Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1482751
MD5: 4ea39e58d5185ea13c816062f97e001d
SHA1: 4835b4fce547469ea200fc05f9bdfcfdc7572469
SHA256: 1193d78ae12a46941717ff875f19ab33ce9f51f9c4ca3ef3b125abbc37560d62
Tags: exe
Infos:

Detection

Vidar
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Found malware configuration
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected Powershell download and execute
Yara detected Vidar
Yara detected Vidar stealer
.NET source code contains method to dynamically call methods (often used by packers)
AI detected suspicious sample
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Searches for specific processes (likely to inject)
Sigma detected: Silenttrinity Stager Msbuild Activity
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to create guard pages, often used to hinder reverse engineering and debugging
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to record screenshots
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

AV Detection
barindex
Antivirus detection for URL or domain
Source: https://5.75.212.60/sqls.dll Avira URL Cloud: Label: malware
Source: https://steamcommunity.com/profiles/76561199747278259/badges Avira URL Cloud: Label: malware
Source: https://5.75.212.60/- Avira URL Cloud: Label: malware
Source: https://5.75.212.60/A Avira URL Cloud: Label: malware
Source: https://t.me/armad2a Avira URL Cloud: Label: malware
Source: https://5.75.212.60/softokn3.dllq Avira URL Cloud: Label: malware
Source: https://5.75.212.60/B Avira URL Cloud: Label: malware
Source: https://steamcommunity.com/profiles/76561199747278259 Avira URL Cloud: Label: malware
Source: https://5.75.212.60/o Avira URL Cloud: Label: malware
Source: https://5.75.212.60/nss3.dllQ Avira URL Cloud: Label: malware
Source: https://5.75.212.60/softokn3.dll Avira URL Cloud: Label: malware
Source: https://steamcommunity.com/profiles/76561199747278259/inventory/ Avira URL Cloud: Label: malware
Source: https://5.75.212.60/freebl3.dllO Avira URL Cloud: Label: malware
Source: https://5.75.212.60/mozglue.dll Avira URL Cloud: Label: malware
Source: https://5.75.212.60/ Avira URL Cloud: Label: malware
Source: https://5.75.212.60/freebl3.dll Avira URL Cloud: Label: malware
Source: https://5.75.212.60/nss3.dll Avira URL Cloud: Label: malware
Source: https://5.75.212.60/msvcp140.dll Avira URL Cloud: Label: malware
Found malware configuration
Source: 00000000.00000002.1692402449.0000000003A10000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199747278259"], "Botnet": "cb71d89d3eecac4c03c1698bbe16d6d2"}
Multi AV Scanner detection for domain / URL
Source: arpdabl.zapto.org Virustotal: Detection: 11% Perma Link
Source: https://5.75.212.60/sqls.dll Virustotal: Detection: 11% Perma Link
Source: http://arpdabl.zapto.org/q Virustotal: Detection: 10% Perma Link
Source: https://5.75.212.60/- Virustotal: Detection: 11% Perma Link
Multi AV Scanner detection for submitted file
Source: file.exe ReversingLabs: Detection: 32%
Source: file.exe Virustotal: Detection: 24% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: file.exe Joe Sandbox ML: detected
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00406D50 CryptUnprotectData,LocalAlloc,LocalFree, 4_2_00406D50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00406CD0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree, 4_2_00406CD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00410DF0 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA, 4_2_00410DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00408980 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,PK11_FreeSlot,lstrcatA,PK11_FreeSlot,lstrcatA, 4_2_00408980
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C576C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer, 4_2_6C576C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C6CA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util, 4_2_6C6CA9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C6C4440 PK11_PrivDecrypt, 4_2_6C6C4440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C694420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free, 4_2_6C694420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C6C44C0 PK11_PubEncrypt, 4_2_6C6C44C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C7125B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt, 4_2_6C7125B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C6A8670 PK11_ExportEncryptedPrivKeyInfo, 4_2_6C6A8670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C6CA650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext, 4_2_6C6CA650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C6AE6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free, 4_2_6C6AE6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C6EA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError, 4_2_6C6EA730
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 23.192.247.89:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 5.75.212.60:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: file.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: mozglue.pdbP source: MSBuild.exe, 00000004.00000002.2363277109.00000000267F9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2383501124.000000006C5DD000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.4.dr
Source: Binary string: freebl3.pdb source: MSBuild.exe, 00000004.00000002.2360020624.000000002088F000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr
Source: Binary string: freebl3.pdbp source: MSBuild.exe, 00000004.00000002.2360020624.000000002088F000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr
Source: Binary string: nss3.pdb@ source: MSBuild.exe, 00000004.00000002.2385733567.000000006C79F000.00000002.00000001.01000000.00000009.sdmp, MSBuild.exe, 00000004.00000002.2375510661.000000003E5B5000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.4.dr
Source: Binary string: supergamesoft.pdb( source: file.exe
Source: Binary string: PE.pdbH] source: file.exe, 00000000.00000002.1705915663.0000000005400000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: supergamesoft.pdb source: file.exe
Source: Binary string: C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\SWxnr.pdb source: file.exe, 00000000.00000002.1692402449.0000000003F76000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1692402449.000000000446A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1706153820.0000000005533000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: softokn3.pdb@ source: MSBuild.exe, 00000004.00000002.2369809932.00000000326D3000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.4.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: MSBuild.exe, 00000004.00000002.2372726063.0000000038643000.00000004.00000020.00020000.00000000.sdmp, vcruntime140.dll.4.dr
Source: Binary string: PE.pdb source: file.exe, 00000000.00000002.1705915663.0000000005400000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: MSBuild.exe, 00000004.00000002.2366512276.000000002C765000.00000004.00000020.00020000.00000000.sdmp, msvcp140.dll.4.dr
Source: Binary string: nss3.pdb source: MSBuild.exe, 00000004.00000002.2385733567.000000006C79F000.00000002.00000001.01000000.00000009.sdmp, MSBuild.exe, 00000004.00000002.2375510661.000000003E5B5000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.4.dr
Source: Binary string: mozglue.pdb source: MSBuild.exe, 00000004.00000002.2363277109.00000000267F9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2383501124.000000006C5DD000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.4.dr
Source: Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: MSBuild.exe, 00000004.00000002.2352339201.000000001A488000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2359423972.00000000203F8000.00000002.00001000.00020000.00000000.sdmp
Source: Binary string: softokn3.pdb source: MSBuild.exe, 00000004.00000002.2369809932.00000000326D3000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00401110 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 4_2_00401110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_004099F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, 4_2_004099F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0040A2C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA, 4_2_0040A2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_004156C0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose, 4_2_004156C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0040C2E0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 4_2_0040C2E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00415EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 4_2_00415EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00414F80 wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcatA,strtok_s,strtok_s,memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,FindNextFileA,FindClose, 4_2_00414F80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0040B390 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 4_2_0040B390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00409D40 StrCmpCA,FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 4_2_00409D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00415A70 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA, 4_2_00415A70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0040AAB0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose, 4_2_0040AAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_004153C0 GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA, 4_2_004153C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h 0_2_059BD4D0

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: https://steamcommunity.com/profiles/76561199747278259
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /profiles/76561199747278259 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 23.192.247.89 23.192.247.89
