF68D598AADBBF6FF88300F148569E8069B361DB71ED46CBA0

Function 059A22C0 Relevance: 1.4, Strings: 1, Instructions: 165COMMON

Download Yara Rule

Strings

(bq, xrefs: 059A23AD

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 313a701566f30afbfc6725d5809b67ad9436196c1c459ae9904bc03aa844909f
Instruction ID: b9245064477b90ae638d3b057e049b0a79b3042deee7417b8ee5289e01163369
Opcode Fuzzy Hash: 313a701566f30afbfc6725d5809b67ad9436196c1c459ae9904bc03aa844909f
Instruction Fuzzy Hash: 4F51A035F002498FDB44AB78A41827EBBF7FFD5340B24456AD606D7381DE38AD068B95

Function 059A0651 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

t]6j, xrefs: 059A07ED

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID: t]6j
API String ID: 0-2231782407
Opcode ID: 258144e475c2487f375ceb3b95576087af6a27616a58a28ec90c60a6c9de7008
Instruction ID: 5a6a4c976cb7ee0ddc254c122f952b0a47646a8102ae0cd836674bd371718519
Opcode Fuzzy Hash: 258144e475c2487f375ceb3b95576087af6a27616a58a28ec90c60a6c9de7008
Instruction Fuzzy Hash: 35711875A00209DFCB15DF68D588AADBBB2FF48310F054468E806AB3A1DB75ED85CF90

Function 059AD9A0 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

PH^q, xrefs: 059ADAA6

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 4abd8717319e7a991ba5e1efad300b18eb0e1735572d680e225b6e55adfacc63
Instruction ID: fb00f41b8656db9d5ae7262f56555a31697a77154553627f70a05ae355ae33a2
Opcode Fuzzy Hash: 4abd8717319e7a991ba5e1efad300b18eb0e1735572d680e225b6e55adfacc63
Instruction Fuzzy Hash: FB51F532A083858FDB15CB79D80476ABBFABF81200F0D81AAD459C7655DB34E881CBE1

Function 059A5221 Relevance: 1.4, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

(_^q, xrefs: 059A5338

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID: (_^q
API String ID: 0-538443824
Opcode ID: d42c8a30814d105be1fa9bc233463647d13fd0fa924624461dfab62d6e8842c3
Instruction ID: df6e1824fc1914dd4107f02fcce6f2f73b27b2cb58feac53eb7c977c5a461991
Opcode Fuzzy Hash: d42c8a30814d105be1fa9bc233463647d13fd0fa924624461dfab62d6e8842c3
Instruction Fuzzy Hash: D551C131A04248DFCB05EFB8D8549ADBBF5FF89300F05856AE405AB351EF35A909CB90

Function 059A8078 Relevance: 1.4, Strings: 1, Instructions: 143COMMON

Download Yara Rule

Strings

(bq, xrefs: 059A80D6

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: a95a9b9cad9d927a1dc22817665315de82fb4282f28bf06fe252d39808e9b491
Instruction ID: ac56f9768d11d658017b32a1c3bc5c112fcd3600fe940be8d6d50fef22b71aa2
Opcode Fuzzy Hash: a95a9b9cad9d927a1dc22817665315de82fb4282f28bf06fe252d39808e9b491
Instruction Fuzzy Hash: 584183316002048FC725EF29D948A6DBBF6FFC4350B148A6AD14A8B365DF74E94A8BD1

Function 059AA978 Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

(bq, xrefs: 059AA9BC

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 4c2f90fd65c24b56de770e0f3a874b7f4a8c8709172a3dbb6090d05dca199510
Instruction ID: 30c2321986e8ecbe9002b8e8a6589c798855acfe27503fbafb61e5fb223cbed6
Opcode Fuzzy Hash: 4c2f90fd65c24b56de770e0f3a874b7f4a8c8709172a3dbb6090d05dca199510
Instruction Fuzzy Hash: 98116632B043584FD7059A39581467E7BEBDBC625071980ABD508D3382DE38CC068361

Function 059A6689 Relevance: .4, Instructions: 408COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4da6e9dcdf51a40dfd2c1cfeca5019599f83fc33bebde29bb2906535ee5a736a
Instruction ID: 1d2b151876631793adfcfea2fafef4372d499e816baced21018bb80ad695dbb7
Opcode Fuzzy Hash: 4da6e9dcdf51a40dfd2c1cfeca5019599f83fc33bebde29bb2906535ee5a736a
Instruction Fuzzy Hash: EF127E34A01208CFCB2ADFB4D5989ADBB72FF49355B60496DE406AB351CB36AD81CF50

Function 059A6698 Relevance: .4, Instructions: 403COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d12ca914e20714821dd52a7c1198c4887b214379bfaaee5feb40cc6a68438d1
Instruction ID: 23ced12b537b535c984e13f29b9d7169183cc6b64428e56917f32dc8362c6414
Opcode Fuzzy Hash: 6d12ca914e20714821dd52a7c1198c4887b214379bfaaee5feb40cc6a68438d1
Instruction Fuzzy Hash: 7D127E34A01208CFCB2ADFB4D5989ADBB72FF49355B60496DE406AB351CB36AD81CF50

Function 059AB258 Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5abb8cfbde01c16730c73ececf9defc2cf5e97a9e62c36e2b1d60c79bf224398
Instruction ID: 8891ef36838b286583959da8836c15a996008db722ccff10d66cdf4e7e0cd7cd
Opcode Fuzzy Hash: 5abb8cfbde01c16730c73ececf9defc2cf5e97a9e62c36e2b1d60c79bf224398
Instruction Fuzzy Hash: DA023F35A00719CFDB14DF78C854A69BBB6FF49310F118699E949AB361DB30E981CF80

Function 059A71F0 Relevance: .4, Instructions: 356COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 525c204240311c07a32592620f72ae4353fa2b7540326775d0d49adca22e47b0
Instruction ID: de7867ecaf9a6d50cce58eb7c44e5b81b6942b74cbf166484078ac5aad3c4187
Opcode Fuzzy Hash: 525c204240311c07a32592620f72ae4353fa2b7540326775d0d49adca22e47b0
Instruction Fuzzy Hash: 46D18B31B002498FDB14DBB8D499AADBBF6EF88340F158469E805EB395DF34DD058BA0

Function 059A9E5B Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0c059097bc4870b0ad95048f7571c66a85fe2a515402eefe404d8143b2449bd
Instruction ID: 53b25f06c1f98fc222160346ee2b5c9d78a41fe0223bf092d396ba7146b1af2a
Opcode Fuzzy Hash: c0c059097bc4870b0ad95048f7571c66a85fe2a515402eefe404d8143b2449bd
Instruction Fuzzy Hash: CEC1276E29816ADE8656EBBC2C8422E2571BECD31430FDC279435BB6C6CE5BC407C1D6