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AKAMAI-ASUS AKAMAI-ASUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJDGCAEBFIIECAKFHIJUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 279Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDAKJKFCFBGCBGDHCBUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJJECFIECBGDGCAAAEHUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFCFBFBFBKFIDHJKFCAUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 332Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FBKECFIIEHCFHIECAFBAUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 6713Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /sqls.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EHDGCGIDAKEBKECAFIEHUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 4677Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJDBAAAEHIEGCAKFHCGUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 1529Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AAAAAAAAAAAAAAAAAAAAUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BFCFBFBFBKFIDHJKFCAFUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----ECBGHCGCBKFIECBFHIDGUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 1145Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GDGHJEHJJDAAAKEBGCFCUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DHJJEGHIIDAFIDHJDHJEUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DAECFIJDAAAKECBFCGHIUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 457Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIIEGDBKJKEBGCBAFCFUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 98617Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJKECAAAFHJECAAAEBFUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJKJDGCGDAKFHIDBGCBUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00405010 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle, 4_2_00405010
Source: global traffic HTTP traffic detected: GET /profiles/76561199747278259 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /sqls.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic DNS traffic detected: DNS query: arpdabl.zapto.org
Source: unknown HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJDGCAEBFIIECAKFHIJUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 279Connection: Keep-AliveCache-Control: no-cache
Source: file.exe, 00000000.00000002.1692402449.0000000003A10000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1691045839.0000000002AD9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1692402449.00000000045A6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1692402449.000000000446A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1692402449.00000000039E3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2343717434.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://64532127VdtSrezylanAPTHSymMatchStringInternetSetOptionAHttpQueryInfoAdbghelp.dllSetThreadCont
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://arpdabl.HJECAAAEBF
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://arpdabl.zapto
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://arpdabl.zapto.
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://arpdabl.zapto.AEBF
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://arpdabl.zapto.org
Source: MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arpdabl.zapto.org/
Source: MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arpdabl.zapto.org/A
Source: MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arpdabl.zapto.org/G
Source: MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arpdabl.zapto.org/I
Source: MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arpdabl.zapto.org/i
Source: MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arpdabl.zapto.org/q
Source: MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arpdabl.zapto.org/v
Source: MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arpdabl.zapto.org/y
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://arpdabl.zapto.orgF
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://arpdabl.zaptoAAEBF
Source: MSBuild.exe, 00000004.00000002.2363277109.00000000267F9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2369809932.00000000326D3000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2360020624.000000002088F000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2375510661.000000003E5B5000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: MSBuild.exe, 00000004.00000002.2363277109.00000000267F9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2369809932.00000000326D3000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2360020624.000000002088F000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2375510661.000000003E5B5000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: MSBuild.exe, 00000004.00000002.2363277109.00000000267F9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2369809932.00000000326D3000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2360020624.000000002088F000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2375510661.000000003E5B5000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: MSBuild.exe, 00000004.00000002.2363277109.00000000267F9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2369809932.00000000326D3000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2360020624.000000002088F000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2375510661.000000003E5B5000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: MSBuild.exe, 00000004.00000002.2363277109.00000000267F9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2369809932.00000000326D3000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2360020624.000000002088F000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2375510661.000000003E5B5000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: MSBuild.exe, 00000004.00000002.2363277109.00000000267F9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2369809932.00000000326D3000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2360020624.000000002088F000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2375510661.000000003E5B5000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: MSBuild.exe, 00000004.00000002.2363277109.00000000267F9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2369809932.00000000326D3000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2360020624.000000002088F000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2375510661.000000003E5B5000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: MSBuild.exe, 00000004.00000002.2363277109.00000000267F9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2369809932.00000000326D3000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2360020624.000000002088F000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2375510661.000000003E5B5000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: MSBuild.exe, 00000004.00000002.2363277109.00000000267F9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2369809932.00000000326D3000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2360020624.000000002088F000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2375510661.000000003E5B5000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: MSBuild.exe, 00000004.00000002.2363277109.00000000267F9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2369809932.00000000326D3000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2360020624.000000002088F000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2375510661.000000003E5B5000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: MSBuild.exe, 00000004.00000002.2363277109.00000000267F9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2369809932.00000000326D3000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2360020624.000000002088F000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2375510661.000000003E5B5000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: MSBuild.exe, 00000004.00000002.2363277109.00000000267F9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2369809932.00000000326D3000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2360020624.000000002088F000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2375510661.000000003E5B5000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: MSBuild.exe, 00000004.00000002.2363277109.00000000267F9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2369809932.00000000326D3000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2360020624.000000002088F000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2375510661.000000003E5B5000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: MSBuild.exe, 00000004.00000002.2363277109.00000000267F9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2369809932.00000000326D3000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2360020624.000000002088F000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2375510661.000000003E5B5000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: MSBuild.exe, 00000004.00000002.2363277109.00000000267F9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2369809932.00000000326D3000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2360020624.000000002088F000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2375510661.000000003E5B5000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr String found in binary or memory: http://ocsp.digicert.com0
Source: MSBuild.exe, 00000004.00000002.2363277109.00000000267F9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2369809932.00000000326D3000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2360020624.000000002088F000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2375510661.000000003E5B5000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: MSBuild.exe, 00000004.00000002.2363277109.00000000267F9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2369809932.00000000326D3000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2360020624.000000002088F000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2375510661.000000003E5B5000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: MSBuild.exe, 00000004.00000002.2363277109.00000000267F9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2369809932.00000000326D3000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2360020624.000000002088F000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2375510661.000000003E5B5000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr String found in binary or memory: http://ocsp.digicert.com0N