Function 059A77F9 Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fd75cfab81bdab49edb2decaccdd7c0e7468e9d83ef0ba74edf6c944be3d5f5
Instruction ID: ccfbd912a6b3941750094a802e29d78859b30509a67ee1ef081631aa2a8b7c17
Opcode Fuzzy Hash: 8fd75cfab81bdab49edb2decaccdd7c0e7468e9d83ef0ba74edf6c944be3d5f5
Instruction Fuzzy Hash: C5C15036B002059FDB04DFA9D8459AEB7F7FF88244B158529E806D7365EB34EC46CBA0

Function 059AB246 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 011369ccdb87c4cfd618606089f4e1634de318f492efe0f5542370f8584a7177
Instruction ID: 7d0d9174625a8c76f77d28e062ee983f6c863287b96f47515b3a7a8e85160dab
Opcode Fuzzy Hash: 011369ccdb87c4cfd618606089f4e1634de318f492efe0f5542370f8584a7177
Instruction Fuzzy Hash: ECC14F31910719CFDB11EF78C854A99B7B1FF49314F158699E8896B261EB30EAC5CF80

Function 059A5B28 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0b2a45be0f15755b37ff17f18d42cc5ce3167bbc0d70e1048658b1923a65f07
Instruction ID: e51f66367ad84d3be0154049adda30dd49a1d0decae1af37148954488e604eff
Opcode Fuzzy Hash: f0b2a45be0f15755b37ff17f18d42cc5ce3167bbc0d70e1048658b1923a65f07
Instruction Fuzzy Hash: F8A1E379A00249DFCB14DF68D888E99BBF6FF89320F164595E5059B362DB30EC85CB90

Function 059AAE10 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ac28691f0dbf11c01d37dc2ebff59fb36c95751582698e9ecfa75ef4742c7a5
Instruction ID: 633d097e0765f72cbc2a725045ea844070dc0d2a8713a1219783bd09f1b72cb5
Opcode Fuzzy Hash: 7ac28691f0dbf11c01d37dc2ebff59fb36c95751582698e9ecfa75ef4742c7a5
Instruction Fuzzy Hash: 5581B131A002059FC715DB68C988A6EBBFAFF88310F158169E51597366DB34ED46CBE0

Function 059A4830 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 049fccf28c40930f8c50821d5148e8a5a4060a563fca8256656dc8a370bef56c
Instruction ID: c12df8278c4f9d647487efdcc970ba4664213589548c5d5f31516bc60ffac3c3
Opcode Fuzzy Hash: 049fccf28c40930f8c50821d5148e8a5a4060a563fca8256656dc8a370bef56c
Instruction Fuzzy Hash: 7D81B131B002499FCB04EFB8C844AAE7BE6FFC9350B10856AE919DB355DF34E9158B90

Function 059ADBA0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1fe4e195e9650af66c551f8b6ceb376b525c1e783d381743bffcadad6c67a0b
Instruction ID: 4910e7d944351f3b65d2bd570c7bd0c04b79f7d874c7168502787448f9b26a1e
Opcode Fuzzy Hash: e1fe4e195e9650af66c551f8b6ceb376b525c1e783d381743bffcadad6c67a0b
Instruction Fuzzy Hash: 8D71E0367043059FCB10DF68D844E6ABBB6FF84310F05856AE55A8B7A1DB30EC45CBA0

Function 059A53D0 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7758a9048327419b65725b15b27730e311e8b6a50d22a2d418d6fc3ef011dc69
Instruction ID: 2397977ac9e22c9c6d14b93f9762f0bfb5b3bc2cf0063f2f75be9facb82b5b25
Opcode Fuzzy Hash: 7758a9048327419b65725b15b27730e311e8b6a50d22a2d418d6fc3ef011dc69
Instruction Fuzzy Hash: E181CE32B046048FCB14DF78D8846AEBBF6FF88310F15856AD44AD7651EB30E84ACB90

Function 059AE078 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b585f8e8bb12f29ecca58c4c7ffe6522941d7cb097c926bd7c6d30edaea29eb2
Instruction ID: a5ca43f8f2b2126602f4fa27ea3a666e10460635db168c7d375c2cdec67657f5
Opcode Fuzzy Hash: b585f8e8bb12f29ecca58c4c7ffe6522941d7cb097c926bd7c6d30edaea29eb2
Instruction Fuzzy Hash: A7618C31B002158FDB15EF78C894A6EBBF6FF85310B048969E9059B3A5DB34ED45CBA0

Function 059ACC80 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e97c34dcbe59285aeb24dab17a8064e38ff43b1af86c544a69b10db1b38cc5d9
Instruction ID: ad780ef4107735dad0190033ab1be46269f7b79f09782b8b6ec8c73ffa42615d
Opcode Fuzzy Hash: e97c34dcbe59285aeb24dab17a8064e38ff43b1af86c544a69b10db1b38cc5d9
Instruction Fuzzy Hash: D6519D357006149FCB04DF69D998A2ABBFAFF8860171480A9E506DB775DF31EC15CBA0

Function 059A5B19 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a98f9ca5d8140563ad6f97f5506cd40e997295e7f67198dc58821c63e26844c
Instruction ID: 4df1dfb0abd1a2d37a0e425361f5a2b02aa00b2f36537a498ab71adcf29181a2
Opcode Fuzzy Hash: 7a98f9ca5d8140563ad6f97f5506cd40e997295e7f67198dc58821c63e26844c
Instruction Fuzzy Hash: 1C510276A01209EFCB04CF59D884A9DBBF6FF89321F168565F5059B362DB30E885CB90

Function 059A0DB1 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92e5749513b27681cc8802470008673ece58bf78fcca1f183afbc718f4e7b242
Instruction ID: 561a61a1641b58a3007d78b1dc95cba69068cb3fdf849b2176c06e411affcd9c
Opcode Fuzzy Hash: 92e5749513b27681cc8802470008673ece58bf78fcca1f183afbc718f4e7b242
Instruction Fuzzy Hash: 3251E375B012199FCB04DF68D59899EBBF2BF88310B258659E815EB365CB70EC42CB90

Function 059AE068 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98ed83a930f1e7beccaa9466ea720f90a96d73a5a442b8fc4520368c6333b727
Instruction ID: 5c54c9ad69632a7525e05183c2078f9c38765b88989b304b538d50b25244a0d4
Opcode Fuzzy Hash: 98ed83a930f1e7beccaa9466ea720f90a96d73a5a442b8fc4520368c6333b727
Instruction Fuzzy Hash: 6B515F317002159FCB14EF68C984AAEB7B6FF84310F048969E5159B3A5DB34E945CBE0

Function 059AA710 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b789b394fdcfd7c105dc367b1479d5ce8d43247d1ff7a11e57de582058d24155
Instruction ID: f4988c6143d2ca952ce2383518eb6718ca4312dff351c54748f55f028c213b32
Opcode Fuzzy Hash: b789b394fdcfd7c105dc367b1479d5ce8d43247d1ff7a11e57de582058d24155
Instruction Fuzzy Hash: 2C412131A003058FCB15DF78D8456AEBBB6FF88314F144569E506AB355EF35E846CBA0

Function 059AA720 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6d2a2651ebf13ceae1eaefbb5fca0f02c8c46bed7065d6593aca78ffbebdbb0
Instruction ID: 2db968e6d92ccce5121e43c2f9e479e0186bd96592a510a675195d3cc1fe1c3a
Opcode Fuzzy Hash: a6d2a2651ebf13ceae1eaefbb5fca0f02c8c46bed7065d6593aca78ffbebdbb0
Instruction Fuzzy Hash: A6411E35A003058FCB15DF78D4456AEBBB6FF88314F148569E506AB354EF39E846CBA0

Function 059AD800 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25619964ddad385948a2ae3f2741dfbf537517642e055c8d7c5ebc93f54641c3
Instruction ID: 3eb11588913db48d6e8729e34dfbf76848397587696f1997a72e74a9b71f94a5
Opcode Fuzzy Hash: 25619964ddad385948a2ae3f2741dfbf537517642e055c8d7c5ebc93f54641c3
Instruction Fuzzy Hash: 1741B935E103099FC754AB74E448BEDB7B9FF89300F10862AE546A7351EF74A984CB90

Function 059A0006 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed172c8483aa2de70624a1ea1b74fcce299d538301e580aacd8971f6c3d3f8a2
Instruction ID: d94cb44c2896cf99219a92266d7b89d2969e4673625fe9c797b829748e940703
Opcode Fuzzy Hash: ed172c8483aa2de70624a1ea1b74fcce299d538301e580aacd8971f6c3d3f8a2
Instruction Fuzzy Hash: EC418631A14608CFCB05EF64D999A9DBFB1FF4A301F454499E401AB3A1DF34A94ACF91

Function 059A634D Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c206bc5344cd67955ffc6a2ada859c2ff4c9648fa65bf373a4c2f76bc6d8a53e
Instruction ID: 3359bee4d35fac1c3e146ed9648d3cbc42905ea2bb67960a7600f97ed4d6d0b6
Opcode Fuzzy Hash: c206bc5344cd67955ffc6a2ada859c2ff4c9648fa65bf373a4c2f76bc6d8a53e
Instruction Fuzzy Hash: 5E41FA75A00204DFCB04DFA4D594AADBBF6FF4D305F148469E906A7391DB36AD42CB60

Function 059A1518 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4fb9a8c47b7a5b7e9629ec3d7b53af965bf3880976c4503967f26046f662730
Instruction ID: 8b23548a3ec3194c2f4072e1010bef5e95aed8e1a3c39f3fdac9894e8dad2388
Opcode Fuzzy Hash: b4fb9a8c47b7a5b7e9629ec3d7b53af965bf3880976c4503967f26046f662730
Instruction Fuzzy Hash: 96218071B006098FCB11EB69D9849AE77B6FF89200F404269D5069B365EF30ED49CBA1

Function 059A562F Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6866cabe01d883285948c3458370ae611635543d0cf24c52b67306c1c51f5b80
Instruction ID: 9252f0ff7dcacf569755b70ae9d12a3a84e0b8911d7793faac7be0d387664276
Opcode Fuzzy Hash: 6866cabe01d883285948c3458370ae611635543d0cf24c52b67306c1c51f5b80
Instruction Fuzzy Hash: 0F219C726046089FC711EB68C880E9BBBF9FF45314F01456EE142CB651EB30F946CB90

Function 059A1509 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a132dba2210630663b558cea1cacd80c9c10e88d0547a235f2779f6c4d602f85
Instruction ID: 61748cd281fc2953fd1fe87491d5f54a7631c776a83007c0fe37defe27b2dca4
Opcode Fuzzy Hash: a132dba2210630663b558cea1cacd80c9c10e88d0547a235f2779f6c4d602f85
Instruction Fuzzy Hash: 3F21B731B007498FCB11EB68D9549AE7BB6FF89200F40416AD5069B365EF34DD49CBD1

Function 007FD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1780615032.00000000007FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7fd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a6a9b7cf306012582770e9d59a7e2812b6e7f67c534eaabbc9aff627f77e885
Instruction ID: 4729f8b090149d4547052ab5206bd5b69fc1936d6423ed369857266a93a23652
Opcode Fuzzy Hash: 3a6a9b7cf306012582770e9d59a7e2812b6e7f67c534eaabbc9aff627f77e885
Instruction Fuzzy Hash: D5212871504248DFCB25DF14D9C0B36BF66FB94318F20C569EA050B356C33ADC66D6A1

Function 0080D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1780726713.000000000080D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0080D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_80d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66304083c56d650c4f220383bc0ca4ff3706e2fe9555e141a00ac8b8229b96a7
Instruction ID: f48541c1794cb8ffd5dcce0506f9d7b8ec77b3171e674f956f98a6936f02c3dd
Opcode Fuzzy Hash: 66304083c56d650c4f220383bc0ca4ff3706e2fe9555e141a00ac8b8229b96a7
Instruction Fuzzy Hash: 7721F271604704DFDB54DF54D984B26BBA5FB84318F20C569D84E8B296C33AD847CA61

Function 059A2550 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b58157d7ce22a2495034292055c48f48d61cf7a230e6af96e468357a674d8673
Instruction ID: 9408a2d9aa9078bff7630cb06725bd20b4d8c37de4092b0b2f22c161da190859
Opcode Fuzzy Hash: b58157d7ce22a2495034292055c48f48d61cf7a230e6af96e468357a674d8673
Instruction Fuzzy Hash: 81212579B005058FCB04DF69D998C5ABBFAFF89614B2540A9E905DB331CB30EC05CB60

Function 059AF970 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53b9f18806cbf3d141150b30586fa965247c979a78421ba423e9e84d2aad18ab
Instruction ID: d640fe104ffb63df2d1634e59832b346487aa7adbb59ce190afae7af1b104916
Opcode Fuzzy Hash: 53b9f18806cbf3d141150b30586fa965247c979a78421ba423e9e84d2aad18ab
Instruction Fuzzy Hash: DE214A7A7045149FC744DB29E888D6EBBEAFF89711715816AF409CB361DB31EC058BA0