Source: MSBuild.exe, 00000004.00000002.2363277109.00000000267F9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2369809932.00000000326D3000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2360020624.000000002088F000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2375510661.000000003E5B5000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: Amcache.hve.10.dr String found in binary or memory: http://upx.sf.net
Source: MSBuild.exe, 00000004.00000002.2363277109.00000000267F9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2369809932.00000000326D3000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2360020624.000000002088F000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2375510661.000000003E5B5000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: MSBuild.exe, MSBuild.exe, 00000004.00000002.2363277109.00000000267F9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2383501124.000000006C5DD000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.4.dr String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: MSBuild.exe, 00000004.00000002.2352339201.000000001A488000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2359740327.000000002042D000.00000002.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212
Source: 76561199747278259[1].htm.4.dr String found in binary or memory: https://5.75.212.60
Source: MSBuild.exe, 00000004.00000002.2346186542.00000000017B8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/
Source: MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/-
Source: MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/A
Source: MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/B
Source: MSBuild.exe, 00000004.00000002.2346186542.00000000017B8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/freebl3.dll
Source: MSBuild.exe, 00000004.00000002.2346186542.00000000017B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/freebl3.dllO
Source: MSBuild.exe, 00000004.00000002.2346186542.00000000017B8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/mozglue.dll
Source: MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/msvcp140.dll
Source: MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/msvcp140.dllFF
Source: MSBuild.exe, 00000004.00000002.2346186542.00000000017B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/nss3.dll
Source: MSBuild.exe, 00000004.00000002.2346186542.00000000017B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/nss3.dllQ
Source: MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/o
Source: MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/softokn3.dll
Source: MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/softokn3.dllq
Source: MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/sqls.dll
Source: MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/vcruntime140.dll
Source: DAECFI.4.dr String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 76561199747278259[1].htm.4.dr String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: MSBuild.exe, 00000004.00000002.2346186542.00000000017B8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, AAFBAK.4.dr String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: MSBuild.exe, 00000004.00000002.2346186542.00000000017B8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, AAFBAK.4.dr String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: DAECFI.4.dr String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: DAECFI.4.dr String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: DAECFI.4.dr String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=eZOyL2UG5OX8&a
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.TP5s6TzX6LLh
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=3eYWCMu_
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=e0OV
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=B7Vsdo1okyaC&l=english
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=Iy1ies1ROjUT&l=english
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=54OKIvHlOQzF&l=e
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: 76561199747278259[1].htm.4.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=_D2Bg4UEaFxK&l=en
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: MSBuild.exe, 00000004.00000002.2346186542.00000000017B8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, AAFBAK.4.dr String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: MSBuild.exe, 00000004.00000002.2346186542.00000000017B8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, AAFBAK.4.dr String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: DAECFI.4.dr String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: DAECFI.4.dr String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: DAECFI.4.dr String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://help.steampowered.com/en/
Source: AAFBAK.4.dr String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: MSBuild.exe, 00000004.00000002.2363277109.00000000267F9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2369809932.00000000326D3000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2360020624.000000002088F000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2375510661.000000003E5B5000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr String found in binary or memory: https://mozilla.org0/
Source: 76561199747278259[1].htm.4.dr String found in binary or memory: https://steamcommunity.com/
Source: MSBuild.exe, 00000004.00000002.2346186542.0000000001688000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/?/
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://steamcommunity.com/discussions/
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: 76561199747278259[1].htm.4.dr String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199747278259
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://steamcommunity.com/market/
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: file.exe, 00000000.00000002.1692402449.0000000003A10000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1691045839.0000000002AD9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1692402449.00000000045A6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1692402449.000000000446A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1692402449.00000000039E3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, MSBuild.exe, 00000004.00000002.2346186542.00000000016C9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2343717434.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199747278259
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://steamcommunity.com/profiles/76561199747278259/badges
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://steamcommunity.com/profiles/76561199747278259/inventory/
Source: MSBuild.exe, 00000004.00000002.2346186542.00000000016C9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/765611997472782592
Source: file.exe, 00000000.00000002.1692402449.0000000003A10000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1691045839.0000000002AD9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1692402449.00000000045A6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1692402449.000000000446A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1692402449.00000000039E3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2343717434.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199747278259gi_z2Mozilla/5.0
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://steamcommunity.com/workshop/
Source: 76561199747278259[1].htm.4.dr String found in binary or memory: https://store.steampowered.com/
Source: 76561199747278259[1].htm.4.dr String found in binary or memory: https://store.steampowered.com/about/
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://store.steampowered.com/explore/
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://store.steampowered.com/legal/
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://store.steampowered.com/mobile
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://store.steampowered.com/news/
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://store.steampowered.com/points/shop/
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/privac
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://store.steampowered.com/stats/
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: CBGCAF.4.dr String found in binary or memory: https://support.mozilla.org
Source: CBGCAF.4.dr String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: CBGCAF.4.dr String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: MSBuild.exe, 00000004.00000002.2351862083.0000000019EBC000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2343717434.000000000056E000.00000040.00000400.00020000.00000000.sdmp, CBKJJE.4.dr String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: CBKJJE.4.dr String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: MSBuild.exe, 00000004.00000002.2343717434.000000000056E000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe
Source: MSBuild.exe, 00000004.00000002.2351862083.0000000019EBC000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2343717434.000000000056E000.00000040.00000400.00020000.00000000.sdmp, CBKJJE.4.dr String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: CBKJJE.4.dr String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: MSBuild.exe, 00000004.00000002.2343717434.000000000056E000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe
Source: file.exe, 00000000.00000002.1692402449.0000000003A10000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1691045839.0000000002AD9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1692402449.00000000045A6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1692402449.000000000446A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1692402449.00000000039E3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, MSBuild.exe, 00000004.00000002.2343717434.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://t.me/armad2a
Source: file.exe, 00000000.00000002.1692402449.0000000003A10000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1691045839.0000000002AD9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1692402449.00000000045A6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1692402449.000000000446A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1692402449.00000000039E3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2343717434.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://t.me/armad2ahellosqls.dllsqlite3.dllIn
Source: MSBuild.exe, 00000004.00000002.2346186542.00000000017B8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, AAFBAK.4.dr String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: MSBuild.exe, 00000004.00000002.2363277109.00000000267F9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2369809932.00000000326D3000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2360020624.000000002088F000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2375510661.000000003E5B5000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr String found in binary or memory: https://www.digicert.com/CPS0
Source: DAECFI.4.dr String found in binary or memory: https://www.ecosia.org/newtab/
Source: MSBuild.exe, 00000004.00000002.2346186542.00000000017B8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, AAFBAK.4.dr String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: DAECFI.4.dr String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: CBGCAF.4.dr String found in binary or memory: https://www.mozilla.org
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000530000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2343717434.000000000052A000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2351862083.0000000019EBC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/
Source: MSBuild.exe, 00000004.00000002.2343717434.000000000052A000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/:
Source: CBGCAF.4.dr String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000530000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2343717434.000000000052A000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2351862083.0000000019EBC000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/FIDHJKFCAF
Source: CBGCAF.4.dr String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000530000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2351862083.0000000019EBC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: CBGCAF.4.dr String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000530000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/vchost.exe
Source: CBGCAF.4.dr String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000530000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2351862083.0000000019EBC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: CBGCAF.4.dr String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000530000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/l8dkvDNUUVWrkKclAGH309ds=ost.exe
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.4.dr String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown HTTPS traffic detected: 23.192.247.89:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 5.75.212.60:443 -> 192.168.2.4:49731 version: TLS 1.2
Contains functionality to record screenshots
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00411530 GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GlobalFix,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow, 4_2_00411530
Contains functionality to call native functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C58ED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset, 4_2_6C58ED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5CB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error, 4_2_6C5CB700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5CB8C0 rand_s,NtQueryVirtualMemory, 4_2_6C5CB8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5CB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError, 4_2_6C5CB910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C56F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error, 4_2_6C56F280
Detected potential crypto function
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00FB9062 0_2_00FB9062
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00FBB1DD 0_2_00FBB1DD
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00FB9578 0_2_00FB9578
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00FB97BF 0_2_00FB97BF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_05462590 0_2_05462590
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_05463D08 0_2_05463D08
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_05462582 0_2_05462582
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_05463CC8 0_2_05463CC8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_05460040 0_2_05460040
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0546001C 0_2_0546001C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0546131E 0_2_0546131E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_05461320 0_2_05461320
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_054A2106 0_2_054A2106
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_054A7350 0_2_054A7350
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_054ABF00 0_2_054ABF00
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_054A7340 0_2_054A7340
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_054A8288 0_2_054A8288
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_054A2C38 0_2_054A2C38
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_059B1B10 0_2_059B1B10
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_059B3036 0_2_059B3036
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_059B3201 0_2_059B3201
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0041BD50 4_2_0041BD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0041A130 4_2_0041A130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00419B58 4_2_00419B58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00419B30 4_2_00419B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5635A0 4_2_6C5635A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5D545C 4_2_6C5D545C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C575440 4_2_6C575440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5A5C10 4_2_6C5A5C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5B2C10 4_2_6C5B2C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5DAC00 4_2_6C5DAC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5D542B 4_2_6C5D542B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C58D4D0 4_2_6C58D4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5764C0 4_2_6C5764C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5A6CF0 4_2_6C5A6CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C56D4E0 4_2_6C56D4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C576C80 4_2_6C576C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5C34A0 4_2_6C5C34A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5CC4A0 4_2_6C5CC4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C58ED10 4_2_6C58ED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C590512 4_2_6C590512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C57FD00 4_2_6C57FD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5A0DD0 4_2_6C5A0DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5C85F0 4_2_6C5C85F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C589E50 4_2_6C589E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5A3E50 4_2_6C5A3E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5B2E4E 4_2_6C5B2E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C584640 4_2_6C584640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C56C670 4_2_6C56C670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5D6E63 4_2_6C5D6E63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5A7E10 4_2_6C5A7E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5B5600 4_2_6C5B5600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5C9E30 4_2_6C5C9E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C56BEF0 4_2_6C56BEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C57FEF0 4_2_6C57FEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5D76E3 4_2_6C5D76E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C585E90 4_2_6C585E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5CE680 4_2_6C5CE680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5C4EA0 4_2_6C5C4EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5A7710 4_2_6C5A7710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C579F00 4_2_6C579F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C596FF0 4_2_6C596FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C56DFE0 4_2_6C56DFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5B77A0 4_2_6C5B77A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C588850 4_2_6C588850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C58D850 4_2_6C58D850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5AF070 4_2_6C5AF070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C577810 4_2_6C577810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5AB820 4_2_6C5AB820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5B4820 4_2_6C5B4820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5D50C7 4_2_6C5D50C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C58C0E0 4_2_6C58C0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5A58E0 