Function 059A2560 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 824609a963b955ea0089d23741bcd66450125b6aafd814a3d94f743836fd32d9
Instruction ID: 6fe04405f7e299d25e04469b2fd35c9f4171a415dd3166527aca275cd3f7f0a5
Opcode Fuzzy Hash: 824609a963b955ea0089d23741bcd66450125b6aafd814a3d94f743836fd32d9
Instruction Fuzzy Hash: 2921B379B005158FCB04DF69D99886AB7FAFF89615B2140A9E906DB331CB70ED05CBA0

Function 059AADF0 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0f196d520751002fb641552396dc31ed8c882b9a4f212990fa9c6dce56c569c
Instruction ID: edc6b1de0b0d7d18c2570bcaf3d459851d07a92799e98e9df7be8dd806327216
Opcode Fuzzy Hash: c0f196d520751002fb641552396dc31ed8c882b9a4f212990fa9c6dce56c569c
Instruction Fuzzy Hash: 4921A172A0425A9FCB01DFA8C880AAEFBF9FF44314F158166D550D7252D730E945CBE0

Function 059A0F78 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bf178d1557b5da0f014ce07a95ce30112038cd04e568909239e7aa56d4c5aff
Instruction ID: 8171f2f5f2b583a0d51f34dd8892ecdb7b8f7a753a330dac55678e5b3b2b0f67
Opcode Fuzzy Hash: 0bf178d1557b5da0f014ce07a95ce30112038cd04e568909239e7aa56d4c5aff
Instruction Fuzzy Hash: EE11AF326407149FC321CF2AC944A5BBBE6EFC9314B04897AE489CB761DA71FC468BD0

Function 059A16C7 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75aefa19f12322ecd5edceb2b090d7399b06fcb07f95cdc5810a755c900fabb4
Instruction ID: d3588bf491c6c1766244303c72b3288cba7ee8c23abf318566e841aa52749a30
Opcode Fuzzy Hash: 75aefa19f12322ecd5edceb2b090d7399b06fcb07f95cdc5810a755c900fabb4
Instruction Fuzzy Hash: 67118CB23093488FD30697B8A80127D7F95CFC5254F1981F7E658CBB92D925D907C791

Function 059A5098 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e94fdeff941119f861eddab311711583f2d630ff1cc99947a54fd2599337a9be
Instruction ID: 182844a28c87c14a254ba087beec114fc4e461edf38e6556f351c9e2a0b29d73
Opcode Fuzzy Hash: e94fdeff941119f861eddab311711583f2d630ff1cc99947a54fd2599337a9be
Instruction Fuzzy Hash: 8D211531A002088FDB18DFA9D548ADDBBF6FF8C311F15806AD405B7250EB719984CFA0

Function 007FD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1780615032.00000000007FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7fd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: ac381f4bb18569f08c8331cf7c02f00690a7231e067a17df1bc55b5f44ff78ff
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 1C11D376504284CFCB16CF14D5C4B26BF72FB94318F24C6A9D9490B756C33AD86ACBA2

Function 059ADF8A Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1e69317780dd384d923f781bac97917931e88085874d847f16a811a8f1ae088
Instruction ID: ad0e26635ca836e09bb2052c95fc8670f35361661703fefabb23a52a0dbff72e
Opcode Fuzzy Hash: d1e69317780dd384d923f781bac97917931e88085874d847f16a811a8f1ae088
Instruction Fuzzy Hash: D8114871E002199BDB04DFA8E954ADDBBF6FF89310F14412AE804B73A0CB35AC41CBA4

Function 059ADF12 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70ca349ae807d7548ab65430f641d73a2df4fa42b3a7c8d28f56d5b95e080a2c
Instruction ID: 4f5bdd6ce42ccb8053a51cdafa73fc2397b0e114430bd5317df704abedddec6e
Opcode Fuzzy Hash: 70ca349ae807d7548ab65430f641d73a2df4fa42b3a7c8d28f56d5b95e080a2c
Instruction Fuzzy Hash: 6A112871E111199BCB04DFA8E954ADDBBF6FF89310F14502AE404B7760CB35A841CBA0

Function 059AA969 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b2d627668178d327d958054105e58d0c72d66d27a736889376fa1e9de3dc05d
Instruction ID: bc4933908a6c7e130b7a30be140df301617bba7da51c55b2099a7f305a9d68c1
Opcode Fuzzy Hash: 7b2d627668178d327d958054105e58d0c72d66d27a736889376fa1e9de3dc05d
Instruction Fuzzy Hash: 1801D432B083545FD7069A39581576E7BFBDBC5250F0980A7D544D7382DE28C90287A1

Function 0080D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1780726713.000000000080D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0080D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_80d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 3be3a9b1e166b9522f44902ad43285d2c7e2c59cbd312116f8e84a6f806dd698
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: B011BB75504780CFCB11CF54D9C4B16BBA2FB84314F24C6AAD8098B696C33AD80ACBA2

Function 059AEA0A Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0849bd7820192fa0323c945b3f377eb1ed98ee352a39d2bb7775687bb33ea38
Instruction ID: f9e5b75e25ef1e50f4611f83e0f66827c8c71f63bb3aea0f172ddfbe43b25ac4
Opcode Fuzzy Hash: e0849bd7820192fa0323c945b3f377eb1ed98ee352a39d2bb7775687bb33ea38
Instruction Fuzzy Hash: 6D1130763001119FCB15CE19C884B6AB7AEFF88711F198055F919CB269C734DC41CBA0

Function 059A0520 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0aee941899b10144f14c2deb919fbdc195506b77b5647a93d2563f96f6f8472
Instruction ID: 867aa3edf175bf680bded45f428756a6b846253af591f629dfe8cf11b6d9f35d
Opcode Fuzzy Hash: a0aee941899b10144f14c2deb919fbdc195506b77b5647a93d2563f96f6f8472
Instruction Fuzzy Hash: 1C11A176A10608CFCB40DFB8D845DAEBBF4FF49311B01466AE905E7360E771A945CBA0

Function 059ADF98 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e84526680b5e69abb63f38fc2a7bf484122c5ee15f23e507a03bcfed020df2a1
Instruction ID: 4ab7f27d807c3d8cdba4da9762f0f72de4336b1ca5476f215906a5189226d36e
Opcode Fuzzy Hash: e84526680b5e69abb63f38fc2a7bf484122c5ee15f23e507a03bcfed020df2a1
Instruction Fuzzy Hash: 94112371E012189BCB04DFA8E944ADDBBF6FF89310F10902AE804B7360CB356C40CBA4

Function 059AE980 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 902af4c862b47bff8e8f44f842e7636629d94a007e26b8f16490554f62b8b61f
Instruction ID: 47e6528622279d7ed45b8943cafdea1f8a3e7350c641a6c3b617159d0a74ddd6
Opcode Fuzzy Hash: 902af4c862b47bff8e8f44f842e7636629d94a007e26b8f16490554f62b8b61f
Instruction Fuzzy Hash: F411B675904208EFCF41CFA4C944AA9BBF5FF48210F1484A9E949D7251D732DA61EFA1

Function 059A0530 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d31fb4aee3f8c9f38a5c91a45581cf01d2d5ddbc8260af3ac2c2b89974300eea
Instruction ID: 32d9715cd0794fa2087b372ae9e22c9b2bf7251e00451859d26f48a08b62f285
Opcode Fuzzy Hash: d31fb4aee3f8c9f38a5c91a45581cf01d2d5ddbc8260af3ac2c2b89974300eea
Instruction Fuzzy Hash: 40014075A106099FCB44DFA8D888CAEBBF9FF89211B10456AE905D7320DB71A944CBA0

Function 059AE8D2 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0b45a99f9989b407e08a24124a8af7445c77080c29a512e4d5043d2347f94fc
Instruction ID: a0f026b8e4282ab63c79a0bb8cabb958e6db6344b684b64edc546b0ec5a7d0cd
Opcode Fuzzy Hash: a0b45a99f9989b407e08a24124a8af7445c77080c29a512e4d5043d2347f94fc
Instruction Fuzzy Hash: 0D01DB32A043559BCF15DBA9C8146EEBFFAAF88300F084469D451F7251CB359904DBB0

Function 007FD655 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1780615032.00000000007FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7fd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cebe687501c8cc3cfbe21edbd173ff692d372a8db6d42e6c109840c47e5a0b7c
Instruction ID: c92fff23657d0f37e3b4c2bc70c3ccf5f4af387386ae3307e66a5bd32c203879
Opcode Fuzzy Hash: cebe687501c8cc3cfbe21edbd173ff692d372a8db6d42e6c109840c47e5a0b7c
Instruction Fuzzy Hash: C7012B310083489AE7309B19CE84777BF99EF45364F18C46AEE0C8A386C67DDC40CA71

Function 059ACE50 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f882fa78b89d2a53794ef298dc5fa105a961c6b3b7edcceed958d20190afc895
Instruction ID: f7e23fe56954fe176be11a9171c38cca6fca0b2317ea3341dd087869be1a09e9
Opcode Fuzzy Hash: f882fa78b89d2a53794ef298dc5fa105a961c6b3b7edcceed958d20190afc895
Instruction Fuzzy Hash: AB0188353605109FC704DF69D444D65B7E9FF89B5231640AAF606CB371DA72EC51CB90

Function 059A05E0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47a973cb38afd3236fa66654eabee5d118f7f303fc6b65c42a35e9cd1a6e934f
Instruction ID: c36d49bbdd5f0a24a63515759d9a8d056ba5a41f5fe8dc4a7e679a1982ca12b3
Opcode Fuzzy Hash: 47a973cb38afd3236fa66654eabee5d118f7f303fc6b65c42a35e9cd1a6e934f
Instruction Fuzzy Hash: F0014F72A0001AAFCB01DF98CD05EDE7BBAEF49314F154165E614EB2B1D7319A15CBD1

Function 059AA6A0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 485d77266b533faa0a7e0717d92608860f664b56df9a0d0725adde8f52ff6de3
Instruction ID: a7d36b6633077ec1220380bc9fc38a9be8ea62622742ef1ee2c9c8978e07b505
Opcode Fuzzy Hash: 485d77266b533faa0a7e0717d92608860f664b56df9a0d0725adde8f52ff6de3
Instruction Fuzzy Hash: F001AD71B042149FDB15DBA8D889BAEBFFAFB89210F050529E246D33A1CB319845CBD0

Function 059AE8E0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 653fbc8841bc3dbb08fb2164c2739c2b7d8f898b703722c4016af9835253b57d
Instruction ID: f0fc36d5093d80195e81f4a6ee6ec2d0e90d13e029744575de5b9422ced372d9
Opcode Fuzzy Hash: 653fbc8841bc3dbb08fb2164c2739c2b7d8f898b703722c4016af9835253b57d
Instruction Fuzzy Hash: ED01B532A043599BCF25CBA5C8146AEBFFABF88300F04446DE552B3250CB359904DBB0

Function 059AA630 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2da4630b2d68b455a0eed8d30a8f0eb2fed1156bad7f169b0eceb0c067f83b9
Instruction ID: 015d1c6e472d58f4dde5dc3c34e34f7a739fe9db809a0b4cf85a1c992f9be21b
Opcode Fuzzy Hash: c2da4630b2d68b455a0eed8d30a8f0eb2fed1156bad7f169b0eceb0c067f83b9
Instruction Fuzzy Hash: BBF04F323142118BCB159A69D444B69B7EAFFC9265B0A4469E44AC7791CB31CC42CB90

Function 059A781F Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c5a81f6d77666316917c566eb7a8951ef4a3d05f38ca4e0b2526e4a9539ee18
Instruction ID: 867d50a759dc59f4c899be749a416c7867a2d4ff2d1d2a998590b610dcbe8900
Opcode Fuzzy Hash: 3c5a81f6d77666316917c566eb7a8951ef4a3d05f38ca4e0b2526e4a9539ee18
Instruction Fuzzy Hash: CFF0E9337002146BDB059E99EC55EEFB7AADFC8260F044426E912E7351DF219C5586E0

Function 059AEB38 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a2a8b3ec3e1254a56dd0e368fb96744e279eb5f159125ff3bd84d0f9f24cab7
Instruction ID: c517d20a9d305b40a7368dd6b70d9dad452821ff9ac326b11a343798cdc35047
Opcode Fuzzy Hash: 1a2a8b3ec3e1254a56dd0e368fb96744e279eb5f159125ff3bd84d0f9f24cab7
Instruction Fuzzy Hash: 2A01F676600625AFD705CE49D988DAAF7EDFB88321705C666F919DB701CB34E842CB90

Function 059A1740 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f8ccbed4650e65571fee7db1c20747aae1dd0b2e1dfa5e47286944c570f212b
Instruction ID: e0bad8f75fc999b8c674f2963915cc8ccbebf7a0f3de90d2ae1f969214f6b6cc
Opcode Fuzzy Hash: 6f8ccbed4650e65571fee7db1c20747aae1dd0b2e1dfa5e47286944c570f212b
Instruction Fuzzy Hash: 6501D470909309CBE742EF68E80977E7BF5EB41308F088499D552A7691CB784605EBE1

Function 059A769D Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 114f0300dafa49e9f99f353c324a04b0f58148e3612c66e3f9604d4d6aca03d8
Instruction ID: 1c3130b999b758f42224d2ac59f942018b1a35164bbcfd9d370e6f4f7a5b9a2f
Opcode Fuzzy Hash: 114f0300dafa49e9f99f353c324a04b0f58148e3612c66e3f9604d4d6aca03d8
Instruction Fuzzy Hash: 07F019367406058FCB05EBA8E559AAC77B2FB88321B250469E406DB3A0DF35ED45CBA1