4_2_6C5A58E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5960A0 4_2_6C5960A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C58A940 4_2_6C58A940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5BB970 4_2_6C5BB970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5DB170 4_2_6C5DB170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C57D960 4_2_6C57D960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5A5190 4_2_6C5A5190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5C2990 4_2_6C5C2990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C59D9B0 4_2_6C59D9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C56C9A0 4_2_6C56C9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5A9A60 4_2_6C5A9A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5A8AC0 4_2_6C5A8AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C581AF0 4_2_6C581AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5AE2F0 4_2_6C5AE2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5DBA90 4_2_6C5DBA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C57CAB0 4_2_6C57CAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5D2AB0 4_2_6C5D2AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5622A0 4_2_6C5622A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C594AA0 4_2_6C594AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C565340 4_2_6C565340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C57C370 4_2_6C57C370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5AD320 4_2_6C5AD320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5D53C8 4_2_6C5D53C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C56F380 4_2_6C56F380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C61AC60 4_2_6C61AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C6EAC30 4_2_6C6EAC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C6D6C00 4_2_6C6D6C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C60ECC0 4_2_6C60ECC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C66ECD0 4_2_6C66ECD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C6DED70 4_2_6C6DED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C73AD50 4_2_6C73AD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C798D20 4_2_6C798D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C79CDC0 4_2_6C79CDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C614DB0 4_2_6C614DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C6A6D90 4_2_6C6A6D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C6AEE70 4_2_6C6AEE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C6F0E20 4_2_6C6F0E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C61AEC0 4_2_6C61AEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C6B0EC0 4_2_6C6B0EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C696E90 4_2_6C696E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C6D2F70 4_2_6C6D2F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C67EF40 4_2_6C67EF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C750F20 4_2_6C750F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C616F10 4_2_6C616F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C610FE0 4_2_6C610FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C6EEFF0 4_2_6C6EEFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C758FB0 4_2_6C758FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C61EFB0 4_2_6C61EFB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C6E4840 4_2_6C6E4840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C660820 4_2_6C660820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C69A820 4_2_6C69A820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C7168E0 4_2_6C7168E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C648960 4_2_6C648960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C666900 4_2_6C666900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C72C9E0 4_2_6C72C9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C6449F0 4_2_6C6449F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C6A09A0 4_2_6C6A09A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C6CA9A0 4_2_6C6CA9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C6D09B0 4_2_6C6D09B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C68CA70 4_2_6C68CA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C6C8A30 4_2_6C6C8A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C6BEA00 4_2_6C6BEA00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C68EA80 4_2_6C68EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C716BE0 4_2_6C716BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C6B0BA0 4_2_6C6B0BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C618BAC 4_2_6C618BAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C628460 4_2_6C628460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C674420 4_2_6C674420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C69A430 4_2_6C69A430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C6564D0 4_2_6C6564D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C6AA4D0 4_2_6C6AA4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C73A480 4_2_6C73A480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C672560 4_2_6C672560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C6B0570 4_2_6C6B0570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C758550 4_2_6C758550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C668540 4_2_6C668540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C714540 4_2_6C714540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C6DA5E0 4_2_6C6DA5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C69E5F0 4_2_6C69E5F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C6045B0 4_2_6C6045B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C66C650 4_2_6C66C650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C66E6E0 4_2_6C66E6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C6AE6E0 4_2_6C6AE6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C6346D0 4_2_6C6346D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C690700 4_2_6C690700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C63A7D0 4_2_6C63A7D0
Found potential string decryption / allocating functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: String function: 6C79D930 appears 33 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: String function: 6C5A94D0 appears 90 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: String function: 6C79DAE0 appears 41 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: String function: 6C639B10 appears 35 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: String function: 6C59CBE8 appears 134 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: String function: 00402000 appears 287 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: String function: 6C633620 appears 40 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: String function: 6C7909D0 appears 172 times
One or more processes crash
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6512 -s 2812
Sample file is different than original file name gathered from version info
Source: file.exe, 00000000.00000002.1689890749.0000000000AEE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe, 00000000.00000002.1705915663.0000000005400000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenamePE.dll& vs file.exe
Source: file.exe, 00000000.00000002.1692402449.0000000003F76000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSWxnr.dll0 vs file.exe
Source: file.exe, 00000000.00000000.1683221894.000000000065C000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamesupergamesoft.exe$ vs file.exe
Source: file.exe, 00000000.00000002.1692402449.000000000446A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSWxnr.dll0 vs file.exe
Source: file.exe, 00000000.00000002.1691045839.0000000002A64000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclrjit.dllT vs file.exe
Source: file.exe, 00000000.00000002.1691045839.0000000002A64000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename vs file.exe
Source: file.exe, 00000000.00000002.1691045839.0000000002A64000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: $^q,\\StringFileInfo\\040904B0\\OriginalFilename vs file.exe
Source: file.exe, 00000000.00000002.1706153820.0000000005533000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameSWxnr.dll0 vs file.exe
Source: file.exe Binary or memory string: OriginalFilenamesupergamesoft.exe$ vs file.exe
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: 0.2.file.exe.5400000.14.raw.unpack, fDX9tehJ5EFemhKZwc.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.file.exe.5400000.14.raw.unpack, fDX9tehJ5EFemhKZwc.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.file.exe.42540c0.2.raw.unpack, viSFIRaCy.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: file.exe, 00000000.00000002.1692402449.0000000003F76000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: MSB4098: MSBuild is invoking VCBuild to build this project. Project-to-project references between VC++ projects (.VCPROJ) and C#/VB/VJ# projects (.CSPROJ, .VBPROJ, .VJSPROJ) are not supported by the command-line build systems when building stand-alone VC++ projects. Projects that contain such project-to-project references will fail to build. Please build the solution file containing this project instead.
Source: file.exe, 00000000.00000002.1692402449.0000000003F76000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: MSB4126: The specified solution configuration "{0}" is invalid. Please specify a valid solution configuration using the Configuration and Platform properties (e.g. MSBuild.exe Solution.sln /p:Configuration=Debug /p:Platform="Any CPU") or leave those properties blank to use the default solution configuration.
Source: file.exe, 00000000.00000002.1692402449.0000000003F76000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: yMSB4051: Project {0} is referencing a project with GUID {1}, but a project with this GUID was not found in the .SLN file.