Function 059AA6B0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72666a68d36412b91895de1b1dda8166a6d27a363b2b95e22da7bba945513deb
Instruction ID: a9ff1053a3c75616f90d5b853f2ccda3c0e0e42a145b21059c37fccd4c61a581
Opcode Fuzzy Hash: 72666a68d36412b91895de1b1dda8166a6d27a363b2b95e22da7bba945513deb
Instruction Fuzzy Hash: D3F08C75B002149FCB159FA9D888A6EBFF9FB88210F040129E50693361CB709845CBD0

Function 007FD654 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1780615032.00000000007FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7fd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 707a41ec0306e8387be6d537dba0d4afba69ee5f9f62ff37f4275a0f3574bf8e
Instruction ID: b35eeeab1a7818213b2ad3e949674f3035423630431dd690144819780dc5d429
Opcode Fuzzy Hash: 707a41ec0306e8387be6d537dba0d4afba69ee5f9f62ff37f4275a0f3574bf8e
Instruction Fuzzy Hash: 9AF062714083449AE7208E1ADD84B66FFA8EB55764F18C45AEE0C8A396C2799C45CAB1

Function 059A05F0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7ad34fab37a9e501bdcc71b10c563b6577e5282bb72c719ca805c93a3979e14
Instruction ID: b241f44ad108a2f5a9bdcc6300f34e89d3348b8aac55a9413de48ad77774a977
Opcode Fuzzy Hash: d7ad34fab37a9e501bdcc71b10c563b6577e5282bb72c719ca805c93a3979e14
Instruction Fuzzy Hash: 38F0193690010AAFCB00DF98D904DDEBBB6EF49310B1181A5E618AB270D732AA15CB91

Function 059AA640 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 342069fef979e55c8fc56fb6422096fbaad388d67544c6d75d831da17e7faf45
Instruction ID: 32617a0b910fd54ac947408707cbc19936b404fcdf2b83cad19812efd25a59ad
Opcode Fuzzy Hash: 342069fef979e55c8fc56fb6422096fbaad388d67544c6d75d831da17e7faf45
Instruction Fuzzy Hash: 96F06D313102058FCB199A69D448A2677EBEFC92257164469E00AC7360CF31CC42CBA0

Function 059A1661 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22c94ad86d58674ac36270741c61a55e5b634464a3b8ec8eaa16e04d209d9e8d
Instruction ID: 876cd96680f9eceecfc30ddc85580fbeed3a1a1537f80bf1b379c7408213a5da
Opcode Fuzzy Hash: 22c94ad86d58674ac36270741c61a55e5b634464a3b8ec8eaa16e04d209d9e8d
Instruction Fuzzy Hash: 4DF0B43316D7954BE7224364EC113793F9ADF86214F0D40A39488CFAD2C659C80697E1

Function 059A3387 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: badcfd2462a14838762fc46066bb3066dcea26b4d6701cd57affc9ca0920c0bb
Instruction ID: bfcae624212c85e5cedf8bf18b664876e20e5bb7fe795e103f24ec72d37cc9d5
Opcode Fuzzy Hash: badcfd2462a14838762fc46066bb3066dcea26b4d6701cd57affc9ca0920c0bb
Instruction Fuzzy Hash: EEF09036B04109DFEB149F58F8448AAF33AFBC0325750C576E61987210CB32A866CBE1

Function 059AFA29 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1df8014448991cfbc3768b29cf20135a47d8cf658ae98822a13ed10e2b5ea2b
Instruction ID: 0fb3b2a1bf265546a5a397fe4bfb78099ef0b231c046ce8d4b1b491b9f1c7b0e
Opcode Fuzzy Hash: e1df8014448991cfbc3768b29cf20135a47d8cf658ae98822a13ed10e2b5ea2b
Instruction Fuzzy Hash: BBF0A072F00229AFCB44EF7CD8416DDBBF5EF48210B508066E809E7241E7309A00CBD0

Function 059AFD17 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b700aeef57eaac57e959f375a27371889009df2c6d8e6119cc4dd5e39b64a712
Instruction ID: b01b8ccb5f138bf3f4222bfc6677835d3ca24db83cf49ad03d9d9b44f35ea8fc
Opcode Fuzzy Hash: b700aeef57eaac57e959f375a27371889009df2c6d8e6119cc4dd5e39b64a712
Instruction Fuzzy Hash: A2E092353883545FD31596ACC418B5AB7DDBF49344F454468E14ACB6E1DB60D841C7E0

Function 059A4FF2 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1144a22a50a87ee687e7c051b884ee210d2cab500fb7059661ff91e24e5ae6ee
Instruction ID: 13235cbd4dd5799cca0b9f7ac4aefb2bb98f2b84eef3f459a6aa708d9f88d41e
Opcode Fuzzy Hash: 1144a22a50a87ee687e7c051b884ee210d2cab500fb7059661ff91e24e5ae6ee
Instruction Fuzzy Hash: ACF05872D0021A8FCB40EFBCDA412DEBFB0AF05200F54456AD958E7215E7348A64CBC1

Function 059AFD28 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc714a246ea67fddd3cfb41ccfe271c81f78c0d061e0880c560d8e790884d4ba
Instruction ID: 1159331c9c5474eff8034687be71050ab098cf5984d52cd5696c18e4fc212beb
Opcode Fuzzy Hash: bc714a246ea67fddd3cfb41ccfe271c81f78c0d061e0880c560d8e790884d4ba
Instruction Fuzzy Hash: F7E04F327442445BD314A6A99404B66B7DDBB45364F44446AE21ACB6A4DB61E840C7A4

Function 059A1688 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90223024e3474aac9b5e38d7c416a5ec7aec185724f8ad6fb4a6c026479de323
Instruction ID: 32fe37eb137adb6b74c8f1cbf87d29b119953e64d738d5a1b2086ba4d7467470
Opcode Fuzzy Hash: 90223024e3474aac9b5e38d7c416a5ec7aec185724f8ad6fb4a6c026479de323
Instruction Fuzzy Hash: 28E0863326462603DB255398F4157B577CEDBC4624F184177E40DCFB81CA95985197E1

Function 059A5000 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3f40d3b8547dc780c657bcb56546cf2267ea85c185c7e4c6f13ff4267cf1705
Instruction ID: 6974fada4d23df8e8cbb38b9a0d1f31ebe1ddb0c53b56c2fee699159a142edac
Opcode Fuzzy Hash: c3f40d3b8547dc780c657bcb56546cf2267ea85c185c7e4c6f13ff4267cf1705
Instruction Fuzzy Hash: A7F01571D006198FCB40EFB8D9012DEBBF4AF05300F108126D949E7210E7309A548BD1

Function 059AFA38 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4be2dfe8413ae7f08a1a4e04cb940eed2523e059359f04a593969ebb8c9b6e5
Instruction ID: 737f4313e84b6b4dbd7a77fa570cfe4e8e989954ae60e6a8223f2319e4ab0bd0
Opcode Fuzzy Hash: b4be2dfe8413ae7f08a1a4e04cb940eed2523e059359f04a593969ebb8c9b6e5
Instruction Fuzzy Hash: 5DE0ED71E00218AFCB44EFA8D4055EEBBF5EF48210B108166D519D3200E7305A10CBE0

Function 059A5313 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6d20315596fc72e6eef0694296ef625631382f87c8ca90f92803d6cee49ef1b
Instruction ID: cea2b68ef85fd31540dbbf1f902ded9b64fd0584d78f59139251e42a5f06e42e
Opcode Fuzzy Hash: c6d20315596fc72e6eef0694296ef625631382f87c8ca90f92803d6cee49ef1b
Instruction Fuzzy Hash: CAE09232A04609CFCB00EF60D41969DBBB1AF49344F214919D802B7250EB7455C4CBD1

Function 059A6C77 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 738e9b32cdc9d55597842d4dc5f895ac2ebc91f1e494bdc95fd965aca694f7ce
Instruction ID: 393f5b1287350e9762ab8637518e730308cdc43766b2afa3e6e6d971bc79dff6
Opcode Fuzzy Hash: 738e9b32cdc9d55597842d4dc5f895ac2ebc91f1e494bdc95fd965aca694f7ce
Instruction Fuzzy Hash: D4E0CD323104914BDB15A714D41A77D3F13DB80795F58857AF806CB781DF39490787D4

Function 059A3F60 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45d2ab68a2c595135b984ff75fd6dbf150ef5f07398829dc1f2acb4711d3e626
Instruction ID: fc71cd76deb8b1198d0cf7fb58800287eed70a74222351088472d9050d260fb1
Opcode Fuzzy Hash: 45d2ab68a2c595135b984ff75fd6dbf150ef5f07398829dc1f2acb4711d3e626
Instruction Fuzzy Hash: 80E08636700460CFC7049B2CD50465E7BE69BCC226B19009BD049C7362CB35DC478B80

Function 059A3F70 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b77f7e19f4a7191b6f7dfdc3ab310a50c8a1e48996f2eb2727303edc9e12f5e
Instruction ID: 49c7db3eb4b0afecc0e231850773a136a863fc0d9dd6b621a5dff4f75b82c734
Opcode Fuzzy Hash: 3b77f7e19f4a7191b6f7dfdc3ab310a50c8a1e48996f2eb2727303edc9e12f5e
Instruction Fuzzy Hash: F3D017327101209F86049A5EE90486ABBEEDFC962132540AAE109C7362CA61EC028B90

Function 059AA8E8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baaa41c0f8ea734f9a1ebf5cc6cdacac58ce2aa754cf841e10b435b2f6b3664f
Instruction ID: 83a509449c180863ff179bf34eb03398eccdccae4ee7197384adfbcaf2774f2a
Opcode Fuzzy Hash: baaa41c0f8ea734f9a1ebf5cc6cdacac58ce2aa754cf841e10b435b2f6b3664f
Instruction Fuzzy Hash: BAD0C9713880289FF2467618FC257BF2996DB8922CF1A01556E82D77DACA98DD4302C1

Function 059A14D9 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d18d8cb6e201cc4f4899f400bae9b44f6f3bd7c7e950af2f3f42a0a9e0cabec8
Instruction ID: 5e281efb3f54653fd07b60d24a5f9d35d07981a92b42ac55abb6c537dce9ecb2
Opcode Fuzzy Hash: d18d8cb6e201cc4f4899f400bae9b44f6f3bd7c7e950af2f3f42a0a9e0cabec8
Instruction Fuzzy Hash: E1D0A771424A465FCF01FB34FC98F453F61FB05741F0C0080D15281026E22052178B41

Function 059AA610 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96b94bc2ee8a854ff670de7da4e136f12457cb2b22d1a690c184279d42d7194d
Instruction ID: 56adabd1e6ec56d874bc1819c528fc5b2f28b69658939c6ddf3e47d3b684f684
Opcode Fuzzy Hash: 96b94bc2ee8a854ff670de7da4e136f12457cb2b22d1a690c184279d42d7194d
Instruction Fuzzy Hash: 3EC08C31190208CFCB04ABE8F048DB93BADFF9822931140A1F61C87631EB22EC00CE90

Function 059A015E Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 506a8200645e612c39a6da061621a9c9dd6ae783ec1775d5f68d8769075b2e99
Instruction ID: c8c4084fe2c50e42b4b98116c75f13d859737af6e2e427cf9ad6f648556f740e
Opcode Fuzzy Hash: 506a8200645e612c39a6da061621a9c9dd6ae783ec1775d5f68d8769075b2e99
Instruction Fuzzy Hash: 23D0927154120ACFD710DF90C269BAE7FB1FB44344F600818E002AA651CB764A85CFE1

Non-executed Functions

Function 0599B609 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788156147.0000000005990000.00000040.00000800.00020000.00000000.sdmp, Offset: 05990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5990000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46b1cc8d33d02a8757a56305e053f98b1a620c223f6857cec88c04597cdf393a
Instruction ID: 9bc62db777d90056bfad6181e90121ded5c5164fd2cad4232ac6ebdae97ef4df
Opcode Fuzzy Hash: 46b1cc8d33d02a8757a56305e053f98b1a620c223f6857cec88c04597cdf393a
Instruction Fuzzy Hash: 0FC1C374E01218CFDB58DFA9D890B9DBBB2BF89300F1085A9D419AB355DB346E46CF40

Function 0599B618 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788156147.0000000005990000.00000040.00000800.00020000.00000000.sdmp, Offset: 05990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5990000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cda16e3c6e9ef8c32c8d0f13e46e4b55cd0dd684ffdf39480b1bb9ea84dc130
Instruction ID: ec7d1802789cdda9e9284da73bf99a1ff952bcdc6392b53e294b8c3b41a53a67
Opcode Fuzzy Hash: 5cda16e3c6e9ef8c32c8d0f13e46e4b55cd0dd684ffdf39480b1bb9ea84dc130
Instruction Fuzzy Hash: 07C1C374E01218CFDB58DFA9D890B9DBBB2BF89300F1085A9D419AB355DB346E46CF41