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@10/24@2/2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C5C7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree, 4_2_6C5C7030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00411400 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,FindCloseChangeNotification, 4_2_00411400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00410900 CoInitializeEx,CoInitializeSecurity,CoCreateInstance,CoSetProxyBlanket,VariantInit,VariantClear, 4_2_00410900
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log Jump to behavior
Source: C:\Users\user\Desktop\file.exe Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6512
Source: C:\Windows\SysWOW64\WerFault.exe File created: C:\ProgramData\Microsoft\Windows\WER\Temp\153a8cdf-ac09-4931-85d0-e1eecfa040c1 Jump to behavior
Source: file.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: file.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: MSBuild.exe, 00000004.00000002.2369809932.00000000326D3000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.4.dr Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: MSBuild.exe, 00000004.00000002.2385733567.000000006C79F000.00000002.00000001.01000000.00000009.sdmp, MSBuild.exe, 00000004.00000002.2352339201.000000001A488000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2375510661.000000003E5B5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2359423972.00000000203F8000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.4.dr Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: MSBuild.exe, 00000004.00000002.2369809932.00000000326D3000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.4.dr Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: MSBuild.exe, 00000004.00000002.2385733567.000000006C79F000.00000002.00000001.01000000.00000009.sdmp, MSBuild.exe, 00000004.00000002.2352339201.000000001A488000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2375510661.000000003E5B5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2359423972.00000000203F8000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.4.dr Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: MSBuild.exe, 00000004.00000002.2385733567.000000006C79F000.00000002.00000001.01000000.00000009.sdmp, MSBuild.exe, 00000004.00000002.2352339201.000000001A488000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2375510661.000000003E5B5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2359423972.00000000203F8000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.4.dr Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: MSBuild.exe, 00000004.00000002.2385733567.000000006C79F000.00000002.00000001.01000000.00000009.sdmp, MSBuild.exe, 00000004.00000002.2352339201.000000001A488000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2375510661.000000003E5B5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2359423972.00000000203F8000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.4.dr Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: MSBuild.exe, 00000004.00000002.2369809932.00000000326D3000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.4.dr Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: MSBuild.exe, 00000004.00000002.2352339201.000000001A488000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2359423972.00000000203F8000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: MSBuild.exe, 00000004.00000002.2369809932.00000000326D3000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.4.dr Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: MSBuild.exe, 00000004.00000002.2369809932.00000000326D3000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.4.dr Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: MSBuild.exe, 00000004.00000002.2369809932.00000000326D3000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.4.dr Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: MSBuild.exe, 00000004.00000002.2352339201.000000001A488000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2359423972.00000000203F8000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: MSBuild.exe, 00000004.00000002.2369809932.00000000326D3000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.4.dr Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: MSBuild.exe, MSBuild.exe, 00000004.00000002.2385733567.000000006C79F000.00000002.00000001.01000000.00000009.sdmp, MSBuild.exe, 00000004.00000002.2352339201.000000001A488000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2375510661.000000003E5B5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2359423972.00000000203F8000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.4.dr Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: MSBuild.exe, 00000004.00000002.2385733567.000000006C79F000.00000002.00000001.01000000.00000009.sdmp, MSBuild.exe, 00000004.00000002.2352339201.000000001A488000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2375510661.000000003E5B5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2359423972.00000000203F8000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.4.dr Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: MSBuild.exe, 00000004.00000002.2369809932.00000000326D3000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.4.dr Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: MSBuild.exe, 00000004.00000002.2352339201.000000001A488000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2359423972.00000000203F8000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: MSBuild.exe, 00000004.00000002.2352339201.000000001A488000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2359423972.00000000203F8000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: MSBuild.exe, 00000004.00000002.2369809932.00000000326D3000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.4.dr Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: MSBuild.exe, 00000004.00000002.2352339201.000000001A488000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2359423972.00000000203F8000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: MSBuild.exe, 00000004.00000002.2369809932.00000000326D3000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.4.dr Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;
Source: file.exe ReversingLabs: Detection: 32%
Source: file.exe Virustotal: Detection: 24%
Source: unknown Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6512 -s 2812
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mscorjit.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: mozglue.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: file.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: file.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: file.exe Static file information: File size 6581760 > 1048576
Source: file.exe Static PE information: Raw size of .text is bigger than: 0x100000 < 0x637c00
Source: file.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: file.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: mozglue.pdbP source: MSBuild.exe, 00000004.00000002.2363277109.00000000267F9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2383501124.000000006C5DD000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.4.dr
Source: Binary string: freebl3.pdb source: MSBuild.exe, 00000004.00000002.2360020624.000000002088F000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr
Source: Binary string: freebl3.pdbp source: MSBuild.exe, 00000004.00000002.2360020624.000000002088F000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr
Source: Binary string: nss3.pdb@ source: MSBuild.exe, 00000004.00000002.2385733567.000000006C79F000.00000002.00000001.01000000.00000009.sdmp, MSBuild.exe, 00000004.00000002.2375510661.000000003E5B5000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.4.dr
Source: Binary string: supergamesoft.pdb( source: file.exe
Source: Binary string: PE.pdbH] source: file.exe, 00000000.00000002.1705915663.0000000005400000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: supergamesoft.pdb source: file.exe
Source: Binary string: C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\SWxnr.pdb source: file.exe, 00000000.00000002.1692402449.0000000003F76000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1692402449.000000000446A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1706153820.0000000005533000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: softokn3.pdb@ source: MSBuild.exe, 00000004.00000002.2369809932.00000000326D3000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.4.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: MSBuild.exe, 00000004.00000002.2372726063.0000000038643000.00000004.00000020.00020000.00000000.sdmp, vcruntime140.dll.4.dr
Source: Binary string: PE.pdb source: file.exe, 00000000.00000002.1705915663.0000000005400000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: MSBuild.exe, 00000004.00000002.2366512276.000000002C765000.00000004.00000020.00020000.00000000.sdmp, msvcp140.dll.4.dr
Source: Binary string: nss3.pdb source: MSBuild.exe, 00000004.00000002.2385733567.000000006C79F000.00000002.00000001.01000000.00000009.sdmp, MSBuild.exe, 00000004.00000002.2375510661.000000003E5B5000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.4.dr
Source: Binary string: mozglue.pdb source: MSBuild.exe, 00000004.00000002.2363277109.00000000267F9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2383501124.000000006C5DD000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.4.dr
Source: Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: MSBuild.exe, 00000004.00000002.2352339201.000000001A488000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2359423972.00000000203F8000.00000002.00001000.00020000.00000000.sdmp
Source: Binary string: softokn3.pdb source: MSBuild.exe, 00000004.00000002.2369809932.00000000326D3000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.4.dr

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: 0.2.file.exe.5400000.14.raw.unpack, fDX9tehJ5EFemhKZwc.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Contains functionality to dynamically determine API calls
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00417A40 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 4_2_00417A40
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_054A409D push ds; retf 0002h 0_2_054A409E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0041CDD5 push ecx; ret 4_2_0041CDE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C59B536 push ecx; ret 4_2_6C59B549
Source: 0.2.file.exe.5400000.14.raw.unpack, fDX9tehJ5EFemhKZwc.cs High entropy of concatenated method names: 'ce4DmfsmSrOT856tDgfrkMb', 'NvQOxwsIFR', 'QsUuklFoHUiQD', 'MCRoDX9te', 'l5EbFemhK', 'uwcnnhQXJ', 'J3PigtLyh', 'PwdNpFGeB', 'XCj67ZIOy', 'w09DYCs5D'
Source: 0.2.file.exe.5400000.14.raw.unpack, zcrmeG4DKc05Qj8A7l.cs High entropy of concatenated method names: 'Ys7O1WDVbX', 'EIxO3RK2jf', 'ov3OzJmFFU', 'KJS0ILfinW', 'Gtt0O5H9rf', 'Gvj00KAYqN', 'hUG0r1tocH', 'PBb0lrpBsM', 'pGy05VOh0y', 'j3M0RfBB5l'
Drops PE files
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File created: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File created: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File created: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File created: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File created: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File created: C:\ProgramData\softokn3.dll Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File created: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File created: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File created: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File created: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File created: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File created: C:\ProgramData\softokn3.dll Jump to dropped file
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00417A40 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 4_2_00417A40
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: file.exe PID: 7116, type: MEMORYSTR
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\file.exe Memory allocated: F90000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory allocated: 29B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory allocated: 27D0000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Dropped PE file which has not been started: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Dropped PE file which has not been started: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Dropped PE file which has not been started: C:\ProgramData\softokn3.dll Jump to dropped file
Found large amount of non-executed APIs
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe API coverage: 5.8 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\file.exe TID: 6200 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00401110 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 4_2_00401110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_004099F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, 4_2_004099F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0040A2C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA, 4_2_0040A2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_004156C0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose, 4_2_004156C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0040C2E0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 4_2_0040C2E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00415EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 4_2_00415EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00414F80 wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcatA,strtok_s,strtok_s,memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,FindNextFileA,FindClose, 4_2_00414F80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0040B390 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 4_2_0040B390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00409D40 StrCmpCA,FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 4_2_00409D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00415A70 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA, 4_2_00415A70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0040AAB0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose, 4_2_0040AAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_004153C0 GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA, 4_2_004153C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0040FDA0 GetSystemInfo,wsprintfA, 4_2_0040FDA0
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Source: MSBuild.exe, 00000004.00000002.2346186542.0000000001688000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMwareD
Source: Amcache.hve.10.dr Binary or memory string: VMware
Source: Amcache.hve.10.dr Binary or memory string: VMware Virtual USB Mouse
Source: file.exe Binary or memory string: T7KKDqemuqJg3uTqm2mj
Source: Amcache.hve.10.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.10.dr Binary or memory string: VMware, Inc.
Source: Amcache.hve.10.dr Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.10.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.10.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.10.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: MSBuild.exe, 00000004.00000002.2346186542.00000000016E5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2346186542.0000000001688000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: Amcache.hve.10.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.10.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.10.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.10.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: MSBuild.exe, 00000004.00000002.2346186542.00000000016E5000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWX
Source: Amcache.hve.10.dr Binary or memory string: vmci.sys
Source: Amcache.hve.10.dr Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.10.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.10.dr Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.10.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.10.dr Binary or memory string: VMware20,1
Source: Amcache.hve.10.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.10.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.10.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: MSBuild.exe, 00000004.00000002.2346186542.0000000001688000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: Amcache.hve.10.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.10.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.10.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.10.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.10.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.10.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.10.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.10.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\file.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process queried: DebugPort Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0041D12F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 4_2_0041D12F
Contains functionality to create guard pages, often used to hinder reverse engineering and debugging
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00402000 VirtualProtect 00000000,00000004,00000100,? 4_2_00402000
Contains functionality to dynamically determine API calls
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00417A40 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 4_2_00417A40
Contains functionality to read the PEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_004176E0 mov eax, dword ptr fs:[00000030h] 4_2_004176E0
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00402000 lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,GetProcessHeap,RtlAllocateHeap,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenA,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,VirtualProtect,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW, 4_2_00402000
Enables debug privileges
Source: C:\Users\user\Desktop\file.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0041ECC8 SetUnhandledExceptionFilter, 4_2_0041ECC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0041D12F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 4_2_0041D12F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0041CAF5 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 4_2_0041CAF5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C59B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 4_2_6C59B66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C59B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 4_2_6C59B1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C74AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 4_2_6C74AC62
Source: C:\Users\user\Desktop\file.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: file.exe PID: 7116, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MSBuild.exe PID: 6512, type: MEMORYSTR
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\file.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write Jump to behavior
Contains functionality to inject code into remote processes
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0040ED80 memset,CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,VirtualAllocEx,ResumeThread,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread, 4_2_0040ED80
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\file.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A Jump to behavior
Searches for specific processes (likely to inject)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00411400 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,FindCloseChangeNotification, 4_2_00411400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_004112F0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle, 4_2_004112F0
Writes to foreign memory regions
Source: C:\Users\user\Desktop\file.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 420000 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 428000 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 63D000 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 63E000 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 11CF008 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C794760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free, 4_2_6C794760
Contains functionality to query CPU information (cpuid)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00401000 cpuid 4_2_00401000
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree, 4_2_0040FC30
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0041A440 GetLocalTime,SystemTimeToFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z, 4_2_0041A440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0040FAE0 GetProcessHeap,HeapAlloc,GetUserNameA, 4_2_0040FAE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0040FBC0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA, 4_2_0040FBC0
Source: C:\Users\user\Desktop\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: iles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.10.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.10.dr Binary or memory string: msmpeng.exe
Source: Amcache.hve.10.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.10.dr Binary or memory string: MsMpEng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected Vidar
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Vidar stealer
Source: Yara match File source: 0.2.file.exe.4579110.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.39e31c0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.3a109f0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.4579110.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.39e31c0.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.45a6940.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.45a6940.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.3a109f0.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.1692402449.0000000003A10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1691045839.0000000002AD9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1692402449.00000000045A6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1692402449.00000000039E3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2343717434.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1692402449.000000000446A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: file.exe PID: 7116, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MSBuild.exe PID: 6512, type: MEMORYSTR
Found many strings related to Crypto-Wallets (likely being stolen)
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: |1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000530000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: \ElectronCash\wallets\
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: |1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: file.exe, 00000000.00000000.1682009085.0000000000022000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: XhJAxXnjj5
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: |1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: |1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000530000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: \Exodus\exodus.wallet\
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000530000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: info.seco
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: |1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: |1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: |1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000530000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: \Exodus\exodus.wallet\
Source: MSBuild.exe, 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\.finger-print.fp/
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: |1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000530000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000530000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: \Exodus\exodus.wallet\
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000530000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: MultiDoge
Source: MSBuild.exe, 00000004.00000002.2343717434.000000000052A000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: seed.seco
Source: file.exe, 00000000.00000002.1705915663.0000000005400000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: set_UseMachineKeyStore
Source: MSBuild.exe, 00000004.00000002.2346186542.0000000001688000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\*.*
Source: MSBuild.exe, 00000004.00000002.2343717434.0000000000438000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: |1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Tries to harvest and steal Bitcoin Wallet information
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core Jump to behavior
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Tries to steal Crypto Currency Wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Exodus\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Exodus\backups\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\MultiDoge\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Binance\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\ Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: Process Memory Space: MSBuild.exe PID: 6512, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Vidar
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Vidar stealer
Source: Yara match File source: 0.2.file.exe.4579110.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.39e31c0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.3a109f0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.4579110.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.39e31c0.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.45a6940.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.45a6940.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.3a109f0.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.1692402449.0000000003A10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1691045839.0000000002AD9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1692402449.00000000045A6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1692402449.00000000039E3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2343717434.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2346186542.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1692402449.000000000446A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: file.exe PID: 7116, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MSBuild.exe PID: 6512, type: MEMORYSTR
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C750C40 sqlite3_bind_zeroblob, 4_2_6C750C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C750D60 sqlite3_bind_parameter_name, 4_2_6C750D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C678EA0 sqlite3_clear_bindings, 4_2_6C678EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C750B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob, 4_2_6C750B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_6C676410 bind,WSAGetLastError, 4_2_6C676410
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1482751 Sample: file.exe Startdate: 26/07/2024 Architecture: WINDOWS Score: 100 35 steamcommunity.com 2->35 37 fp2e7a.wpc.phicdn.net 2->37 39 2 other IPs or domains 2->39 45 Multi AV Scanner detection for domain / URL 2->45 47 Found malware configuration 2->47 49 Antivirus detection for URL or domain 2->49 51 10 other signatures 2->51 8 file.exe 3 2->8         started        signatures3 process4 file5 25 C:\Users\user\AppData\Local\...\file.exe.log, ASCII 8->25 dropped 53 Found many strings related to Crypto-Wallets (likely being stolen) 8->53 55 Writes to foreign memory regions 8->55 57 Allocates memory in foreign processes 8->57 59 Injects a PE file into a foreign processes 8->59 12 MSBuild.exe 35 8->12         started        17 MSBuild.exe 8->17         started        19 MSBuild.exe 8->19         started        21 MSBuild.exe 8->21         started        signatures6 process7 dnsIp8 41 steamcommunity.com 23.192.247.89, 443, 49730 AKAMAI-ASUS United States 12->41 43 5.75.212.60, 443, 49731, 49732 HETZNER-ASDE Germany 12->43 27 C:\ProgramData\vcruntime140.dll, PE32 12->27 dropped 29 C:\ProgramData\softokn3.dll, PE32 12->29 dropped 31 C:\ProgramData\nss3.dll, PE32 12->31 dropped 33 3 other files (none is malicious) 12->33 dropped 61 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 12->61 63 Found many strings related to Crypto-Wallets (likely being stolen) 12->63 65 Tries to harvest and steal ftp login credentials 12->65 71 3 other signatures 12->71 23 WerFault.exe 22 16 12->23         started        67 Contains functionality to inject code into remote processes 17->67 69 Searches for specific processes (likely to inject) 17->69 file9 signatures10 process11
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
5.75.212.60
 unknown Germany
24940 HETZNER-ASDE false
23.192.247.89
 steamcommunity.com United States
16625 AKAMAI-ASUS true

Contacted Domains

Name IP Active
steamcommunity.com 23.192.247.89 true
arpdabl.zapto.org 77.91.101.71 true
fp2e7a.wpc.phicdn.net 192.229.221.95 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://5.75.212.60/sqls.dll false
  • 12%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
https://steamcommunity.com/profiles/76561199747278259 true
  • Avira URL Cloud: malware
 unknown
https://5.75.212.60/softokn3.dll false
  • Avira URL Cloud: malware
 unknown
https://5.75.212.60/mozglue.dll false
  • Avira URL Cloud: malware
 unknown
https://5.75.212.60/ false
  • Avira URL Cloud: malware
 unknown
https://5.75.212.60/freebl3.dll false
  • Avira URL Cloud: malware
 unknown
https://5.75.212.60/nss3.dll false
  • Avira URL Cloud: malware
 unknown
https://5.75.212.60/msvcp140.dll false
  • Avira URL Cloud: malware
 unknown