Function 05993CC0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788156147.0000000005990000.00000040.00000800.00020000.00000000.sdmp, Offset: 05990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5990000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba289052e2f9f1e3d5c1c5098eafd593acd27810e49c2eb1ac078e7c034491c
Instruction ID: 154ba22a9795df15a93e780037204b01a9dfd212dcabb8512e2143192c9c8519
Opcode Fuzzy Hash: 9ba289052e2f9f1e3d5c1c5098eafd593acd27810e49c2eb1ac078e7c034491c
Instruction Fuzzy Hash: C4218275A00318CFDB04EF98D8C2AADFB75FB89300F604155E649AB352E6719D81DB80

Function 05993C92 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788156147.0000000005990000.00000040.00000800.00020000.00000000.sdmp, Offset: 05990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5990000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34c37a0ab2a0b6745e8d3e278aea6161b29a552c517ffb8696f613f7634b78b6
Instruction ID: ba7912e01d44e88df2e9a8b0cc87d83174f0e648cb6a228526de4fb55dc67a50
Opcode Fuzzy Hash: 34c37a0ab2a0b6745e8d3e278aea6161b29a552c517ffb8696f613f7634b78b6
Instruction Fuzzy Hash: 1901E434A452189FCB04CF88D845AECB7B5FB8A311F205559E919AB261D731ED11DB90

Function 0599A93B Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788156147.0000000005990000.00000040.00000800.00020000.00000000.sdmp, Offset: 05990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5990000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d29d560fc9476e35a055e5752588f6dd7fe491156127aff2bfc88f3332fa282
Instruction ID: f8def8b431b5ef92dc242ea6ca5cb27123748c4bf2b2425950258db322e2be8a
Opcode Fuzzy Hash: 3d29d560fc9476e35a055e5752588f6dd7fe491156127aff2bfc88f3332fa282
Instruction Fuzzy Hash: C8E09230C4910FDAEF18CF95C015BBFF675FB45305F619845880973280DB704A448F66

Function 0599D07C Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788156147.0000000005990000.00000040.00000800.00020000.00000000.sdmp, Offset: 05990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5990000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d653bdca5637fea1c400f396ff27443a780b55af78251a420745146528d3adbb
Instruction ID: 1245a10b920420f66d8aab7b9250d5d23fd35330bf83594d413b89f0d5b192e4
Opcode Fuzzy Hash: d653bdca5637fea1c400f396ff27443a780b55af78251a420745146528d3adbb
Instruction Fuzzy Hash: F1F0A570948219CAEF289F68DC987BEBB75BB06305F509455C00677290C7B40685DF94

Function 059A29D7 Relevance: 32.8, Strings: 26, Instructions: 278COMMON

Download Yara Rule

Strings

D6j, xrefs: 059A2CB3
D6j, xrefs: 059A2CD8
D6j, xrefs: 059A2A19
D6j, xrefs: 059A2AF7
D6j, xrefs: 059A2A88
D6j, xrefs: 059A2C8E
D6j, xrefs: 059A2BB0
D6j, xrefs: 059A2D6C
D6j, xrefs: 059A2D91
D6j, xrefs: 059A2CFD
D6j, xrefs: 059A2A63
D6j, xrefs: 059A2C1F
D6j, xrefs: 059A2AD2
D6j, xrefs: 059A2AAD
D6j, xrefs: 059A2D47
D6j, xrefs: 059A2A3E
D6j, xrefs: 059A2BD5
D6j, xrefs: 059A2C44
D6j, xrefs: 059A2BFA
D6j, xrefs: 059A2B8B
D6j, xrefs: 059A2C69
D6j, xrefs: 059A2B1C
D6j, xrefs: 059A2B66
D6j, xrefs: 059A2B41
D6j, xrefs: 059A2D22
D6j, xrefs: 059A29F4

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID: D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j
API String ID: 0-4048127968
Opcode ID: b47a39c56bb9c1aec68efd9e8b56f0951d1e4f238bc910f3bfdeb81f15ac41b7
Instruction ID: 2efd11af226d537540e3af6e82872ad075fa73cdd50a84a7ecda873e943c2994
Opcode Fuzzy Hash: b47a39c56bb9c1aec68efd9e8b56f0951d1e4f238bc910f3bfdeb81f15ac41b7
Instruction Fuzzy Hash: 1B91A731300B00AFD6056FA5DC51E7EE653FB86700B504438E20A4F7A9DFB6AE1E4796

Function 059A29E8 Relevance: 32.8, Strings: 26, Instructions: 273COMMON

Download Yara Rule

Strings

D6j, xrefs: 059A2CB3
D6j, xrefs: 059A2CD8
D6j, xrefs: 059A2A19
D6j, xrefs: 059A2AF7
D6j, xrefs: 059A2A88
D6j, xrefs: 059A2C8E
D6j, xrefs: 059A2BB0
D6j, xrefs: 059A2D6C
D6j, xrefs: 059A2D91
D6j, xrefs: 059A2CFD
D6j, xrefs: 059A2A63
D6j, xrefs: 059A2C1F
D6j, xrefs: 059A2AD2
D6j, xrefs: 059A2AAD
D6j, xrefs: 059A2D47
D6j, xrefs: 059A2A3E
D6j, xrefs: 059A2BD5
D6j, xrefs: 059A2C44
D6j, xrefs: 059A2BFA
D6j, xrefs: 059A2B8B
D6j, xrefs: 059A2C69
D6j, xrefs: 059A2B1C
D6j, xrefs: 059A2B66
D6j, xrefs: 059A2B41
D6j, xrefs: 059A2D22
D6j, xrefs: 059A29F4

Memory Dump Source

Source File: 00000002.00000002.1788200321.00000000059A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59a0000_MSBuild.jbxd

Similarity

API ID:
String ID: D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j
API String ID: 0-4048127968
Opcode ID: 3c55b078514a4ee2f819a2a9ddb8bc011c5d97434fc8428905da552bb1ea854f
Instruction ID: f33ffc0a9a5091180271b31a01d3ad4f4a5ec06f8be114dbdca53e7ac34b817b
Opcode Fuzzy Hash: 3c55b078514a4ee2f819a2a9ddb8bc011c5d97434fc8428905da552bb1ea854f
Instruction Fuzzy Hash: DD91A631700B00AFD6056FA5DC45E7EE653FB86700B504438E20A4F7A9DFB6AE1E4792

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report xFk6x2mrd7.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\xFk6x2mrd7.exe.log

C:\Users\user\AppData\Roaming\d3d9.dll

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Windows Analysis Report
xFk6x2mrd7.exe

Function 6CC02760 Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 371
libraryloaderCOMMON

Function 6CC0AFB8 Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Function 6CC0B068 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Function 6CC0AEB1 Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Function 6CC114DC Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 6CC11E9A Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON

Function 6CC0D0CA Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Function 6CC0C170 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120
COMMON

Function 6CC1103A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE