Edit tour

Windows Analysis Report
nuCc19sDOl.exe

Overview

General Information

Sample name:	nuCc19sDOl.exe renamed because original name is a hash value
Original sample name:	01e059b3901bd579fb8ea4ebc34009f9.exe
Analysis ID:	1483425
MD5:	01e059b3901bd579fb8ea4ebc34009f9
SHA1:	19b0a2db06db2afbef2b95221d2c11fe4107aa43
SHA256:	05e5cab97709be490b7216163e29d326f43d4f273bdfccf93a485212064b4aca
Tags:	exeRedLineStealer
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected RedLine Stealer

.NET source code contains potential unpacker

.NET source code contains very large array initializations

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

nuCc19sDOl.exe (PID: 6652 cmdline: "C:\Users\user\Desktop\nuCc19sDOl.exe" MD5: 01E059B3901BD579FB8EA4EBC34009F9)

conhost.exe (PID: 6672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MSBuild.exe (PID: 6864 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": "5.42.92.213:46419", "Bot Id": "478596", "Authorization Header": "d409ddacd5400779d74f75370da84208"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.1818185346.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1685085815.000000006CF79000.00000004.00000001.01000000.00000007.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.1819320060.0000000002B79000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: nuCc19sDOl.exe PID: 6652	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: nuCc19sDOl.exe PID: 6652	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 6864	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 6864	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.nuCc19sDOl.exe.6cf79000.4.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2.2.MSBuild.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.nuCc19sDOl.exe.6cf79000.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.nuCc19sDOl.exe.6cf50000.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Suricata Signatures

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T12:12:06.512543+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.114.59.183 - Destination IP: 192.168.2.4

Timestamp:	2024-07-27T12:12:55.686346+0200
SID:	2022930
Source Port:	443
Destination Port:	49737
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T12:12:06.733994+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T12:12:09.445963+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T12:12:06.259979+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T12:12:11.913475+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 5.42.92.213 - Destination IP: 192.168.2.4

Timestamp:	2024-07-27T12:12:00.321853+0200
SID:	2043234
Source Port:	46419
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T12:12:06.963750+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T12:12:09.826085+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T12:12:09.188597+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T12:12:11.052524+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T12:12:08.253192+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T12:12:09.726434+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T12:12:10.122926+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T12:12:05.370389+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T12:12:06.037205+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T12:12:07.886941+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.114.59.183 - Destination IP: 192.168.2.4

Timestamp:	2024-07-27T12:12:17.533976+0200
SID:	2022930
Source Port:	443
Destination Port:	49731
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) - Source IP: 5.42.92.213 - Destination IP: 192.168.2.4

Timestamp:	2024-07-27T12:12:05.827728+0200
SID:	2046056
Source Port:	46419
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T12:12:08.755787+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T12:12:08.971532+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T12:12:05.822240+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T12:12:12.155240+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T12:12:11.480008+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T12:12:10.128355+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T12:12:08.534683+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T12:12:11.270445+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T12:12:00.115561+0200
SID:	2046045
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T12:12:11.697363+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: nuCc19sDOl.exe

Avira: detected

Found malware configuration

Source: 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": "5.42.92.213:46419", "Bot Id": "478596", "Authorization Header": "d409ddacd5400779d74f75370da84208"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\d3d9.dll	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Roaming\d3d9.dll	Virustotal: Detection: 72%			Perma Link

Multi AV Scanner detection for submitted file

Source: nuCc19sDOl.exe	ReversingLabs: Detection: 73%
Source: nuCc19sDOl.exe	Virustotal: Detection: 45%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\d3d9.dll

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: nuCc19sDOl.exe

Joe Sandbox ML: detected

Source: nuCc19sDOl.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: nuCc19sDOl.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: WINLOA~1.PDBIEnloh source: MSBuild.exe, 00000002.00000002.1827440717.00000000052B0000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 4x nop then jmp 06A00538h

2_2_06A00040

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 5.42.92.213:46419

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 5.42.92.213:46419

Source: Joe Sandbox View

ASN Name: RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213

Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000028C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002A6F000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1819320060.00000000028C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1819320060.00000000028C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000028C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000028C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000028C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002B79000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1819320060.00000000028C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15V
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000028C7000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1819320060.0000000002A77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000028C7000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1819320060.0000000002A77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000028C7000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1819320060.0000000002A77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000028C7000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1819320060.0000000002A77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000028C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000028C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000028C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000028C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002B66000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1819320060.00000000028C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: nuCc19sDOl.exe, nuCc19sDOl.exe, 00000000.00000002.1685085815.000000006CF79000.00000004.00000001.01000000.00000007.sdmp, MSBuild.exe, 00000002.00000002.1818185346.0000000000402000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip

Source: unknown

Network traffic detected: HTTP traffic on port 49675 -> 443

System Summary

.NET source code contains very large array initializations

Source: nuCc19sDOl.exe, -Module-.cs

Large array initialization: _206A_200E_202C_200D_200D_202A_206E_200F_200F_202A_200C_200D_200F_206B_206D_202E_206E_202D_206A_202D_200D_202D_202B_200D_206C_202B_206B_202B_202B_206F_200B_206D_200B_206E_206C_206E_200C_202D_206D_202D_202E: array initializer size 51520

Source: C:\Users\user\Desktop\nuCc19sDOl.exe

Code function: 0_2_6CF575A0 GetModuleHandleW,GetProcAddress,NtQueryInformationProcess,

0_2_6CF575A0

Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Code function: 0_2_6CF575A0	0_2_6CF575A0
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Code function: 0_2_6CF57A60	0_2_6CF57A60
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Code function: 0_2_6CF51230	0_2_6CF51230
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Code function: 0_2_6CF650E0	0_2_6CF650E0
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Code function: 0_2_6CF70BB5	0_2_6CF70BB5
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Code function: 0_2_6CF7EB17	0_2_6CF7EB17
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Code function: 0_2_017B1070	0_2_017B1070
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Code function: 0_2_017B2528	0_2_017B2528
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Code function: 0_2_017B0972	0_2_017B0972
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Code function: 0_2_017B0927	0_2_017B0927
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Code function: 0_2_017B39F0	0_2_017B39F0
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Code function: 0_2_017B39E0	0_2_017B39E0
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Code function: 0_2_017B1053	0_2_017B1053
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Code function: 0_2_017B08DF	0_2_017B08DF
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Code function: 0_2_017B0A87	0_2_017B0A87
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Code function: 0_2_017B2518	0_2_017B2518
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Code function: 0_2_017B0C40	0_2_017B0C40
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Code function: 0_2_017B24E7	0_2_017B24E7
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Code function: 0_2_017B2E70	0_2_017B2E70
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Code function: 0_2_0AF04748	0_2_0AF04748
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Code function: 0_2_0AF04388	0_2_0AF04388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0261DC74	2_2_0261DC74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_04E68D28	2_2_04E68D28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_04E66948	2_2_04E66948
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_04E60040	2_2_04E60040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_04E6001F	2_2_04E6001F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_04E68D18	2_2_04E68D18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06A0F358	2_2_06A0F358
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06A080C8	2_2_06A080C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06A00040	2_2_06A00040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06A02118	2_2_06A02118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06A02D28	2_2_06A02D28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06A0BA20	2_2_06A0BA20

Source: C:\Users\user\Desktop\nuCc19sDOl.exe

Code function: String function: 6CF66140 appears 33 times

Source: nuCc19sDOl.exe, 00000000.00000002.1685085815.000000006CFBA000.00000004.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameCaftans.exe8 vs nuCc19sDOl.exe
Source: nuCc19sDOl.exe, 00000000.00000002.1680819190.00000000012CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs nuCc19sDOl.exe
Source: nuCc19sDOl.exe, 00000000.00000000.1675792653.0000000000D72000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCharlie846Ian.txtP vs nuCc19sDOl.exe
Source: nuCc19sDOl.exe	Binary or memory string: OriginalFilenameCharlie846Ian.txtP vs nuCc19sDOl.exe

Source: nuCc19sDOl.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/3@0/1

Source: C:\Users\user\Desktop\nuCc19sDOl.exe

File created: C:\Users\user\AppData\Roaming\d3d9.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6672:120:WilError_03

Source: nuCc19sDOl.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: nuCc19sDOl.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Users\user\Desktop\nuCc19sDOl.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: nuCc19sDOl.exe	ReversingLabs: Detection: 73%
Source: nuCc19sDOl.exe	Virustotal: Detection: 45%

Source: unknown	Process created: C:\Users\user\Desktop\nuCc19sDOl.exe "C:\Users\user\Desktop\nuCc19sDOl.exe"
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\nuCc19sDOl.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: nuCc19sDOl.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: nuCc19sDOl.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: WINLOA~1.PDBIEnloh source: MSBuild.exe, 00000002.00000002.1827440717.00000000052B0000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: nuCc19sDOl.exe, -Module-.cs

.Net Code: _206F_200C_200B_200F_200C_200B_202C_206A_202B_206D_202D_206C_200F_202C_206E_206C_202E_206D_200D_202E_200D_200F_202A_206E_200B_202B_202D_202B_200E_200C_206A_200B_206B_202E_206E_202B_206C_200D_200C_200D_202E System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Code function: 0_2_6CF712E4 push ecx; ret	0_2_6CF712F7
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Code function: 0_2_6CF79180 pushfd ; iretd	0_2_6CF79181
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Code function: 0_2_6CF7EB17 push es; retf	0_2_6CF7EB12
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Code function: 0_2_0AEF071E push esp; retf	0_2_0AEF071F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_04E6D912 push eax; ret	2_2_04E6D921
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06A0B89B push FFFFFF8Bh; iretd	2_2_06A0B89E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06A0B8E0 push FFFFFF8Bh; iretd	2_2_06A0B8E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06A0B924 push FFFFFF8Bh; iretd	2_2_06A0B92E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06A0B97E push FFFFFF8Bh; iretd	2_2_06A0B982

Source: C:\Users\user\Desktop\nuCc19sDOl.exe

File created: C:\Users\user\AppData\Roaming\d3d9.dll

Jump to dropped file

Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: nuCc19sDOl.exe PID: 6652, type: MEMORYSTR

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Memory allocated: 1770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Memory allocated: 3270000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Memory allocated: 30A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Memory allocated: 5710000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Memory allocated: 6710000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Memory allocated: 6840000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Memory allocated: 7840000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Memory allocated: 7BE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Memory allocated: 8BE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Memory allocated: 9BE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2610000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 27F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 47F0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 2092			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 5351			Jump to behavior

Source: C:\Users\user\Desktop\nuCc19sDOl.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\d3d9.dll

Jump to dropped file

Source: C:\Users\user\Desktop\nuCc19sDOl.exe TID: 6820	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7028	Thread sleep time: -27670116110564310s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6908	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: nuCc19sDOl.exe, 00000000.00000002.1682491863.0000000004C8F000.00000004.00000800.00020000.00000000.sdmp, d3d9.dll.0.dr	Binary or memory string: DQEMu
Source: MSBuild.exe, 00000002.00000002.1818477267.0000000000B6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\nuCc19sDOl.exe

Code function: 0_2_6CF65FCA IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CF65FCA

Source: C:\Users\user\Desktop\nuCc19sDOl.exe

Code function: 0_2_6CF6BD3B GetProcessHeap,

0_2_6CF6BD3B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Code function: 0_2_6CF65AF1 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6CF65AF1
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Code function: 0_2_6CF65FCA IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CF65FCA
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Code function: 0_2_6CF69F67 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CF69F67

Source: C:\Users\user\Desktop\nuCc19sDOl.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\nuCc19sDOl.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\nuCc19sDOl.exe

Code function: 0_2_6CF57A60 HuaweiShare,GetConsoleWindow,ShowWindow,CreateProcessW,VirtualAlloc,Wow64GetThreadContext,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,ReadProcessMemory,WriteProcessMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,CloseHandle,CloseHandle,VirtualAlloc,GetThreadContext,ReadProcessMemory,

0_2_6CF57A60

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\nuCc19sDOl.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 430000	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44E000	Jump to behavior
Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 74C008	Jump to behavior

Source: C:\Users\user\Desktop\nuCc19sDOl.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

Jump to behavior

Source: C:\Users\user\Desktop\nuCc19sDOl.exe

Code function: 0_2_6CF66188 cpuid

0_2_6CF66188

Source: C:\Users\user\Desktop\nuCc19sDOl.exe	Queries volume information: C:\Users\user\Desktop\nuCc19sDOl.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\nuCc19sDOl.exe

Code function: 0_2_6CF65C13 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6CF65C13

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.nuCc19sDOl.exe.6cf79000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.nuCc19sDOl.exe.6cf79000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.nuCc19sDOl.exe.6cf50000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1818185346.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1685085815.000000006CF79000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: nuCc19sDOl.exe PID: 6652, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6864, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002B79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\walletsLR^q
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002B79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $^q1C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002B79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $^q-cjelfplplebdjjenllpjcblmjkfcffne\|JaxxxLiberty
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002B79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.walletLR^q
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002B79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLR^q
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002B79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.walletLR^q
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002B79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `,^qdC:\Users\user\AppData\Roaming\Binance
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002B79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLR^q
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002B79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $^q&%localappdata%\Coinomi\Coinomi\walletsLR^qD
Source: MSBuild.exe, 00000002.00000002.1819320060.0000000002B79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $^q5C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1819320060.0000000002B79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6864, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.nuCc19sDOl.exe.6cf79000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.nuCc19sDOl.exe.6cf79000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.nuCc19sDOl.exe.6cf50000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1818185346.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1685085815.000000006CF79000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: nuCc19sDOl.exe PID: 6652, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6864, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	411 Process Injection	1 Masquerading	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	341 Security Software Discovery	Remote Desktop Protocol	3 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	411 Process Injection	NTDS	241 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	124 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
nuCc19sDOl.exe	74%	ReversingLabs	ByteCode-MSIL.Ransomware.RedLine
nuCc19sDOl.exe	46%	Virustotal		Browse
nuCc19sDOl.exe	100%	Avira	HEUR/AGEN.1310947
nuCc19sDOl.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\d3d9.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\d3d9.dll	88%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Roaming\d3d9.dll	73%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
bg.microsoft.map.fastly.net	0%	Virustotal		Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	0%	URL Reputation	safe
http://tempuri.org/Entity/Id14ResponseD	0%	URL Reputation	safe
http://tempuri.org/Entity/Id23ResponseD	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	0%	URL Reputation	safe
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6ResponseD	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	0%	URL Reputation	safe
http://tempuri.org/Entity/Id4	0%	URL Reputation	safe
http://tempuri.org/Entity/Id7	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19Response	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	0%	URL Reputation	safe
http://tempuri.org/Entity/Id13ResponseD	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5ResponseD	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/sc	0%	URL Reputation	safe
http://tempuri.org/Entity/Id1ResponseD	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id20	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21	0%	URL Reputation	safe
http://tempuri.org/Entity/Id22	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	0%	URL Reputation	safe
http://tempuri.org/Entity/Id23	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id1Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15V	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21ResponseD	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10	0%	URL Reputation	safe
http://tempuri.org/Entity/Id11	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10ResponseD	0%	URL Reputation	safe
http://tempuri.org/Entity/Id12	0%	URL Reputation	safe
http://tempuri.org/Entity/Id16Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	0%	URL Reputation	safe
http://tempuri.org/Entity/Id13	0%	URL Reputation	safe
http://tempuri.org/Entity/Id14	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15	0%	URL Reputation	safe
http://tempuri.org/Entity/Id16	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	0%	URL Reputation	safe
http://tempuri.org/Entity/Id17	0%	URL Reputation	safe
http://tempuri.org/Entity/Id18	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15ResponseD	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	0%	URL Reputation	safe
http://tempuri.org/Entity/Id11ResponseD	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	0%, Virustotal, Browse	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id14ResponseD	MSBuild.exe, 00000002.00000002.1819320060.00000000028C7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	MSBuild.exe, 00000002.00000002.1819320060.00000000028C7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id12Response	MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/	MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15V	MSBuild.exe, 00000002.00000002.1819320060.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21Response	MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id9	MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8	MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6ResponseD	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5	MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id4	MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id7	MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6	MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id19Response	MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id13ResponseD	MSBuild.exe, 00000002.00000002.1819320060.00000000028C7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15Response	MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5ResponseD	MSBuild.exe, 00000002.00000002.1819320060.00000000028C7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	MSBuild.exe, 00000002.00000002.1819320060.00000000028C7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6Response	MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ip.sb/ip	nuCc19sDOl.exe, nuCc19sDOl.exe, 00000000.00000002.1685085815.000000006CF79000.00000004.00000001.01000000.00000007.sdmp, MSBuild.exe, 00000002.00000002.1818185346.0000000000402000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1ResponseD	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id9Response	MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id20	MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21	MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id22	MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id23	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id24	MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id24Response	MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1Response	MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21ResponseD	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id10	MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id11	MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id10ResponseD	MSBuild.exe, 00000002.00000002.1819320060.0000000002A6F000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1819320060.00000000028C7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id12	MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id16Response	MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id13	MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id14	MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15	MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://tempuri.org/Entity/Id16	MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id17	MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id18	MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5Response	MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://tempuri.org/Entity/Id19	MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15ResponseD	MSBuild.exe, 00000002.00000002.1819320060.0000000002B79000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1819320060.00000000028C7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id10Response	MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id11ResponseD	MSBuild.exe, 00000002.00000002.1819320060.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1819320060.00000000028C7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8Response	MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id17ResponseD	MSBuild.exe, 00000002.00000002.1819320060.00000000028C7000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1819320060.0000000002A77000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	MSBuild.exe, 00000002.00000002.1819320060.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8ResponseD	MSBuild.exe, 00000002.00000002.1819320060.00000000028C7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust	MSBuild.exe, 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
5.42.92.213	unknown	Russian Federation		39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1483425
Start date and time:	2024-07-27 12:11:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	nuCc19sDOl.exe renamed because original name is a hash value
Original Sample Name:	01e059b3901bd579fb8ea4ebc34009f9.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/3@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 54 Number of non-executed functions: 29
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.114.59.183, 199.232.214.172, 192.229.221.95, 20.242.39.171, 52.165.164.15
Excluded domains from analysis (whitelisted): fe3.delivery.mp.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
06:12:06	API Interceptor	38x Sleep call for process: MSBuild.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fp2e7a.wpc.phicdn.net	d34e1p5zD2.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	Mu7iyblZk8.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	R86BRY7DdC.exe	Get hash	malicious	Snake Keylogger	Browse	192.229.221.95
	d34e1p5zD2.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	41DLTjkmOm.exe	Get hash	malicious	Remcos	Browse	192.229.221.95
	Ycj3d5NMhc.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	QUOTATION_JULQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	192.229.221.95
	https://azadengg.com/MTQwOTk4NzcwMg==sfmaxWjJWdUxYQm5lQzA0TXpVMU1EZ3dNMmxtZUdOb1lYWmxlbkpwYzNoaGFYSmliM0p1TG1OdmJRPT0=&c=E,1,LZxP3HHb1f9qSYvI9qirqXkUUBAc_Lly3K7xLwNdfYOBECyaKUoAd-t3gcHqWT79cExKeBU56i8wGFRIGcXn5xtHq6aoS1GJuvxV76lYjLuWHw,,&typo=1	Get hash	malicious	Unknown	Browse	192.229.221.95
	x.ps1	Get hash	malicious	Unknown	Browse	192.229.221.95
	invoker.ps1	Get hash	malicious	Unknown	Browse	192.229.221.95
bg.microsoft.map.fastly.net	d34e1p5zD2.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	QIKiV83Pkl.exe	Get hash	malicious	DCRat	Browse	199.232.214.172
	41DLTjkmOm.exe	Get hash	malicious	Remcos	Browse	199.232.210.172
	Ycj3d5NMhc.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	oz9Blof9tN.msi	Get hash	malicious	CobaltStrike	Browse	199.232.214.172
	QUOTATION_JULQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	199.232.210.172
	invoker.ps1	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://investors.spotify.com.th.wuush.us.kg/	Get hash	malicious	Unknown	Browse	199.232.214.172
	http://cache.netflix.com.sg3.wuush.us.kg/	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://apple.vn377.com/	Get hash	malicious	Unknown	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	LisectAVT_2403002A_199.exe	Get hash	malicious	RedLine	Browse	5.42.65.68
	LisectAVT_2403002A_240.exe	Get hash	malicious	RisePro Stealer	Browse	5.42.65.117
	LisectAVT_2403002A_240.exe	Get hash	malicious	RisePro Stealer	Browse	5.42.65.117
	LisectAVT_2403002A_422.exe	Get hash	malicious	RedLine	Browse	5.42.65.68
	LisectAVT_2403002B_301.exe	Get hash	malicious	Bdaejec, GCleaner	Browse	5.42.65.115
	LisectAVT_2403002B_98.exe	Get hash	malicious	Bdaejec, GCleaner, Nymaim	Browse	5.42.64.3
	LisectAVT_2403002C_44.exe	Get hash	malicious	EICAR	Browse	5.42.96.78
	LisectAVT_2403002C_45.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	5.42.65.68
	LisectAVT_2403002A_479.exe	Get hash	malicious	RisePro Stealer	Browse	5.42.65.117
	7d69f17f.exe	Get hash	malicious	RedLine	Browse	45.15.156.186

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3094
Entropy (8bit):	5.33145931749415
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0atTqdqlq7qV
MD5:	3FD5C0634443FB2EF2796B9636159CB6
SHA1:	366DDE94AEFCFFFAB8E03AD8B448E05D7489EB48
SHA-256:	58307E94C67E2348F5A838DE4FF668983B38B7E9A3B1D61535D3A392814A57D6
SHA-512:	8535E7C0777C6B0876936D84BDE2BDC59963CF0954D4E50D65808E6E806E8B131DF5DB8FA0E030FAE2702143A7C3A70698A2B9A80519C9E2FFC286A71F0B797C
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\nuCc19sDOl.exe.log

Download File

Process:	C:\Users\user\Desktop\nuCc19sDOl.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Roaming\d3d9.dll

Download File

Process:	C:\Users\user\Desktop\nuCc19sDOl.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	474112
Entropy (8bit):	6.079874930357952
Encrypted:	false
SSDEEP:	12288:ftPYiCgkpxunuWo1jrKrAahMAFfyUImDCjN:ftPYiCX0IjrKrAahzvImDC
MD5:	27A834D436810EE96B12694BEFDB3B43
SHA1:	D6FFDD44C46DB61F62A9DF2998DE8FA3B201F056
SHA-256:	F10655DED0EF7FAF5E2044747589333F3A04A36DBD7890903DA55F0C44E382D2
SHA-512:	911276F8F2DBB597710C1F94973A98C5E2E8283CA99831AB5E62BA58B3EDE9FB4CC42EC98880BCF16D30F8E85751AD889382D186D31F6EF41655CC0E3A730E7A
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88% Antivirus: Virustotal, Detection: 73%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C.)...GQ..GQ..GQL.DP..GQL.BP..GQL.CP..GQL.FP..GQ z<Q..GQ..FQe.GQ.=BP..GQ.=CP..GQ.=DP..GQ..GQ..GQj=GP..GQj=EP..GQRich..GQ........................PE..L....(.f...........!...&.....<.......Z....... ...............................p............@.........................@...T.......<............................P......`u...............................t..@............ ..P............................text...3........................... ..`.rdata..2h... ...j..................@..@.data...T............t..............@....reloc.......P......."..............@..B................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.725005035511834
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	nuCc19sDOl.exe
File size:	625'152 bytes
MD5:	01e059b3901bd579fb8ea4ebc34009f9
SHA1:	19b0a2db06db2afbef2b95221d2c11fe4107aa43
SHA256:	05e5cab97709be490b7216163e29d326f43d4f273bdfccf93a485212064b4aca
SHA512:	05883c1f726dfba182b7d9cfa290d77ba74d3ce2985a1718f16a22744edadab2e3afc1793c4a3f54368d5ef7cdacb9e1babd31f38d493fbbc01d853c9a2be3af
SSDEEP:	12288:4JP/raKAKMPNmB+owvLgT9DBGZLZ9i9OurXl5AFy7t9kHtFn7S9F+nI7WU15TOY1:4/AHPQB+hIBG1kOH6
TLSH:	61D42DDD765072DFC85BC972CEA81C68EA5034BB871B9203906719EDDA5E89BCF140F2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....(.f.................~..........^.... ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x499d5e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x669D28CF [Sun Jul 21 15:27:11 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x99d08	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x9a000	0x688	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x9c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x97d64	0x97e00	ab7c224893805d7176f0f9f899a3ef75	False	0.6113554526748971	data	6.731080317743544	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x9a000	0x688	0x800	9bc5dfd6bf6476c433eaea498b1218ee	False	0.35302734375	data	3.635968076664953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x9c000	0xc	0x200	5e5aec80690ad0a08256d137cd4bdf18	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x9a0a0	0x3fc	data			0.4088235294117647
RT_MANIFEST	0x9a49c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-27T12:12:06.512543+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T12:12:55.686346+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49737	20.114.59.183	192.168.2.4
2024-07-27T12:12:06.733994+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T12:12:09.445963+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T12:12:06.259979+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T12:12:11.913475+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T12:12:00.321853+0200	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	46419	49730	5.42.92.213	192.168.2.4
2024-07-27T12:12:06.963750+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T12:12:09.826085+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T12:12:09.188597+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T12:12:11.052524+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T12:12:08.253192+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T12:12:09.726434+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T12:12:10.122926+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T12:12:05.370389+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T12:12:06.037205+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T12:12:07.886941+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T12:12:17.533976+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49731	20.114.59.183	192.168.2.4
2024-07-27T12:12:05.827728+0200	TCP	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	46419	49730	5.42.92.213	192.168.2.4
2024-07-27T12:12:08.755787+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T12:12:08.971532+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T12:12:05.822240+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T12:12:12.155240+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T12:12:11.480008+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T12:12:10.128355+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T12:12:08.534683+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T12:12:11.270445+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T12:12:00.115561+0200	TCP	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T12:12:11.697363+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 27, 2024 12:11:53.601545095 CEST	49675	443	192.168.2.4	173.222.162.32
Jul 27, 2024 12:11:59.358750105 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:11:59.364186049 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:11:59.364263058 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:11:59.381304979 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:11:59.386472940 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:00.052894115 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:00.101584911 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:00.115561008 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:00.121463060 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:00.321852922 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:00.367137909 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:03.210824013 CEST	49675	443	192.168.2.4	173.222.162.32
Jul 27, 2024 12:12:05.370388985 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:05.392292976 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:05.600991011 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:05.601041079 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:05.601077080 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:05.601103067 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:05.601111889 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:05.601150036 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:05.601161957 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:05.648309946 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:05.822240114 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:05.827728033 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:06.033339024 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:06.037204981 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:06.047758102 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:06.248157024 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:06.259979010 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:06.265192986 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:06.465255976 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:06.508208990 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:06.512542963 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:06.518907070 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:06.728985071 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:06.733994007 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:06.746841908 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:06.952682018 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:06.963749886 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:06.970953941 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:06.970999002 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:06.971028090 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:06.971055984 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:06.971084118 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:06.973082066 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:06.973109961 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:06.973334074 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:07.280647039 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:07.335829020 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:07.886940956 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:07.894290924 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:07.894335032 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:07.894364119 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:08.228346109 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:08.253191948 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:08.260400057 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:08.468641043 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:08.524533033 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:08.534682989 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:08.539891958 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:08.754105091 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:08.755786896 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:08.761305094 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:08.969573021 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:08.971532106 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:08.986795902 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:09.187621117 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:09.188596964 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:09.193743944 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:09.394819021 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:09.445199966 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:09.445962906 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:09.451039076 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:09.451078892 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:09.451112032 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:09.451291084 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:09.451320887 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:09.451375961 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:09.451402903 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:09.451452017 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:09.451479912 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:09.456113100 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:09.456221104 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:09.456248999 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:09.456276894 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:09.456306934 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:09.681288004 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:09.726433992 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:09.826085091 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:09.832324028 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.040946960 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.085817099 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.122925997 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.128285885 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.128328085 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.128355026 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.128381014 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.128390074 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.128408909 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.128437996 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.128454924 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.128464937 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.128495932 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.128523111 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.128530025 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.128583908 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.128598928 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.128627062 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.128659010 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.128688097 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.133661032 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.133690119 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.133721113 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.133771896 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.133856058 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.133884907 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.133914948 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.133919001 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.133946896 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.133958101 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.133970976 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.133985043 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.134011030 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.134037018 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.134118080 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.134186029 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.134273052 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.134318113 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.134346008 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.134367943 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.134383917 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.134423971 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.139820099 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.139883995 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.140083075 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.140136003 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.140183926 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.140243053 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.140574932 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.140628099 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.140650034 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.140682936 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.140703917 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.140711069 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.140753984 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.140758991 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.140788078 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.140806913 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.140815973 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.140841007 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.140842915 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.140871048 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.140873909 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.140897036 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.140899897 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.140944004 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.140971899 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.140999079 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.141025066 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.141052008 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.141077995 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.141103983 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.141129971 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.141155958 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.141181946 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.141207933 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.141259909 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.141287088 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.141314983 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.141341925 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.141350031 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.141367912 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.141395092 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.141412973 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.141422987 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.141436100 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.141449928 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.141477108 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.141480923 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.141503096 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.141503096 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.141521931 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.141530991 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.141556978 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.141562939 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.141583920 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.141587019 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.141603947 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.141611099 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.141638041 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.141638994 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.141658068 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.141664982 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.141690969 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.141699076 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.141721964 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.141725063 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.141745090 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.141748905 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.141763926 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.141799927 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.145636082 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.145664930 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.145690918 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.145692110 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.145709991 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.145719051 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.145740032 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.145746946 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.145776033 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.145777941 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.145802975 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.145803928 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.145822048 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.145832062 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.145859003 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.145859003 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.145879984 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.145885944 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.145914078 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.145922899 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.145941019 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.145967960 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.145994902 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.146022081 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.146048069 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.146074057 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.146856070 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.147272110 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.147345066 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.147372007 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.147490978 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.147517920 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.147599936 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.147902966 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.147931099 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.147957087 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.147988081 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.148035049 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.148066044 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.148277998 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.148310900 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.148358107 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.148536921 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.148561954 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.148565054 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.148591995 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.148638964 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.148643017 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.148663998 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.148670912 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.148688078 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.148698092 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.148739100 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.148746014 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.148766041 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.148772955 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.148802042 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.148813963 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.148838997 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.148840904 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.148864985 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.148891926 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.148897886 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.148919106 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.148946047 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.148946047 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.148969889 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.148972988 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.148993969 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.149020910 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.149025917 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.149049044 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.149075031 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.149079084 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.149102926 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.149102926 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.149121046 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.149130106 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.149156094 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.149159908 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.149178982 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.149183035 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.149210930 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.149220943 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.149238110 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.149249077 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.149286985 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.149317026 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.149344921 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.149372101 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.149398088 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.149425030 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.149451971 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.149482965 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.149509907 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.149535894 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.149561882 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.149588108 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.149614096 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.149640083 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.149688005 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.149713993 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.149740934 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.149768114 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.149794102 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.151407957 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.151458025 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.151485920 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.151842117 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.151870012 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.151895046 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.151928902 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.151954889 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.151982069 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.152008057 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.152034044 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.152060986 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.152245998 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.154735088 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.154766083 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.154789925 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.154808998 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.154814005 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.154841900 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.154869080 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.154891014 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.154918909 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.154918909 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.154947996 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.154966116 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.154974937 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.155002117 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.155003071 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.155019999 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.155030012 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.155050039 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.155081034 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.155087948 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.155109882 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.155136108 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.155138016 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.155162096 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.155164957 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.155183077 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.155191898 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.155217886 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.155244112 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.155271053 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.155298948 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.155345917 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.155373096 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.155399084 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.155425072 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.155451059 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.155477047 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.155503035 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.155529022 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.155555964 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.155581951 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.155607939 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.155637980 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.155664921 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.155689955 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.155739069 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.155766010 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.155791998 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.155818939 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.155844927 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.155870914 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.155898094 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.155925035 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.155951977 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.155978918 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.156004906 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.156030893 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.156058073 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.156105042 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.156131983 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.156157970 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.156183958 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.156209946 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.156235933 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.156261921 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.156287909 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.156512976 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.157159090 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.157186985 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.157217026 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.157234907 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.157238007 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.157263041 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.157300949 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.157314062 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.157341957 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.157368898 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.157388926 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.157416105 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.157443047 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.157491922 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.157519102 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.157545090 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.157593012 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.157619953 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.157645941 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.157672882 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.157699108 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.157749891 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.157778025 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.157804966 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.157830954 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.157857895 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.157883883 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.157910109 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.157937050 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.157984018 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.158011913 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.158039093 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.158065081 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.158092022 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.158118010 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.158143997 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.158169985 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.158195972 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.158221960 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.158267975 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.158296108 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.158323050 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.161227942 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.161257029 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.161304951 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.161331892 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.161358118 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.161385059 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.161411047 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.161458969 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.161487103 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.161513090 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.161540031 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.161566019 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.161592960 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.161618948 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.161667109 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.161694050 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.161720037 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.161746025 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.161772013 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.161798954 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.161824942 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.161870956 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.161899090 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.161925077 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.161941051 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.161951065 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.161978006 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.162004948 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.162045956 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.162051916 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.162080050 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.162106991 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.162132978 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.162159920 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.162185907 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.162213087 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.162239075 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.162266016 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.162292004 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.162321091 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.162369013 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.162395954 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.162422895 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.162447929 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.162473917 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.162499905 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.162527084 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.162553072 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.162579060 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.162606001 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.162631989 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.162657976 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.162683964 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.162709951 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.162735939 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.162761927 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.162789106 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.162815094 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.163181067 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.163208008 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.163239002 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.163266897 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.163328886 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.163357019 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.163408041 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.163434029 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.163460970 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.163486958 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.163532972 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.163558960 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.163606882 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.163634062 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.163880110 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.163986921 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.168380022 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.168410063 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.168458939 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.168502092 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.168741941 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.168770075 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.168849945 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.168900013 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.169022083 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.169080973 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.169209957 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.169236898 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.169286013 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.169317007 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.169388056 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.169418097 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.169444084 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.169527054 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.169554949 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.169603109 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.169630051 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.169677019 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.169703960 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.169729948 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.169763088 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.169810057 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.169837952 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.169864893 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.169891119 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.169918060 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.169965029 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.169991970 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.170018911 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.170044899 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.170070887 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.170097113 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.170144081 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.170170069 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.170196056 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.170222044 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.170269966 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.170298100 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.170324087 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.170350075 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.170397997 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.170423985 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.170470953 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.170497894 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.170527935 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.170816898 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.170845032 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.170887947 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.171047926 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.171080112 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.171309948 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.171313047 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.171340942 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.171370983 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.171396971 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.171412945 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.171447039 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.171473980 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.171519995 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.171547890 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.171941996 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.171969891 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.171999931 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.172025919 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.172074080 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.172101021 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.172147036 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.172174931 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.172775984 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.172804117 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.172831059 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.172857046 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.172993898 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.173022032 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.173069000 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.173095942 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.173122883 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.173150063 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.173311949 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.173358917 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.173386097 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.173417091 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.173444033 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.173585892 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.173614025 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.173640013 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.173763990 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.173791885 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.173818111 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.173845053 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.173871040 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.173897028 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.173943996 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.173990965 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.174019098 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.174308062 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.174369097 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.174396038 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.174426079 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.174452066 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.174479008 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.174504995 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.174530983 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.174577951 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.176496029 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.176527023 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.176554918 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.176585913 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.176635027 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.176666975 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.176723957 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.176731110 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.176842928 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.177565098 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.177592993 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.177675009 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.177701950 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.177728891 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.177756071 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.177804947 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.177833080 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.177859068 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.177885056 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.177916050 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.177942991 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.177968979 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.177994967 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.178045034 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.178072929 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.178098917 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.178124905 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.178163052 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.178190947 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.178237915 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.178265095 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.178292036 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.178320885 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.178347111 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.178373098 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.178399086 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.178426027 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.178452015 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.178478003 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.178504944 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.178530931 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.178556919 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.178582907 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.178611040 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.178637028 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.178663969 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.178711891 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.178739071 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.178771019 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.178797960 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.178824902 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.178852081 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.178878069 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.178905010 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.178930998 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.181984901 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.182013988 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.182040930 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.182068110 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.182094097 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.182121038 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.182147026 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.182173967 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.182202101 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.182229042 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.182241917 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:10.182284117 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.182312965 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.182339907 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.182368040 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.182395935 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.182423115 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.182449102 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.182476997 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.182503939 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.182531118 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.182579994 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.182607889 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.182635069 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.182661057 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.182687998 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.182713985 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.182739973 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.182766914 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.182792902 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.182818890 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.182845116 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.182872057 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:10.223756075 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:11.048351049 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:11.052524090 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:11.057439089 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:11.266215086 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:11.270445108 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:11.275599003 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:11.477648973 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:11.480007887 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:11.484930992 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:11.696901083 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:11.697362900 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:11.703248024 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:11.912623882 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:11.913475037 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:11.918452024 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:12.120214939 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 12:12:12.155240059 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 12:12:19.246202946 CEST	49723	80	192.168.2.4	2.19.126.163
Jul 27, 2024 12:12:19.251566887 CEST	80	49723	2.19.126.163	192.168.2.4
Jul 27, 2024 12:12:19.251626968 CEST	49723	80	192.168.2.4	2.19.126.163
Jul 27, 2024 12:13:07.382949114 CEST	49724	80	192.168.2.4	2.19.126.163
Jul 27, 2024 12:13:07.388839960 CEST	80	49724	2.19.126.163	192.168.2.4
Jul 27, 2024 12:13:07.392471075 CEST	49724	80	192.168.2.4	2.19.126.163

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 27, 2024 12:12:16.770226955 CEST	1.1.1.1	192.168.2.4	0x7f6d	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:12:16.770226955 CEST	1.1.1.1	192.168.2.4	0x7f6d	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:12:18.180906057 CEST	1.1.1.1	192.168.2.4	0x2e1	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 12:12:18.180906057 CEST	1.1.1.1	192.168.2.4	0x2e1	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:12:30.412411928 CEST	1.1.1.1	192.168.2.4	0xc400	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 12:12:30.412411928 CEST	1.1.1.1	192.168.2.4	0xc400	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	06:11:56
Start date:	27/07/2024
Path:	C:\Users\user\Desktop\nuCc19sDOl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\nuCc19sDOl.exe"
Imagebase:	0xd70000
File size:	625'152 bytes
MD5 hash:	01E059B3901BD579FB8EA4EBC34009F9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1685085815.000000006CF79000.00000004.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	06:11:56
Start date:	27/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:11:57
Start date:	27/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x4e0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.1818185346.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.1819320060.0000000002884000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.1819320060.0000000002B79000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	18.4%
Dynamic/Decrypted Code Coverage:	1.8%
Signature Coverage:	11.2%
Total number of Nodes:	599
Total number of Limit Nodes:	6

Executed Functions

Function 6CF57A60 Relevance: 96.7, APIs: 19, Strings: 29, Instructions: 12701memorythreadinjectionCOMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNELBASE ref: 6CF5EF7D
ShowWindow.USER32 ref: 6CF5EFAE
CreateProcessW.KERNELBASE ref: 6CF62B93
VirtualAlloc.KERNELBASE ref: 6CF62D3C
Wow64GetThreadContext.KERNEL32 ref: 6CF62E70
VirtualAllocEx.KERNELBASE ref: 6CF62F89
VirtualAllocEx.KERNEL32 ref: 6CF630CA
WriteProcessMemory.KERNELBASE ref: 6CF63128
WriteProcessMemory.KERNELBASE ref: 6CF6344C
ReadProcessMemory.KERNEL32 ref: 6CF63F38
WriteProcessMemory.KERNEL32 ref: 6CF64029
WriteProcessMemory.KERNELBASE ref: 6CF64205
Wow64SetThreadContext.KERNEL32 ref: 6CF64271
ResumeThread.KERNELBASE ref: 6CF64286
CloseHandle.KERNEL32 ref: 6CF642AA
CloseHandle.KERNEL32 ref: 6CF642BE
VirtualAlloc.KERNEL32 ref: 6CF64E41
GetThreadContext.KERNEL32 ref: 6CF64E89
ReadProcessMemory.KERNEL32 ref: 6CF650AC

Strings

uB, xrefs: 6CF5FC1C
)H?", xrefs: 6CF5E229
ie8, xrefs: 6CF61776
D, xrefs: 6CF6290D
#lH, xrefs: 6CF6328C
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe, xrefs: 6CF629DC, 6CF64DE2
fJ>X, xrefs: 6CF63D79
)H?", xrefs: 6CF646C6
<jv, xrefs: 6CF5C2A4
#lH, xrefs: 6CF631C8
kernel32.dll, xrefs: 6CF5EFB4
ntdll.dll, xrefs: 6CF5EFC8
SQSyq6V1kow76dHTyR1lMG4GrkJ2aFuoQFXRphPFl6VqDTISjkDMrLlqQkzYKgagLaQJZMAcORL0eLAL1zFoPthLqkMPG8hFupfZkjdDmj6L2L0U25ZSUxzgNpdnWegMndS1DkZHXJjB3U4LvtyzCONYH36/WjsG90V6wjPl9ZJw014gq4Vhe5jfUttvPRKJ5+0vIfDmL6hRrOJrqevircXUDzwLfRQy3OGbBJFQoJIpvZDUyreKESuNiHtoLlvGeR8Z, xrefs: 6CF59B47, 6CF616FB, 6CF61771
fJ>X, xrefs: 6CF63DF9
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 6CF6295A
2X!1, xrefs: 6CF609D6
yJgF, xrefs: 6CF5BA20
-0f, xrefs: 6CF61B85
$oJ\, xrefs: 6CF63564
NWf, xrefs: 6CF5C9CD
Us6, xrefs: 6CF632EB
}kW8, xrefs: 6CF5D4C8
X', xrefs: 6CF60C03
@, xrefs: 6CF630C2
NA`f, xrefs: 6CF63CC3
JGG\, xrefs: 6CF5CD02
$oJ\, xrefs: 6CF635FB
}kW8, xrefs: 6CF5D477
-0f, xrefs: 6CF61B05

Memory Dump Source

Source File: 00000000.00000002.1685019446.000000006CF51000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1685002139.000000006CF50000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685060302.000000006CF72000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CF79000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CFBA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685181697.000000006CFC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_nuCc19sDOl.jbxd

Yara matches

Similarity

API ID: Process$Memory$AllocThreadVirtualWrite$Context$CloseHandleReadWindowWow64$ConsoleCreateResumeShow
String ID: NWf$#lH$#lH$$oJ\$$oJ\$)H?"$)H?"$-0f$-0f$2X!1$<jv$@$C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe$D$JGG\$NA`f$SQSyq6V1kow76dHTyR1lMG4GrkJ2aFuoQFXRphPFl6VqDTISjkDMrLlqQkzYKgagLaQJZMAcORL0eLAL1zFoPthLqkMPG8hFupfZkjdDmj6L2L0U25ZSUxzgNpdnWegMndS1DkZHXJjB3U4LvtyzCONYH36/WjsG90V6wjPl9ZJw014gq4Vhe5jfUttvPRKJ5+0vIfDmL6hRrOJrqevircXUDzwLfRQy3OGbBJFQoJIpvZDUyreKESuNiHtoLlvGeR8Z$Us6$X'$fJ>X$fJ>X$ie8$kernel32.dll$ntdll.dll$uB$yJgF$}kW8$}kW8
API String ID: 3720985882-2877712817
Opcode ID: c9aec5adf0c128b8d7f31c835da79109fde9b656fac9dbce0f2494faad3f9c1e
Instruction ID: 782d1d3a3685d00b5185e8d74407a8a87eb4241dafcfe487eb277ab967827055
Opcode Fuzzy Hash: c9aec5adf0c128b8d7f31c835da79109fde9b656fac9dbce0f2494faad3f9c1e
Instruction Fuzzy Hash: FE341272B50215CFCB25CE2EC9843DABBF1AB5B351F104385D919ABBA1C7369E958F00

Function 6CF51230 Relevance: 63.6, APIs: 15, Strings: 18, Instructions: 5829filememoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6CF564E9
GetModuleHandleA.KERNEL32 ref: 6CF565A9
K32GetModuleInformation.KERNEL32 ref: 6CF5671C
GetModuleFileNameA.KERNEL32 ref: 6CF56745
CreateFileA.KERNELBASE ref: 6CF56786
CreateFileMappingA.KERNEL32 ref: 6CF568DD
CloseHandle.KERNEL32 ref: 6CF569EB
MapViewOfFile.KERNELBASE ref: 6CF56A2D
VirtualProtect.KERNELBASE ref: 6CF56DCB
VirtualProtect.KERNELBASE ref: 6CF56ED6
FindCloseChangeNotification.KERNELBASE ref: 6CF56F51
CloseHandle.KERNEL32 ref: 6CF56F71
CloseHandle.KERNEL32 ref: 6CF56F83
GetModuleHandleA.KERNEL32 ref: 6CF5745B
VirtualProtect.KERNEL32 ref: 6CF5756D

Strings

J2#", xrefs: 6CF53A61
)[K{, xrefs: 6CF54441
MAM, xrefs: 6CF54D25
D$s, xrefs: 6CF53291
r[], xrefs: 6CF53995
J2#", xrefs: 6CF53AD7
@, xrefs: 6CF57561
:Ozj, xrefs: 6CF54794
g'[, xrefs: 6CF53E5C
Gfp}, xrefs: 6CF5362E
r>3, xrefs: 6CF557DC
R0*V, xrefs: 6CF56992
`49, xrefs: 6CF51259
wT?Q, xrefs: 6CF565F7
g'[, xrefs: 6CF53EE2
v9r, xrefs: 6CF5312A
R0*V, xrefs: 6CF5692B
>kcn, xrefs: 6CF537E9

Memory Dump Source

Source File: 00000000.00000002.1685019446.000000006CF51000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1685002139.000000006CF50000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685060302.000000006CF72000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CF79000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CFBA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685181697.000000006CFC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_nuCc19sDOl.jbxd

Yara matches

Similarity

API ID: Handle$CloseFileModule$ProtectVirtual$Create$ChangeCurrentFindInformationMappingNameNotificationProcessView
String ID: )[K{$:Ozj$>kcn$@$Gfp}$J2#"$J2#"$MAM$R0*V$R0*V$g'[$g'[$r[]$v9r$wT?Q$D$s$`49$r>3
API String ID: 3270589029-3267666716
Opcode ID: c75e289b82cde051ddebbcd32badc40ec29a5fd06bdabe270a7f093bb68f2ffb
Instruction ID: 2f8e5fc55c01b83f677e648d7ce5a8d387aa2429644abdf130ea5d1ae512d049
Opcode Fuzzy Hash: c75e289b82cde051ddebbcd32badc40ec29a5fd06bdabe270a7f093bb68f2ffb
Instruction Fuzzy Hash: C9A34832E15315CFDB14CF3CC9843DAB7F2AB63310F61925AD61997A98C7369A988F01

Function 6CF575A0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 254
librarynativeloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 6CF575BE
GetProcAddress.KERNEL32 ref: 6CF57706
NtQueryInformationProcess.NTDLL ref: 6CF5775F

Strings

ntdll.dll, xrefs: 6CF575B5
NtQueryInformationProcess, xrefs: 6CF576F9

Memory Dump Source

Source File: 00000000.00000002.1685019446.000000006CF51000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1685002139.000000006CF50000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685060302.000000006CF72000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CF79000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CFBA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685181697.000000006CFC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_nuCc19sDOl.jbxd

Yara matches

Similarity

API ID: AddressHandleInformationModuleProcProcessQuery
String ID: NtQueryInformationProcess$ntdll.dll
API String ID: 3384173408-2906145389
Opcode ID: b6540ca62ab171a552cabd81545f60ae4d0cfd16363b20e488ea7078eb4e18e9
Instruction ID: c1a2e2325861b9a1ddead978eb54b0b48176afe2139c6c4132fb337210a76505
Opcode Fuzzy Hash: b6540ca62ab171a552cabd81545f60ae4d0cfd16363b20e488ea7078eb4e18e9
Instruction Fuzzy Hash: EE91EFB2A69204CFCB00CFBCD5847DEBBF1EB56384F90811BD915EBB94C635991A8B41

Function 017B24E7 Relevance: 4.0, Strings: 3, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

)uP, xrefs: 017B25A9
qKp, xrefs: 017B2548
d+cJ, xrefs: 017B25EE

Memory Dump Source

Source File: 00000000.00000002.1681967635.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17b0000_nuCc19sDOl.jbxd

Similarity

API ID:
String ID: d+cJ$qKp$)uP
API String ID: 0-3434847562
Opcode ID: 4acd9522385bedcd897c4e35de7ae4e7463a602dc369e3d671a802648bc01cbe
Instruction ID: ac1e3f4c1a23972c7a538d69d188be30fb3f85891b922cbfabda811191f1d837
Opcode Fuzzy Hash: 4acd9522385bedcd897c4e35de7ae4e7463a602dc369e3d671a802648bc01cbe
Instruction Fuzzy Hash: 0E81CCB1606211CFDB15CF28C9E4AA6FBB1BF55300BB684E6D5228B6A7C330F950CB55

Function 017B2528 Relevance: 3.9, Strings: 3, Instructions: 176
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

)uP, xrefs: 017B25A9
qKp, xrefs: 017B2548
d+cJ, xrefs: 017B25EE

Memory Dump Source

Source File: 00000000.00000002.1681967635.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17b0000_nuCc19sDOl.jbxd

Similarity

API ID:
String ID: d+cJ$qKp$)uP
API String ID: 0-3434847562
Opcode ID: 156e83e6e2411e355c0dfefb4d55ea89cc714ca83ebce007379630128788a4b6
Instruction ID: 9609539fdd43d7442e95ed68feb20107603c0f664a2d8103370a28816a8a28ce
Opcode Fuzzy Hash: 156e83e6e2411e355c0dfefb4d55ea89cc714ca83ebce007379630128788a4b6
Instruction Fuzzy Hash: 0761D2B0606211CFD708CF68C9E46A6F7A1BF15300BB284A6D2229F2A6C730FD51CB95

Function 017B2518 Relevance: 3.9, Strings: 3, Instructions: 176
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

)uP, xrefs: 017B25A9
qKp, xrefs: 017B2548
d+cJ, xrefs: 017B25EE

Memory Dump Source

Source File: 00000000.00000002.1681967635.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17b0000_nuCc19sDOl.jbxd

Similarity

API ID:
String ID: d+cJ$qKp$)uP
API String ID: 0-3434847562
Opcode ID: 397f6fe98ed114074495707eea712d53282a168ef4d6e2c06731ee68aac220ba
Instruction ID: 07a14bcec6070b51f47e70e0f60d4db8e636e657ef8551e424c388f3b0898700
Opcode Fuzzy Hash: 397f6fe98ed114074495707eea712d53282a168ef4d6e2c06731ee68aac220ba
Instruction Fuzzy Hash: 8A61E0B0606201CFD708CF24C9E4AA6FBB1BF55300BB284A6D2228F2A6C330FD51CB55

Function 017B1053 Relevance: 2.6, Strings: 2, Instructions: 150
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 017B108D
Te^q, xrefs: 017B1207

Memory Dump Source

Source File: 00000000.00000002.1681967635.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17b0000_nuCc19sDOl.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: 9c743bbef2f74d1ce68f3de0d2b75057383f1e3009a2634909154dbc0a9a45ab
Instruction ID: 3cd381bbb32c6c70dfc0f53f6befd4923e804e24f7efbbc0408040a824989408
Opcode Fuzzy Hash: 9c743bbef2f74d1ce68f3de0d2b75057383f1e3009a2634909154dbc0a9a45ab
Instruction Fuzzy Hash: 4351D531F141558FCB088B6998A46AEFBF6FF85705F1184AAD402EB3A5CB358D05CBA1

Function 017B1070 Relevance: 2.6, Strings: 2, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 017B108D
Te^q, xrefs: 017B1207

Memory Dump Source

Source File: 00000000.00000002.1681967635.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17b0000_nuCc19sDOl.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: 96ad75f1565fbfd814ba3d6f6e3f1379b62a2553cd7dcfd5bc88baf51014aa52
Instruction ID: 55c0bbc8b0ec3c9b8229ffcf48eee9cc292ce4e8d45f09ff58a94bb9423ee467
Opcode Fuzzy Hash: 96ad75f1565fbfd814ba3d6f6e3f1379b62a2553cd7dcfd5bc88baf51014aa52
Instruction Fuzzy Hash: CB51D531F101558FCB08CB69D994AAEFAF6FBC9705F50846AD506EB364CB319D00CBA1

Function 0AF04748 Relevance: 1.7, Strings: 1, Instructions: 448
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

rbfM, xrefs: 0AF04888

Memory Dump Source

Source File: 00000000.00000002.1684970669.000000000AEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aef0000_nuCc19sDOl.jbxd

Similarity

API ID:
String ID: rbfM
API String ID: 0-2431342921
Opcode ID: d97b5fa6c65fa0bb0f6cb196c6f6edfc59f4c13f0c34373bb0b01cf262c77d6f
Instruction ID: 0dd4fae3a14755a1062ee3a93b5078e3ee906cafd9ba5be5b2a209bda03467a2
Opcode Fuzzy Hash: d97b5fa6c65fa0bb0f6cb196c6f6edfc59f4c13f0c34373bb0b01cf262c77d6f
Instruction Fuzzy Hash: 8DF14571B043159BC728CF79C991A7EFFE6ABC5202B54892AD582DB2E5C730ED01DB80

Function 017B08DF Relevance: 1.4, Strings: 1, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

s]fN, xrefs: 017B0863

Memory Dump Source

Source File: 00000000.00000002.1681967635.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17b0000_nuCc19sDOl.jbxd

Similarity

API ID:
String ID: s]fN
API String ID: 0-2657733947
Opcode ID: 4c857a9980e07a581d2e79e3b1aee8d8618142fba082e452e4ab9a2c6ec83a39
Instruction ID: f8ba85bd4a590f6d13513a975292e80ee6221521df3b7eba24136770abc9b885
Opcode Fuzzy Hash: 4c857a9980e07a581d2e79e3b1aee8d8618142fba082e452e4ab9a2c6ec83a39
Instruction Fuzzy Hash: 2E41AD30E11109CFD748CF6985846DFFBB2BB89210F25D4A6E459AB215D730CA418B85

Function 6CF658E8 Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6CF6592F
___scrt_uninitialize_crt.LIBCMT ref: 6CF65949

Memory Dump Source

Source File: 00000000.00000002.1685019446.000000006CF51000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1685002139.000000006CF50000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685060302.000000006CF72000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CF79000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CFBA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685181697.000000006CFC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_nuCc19sDOl.jbxd

Yara matches

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: ad762d879a7154107691d578b78aa569cf4cb12a7fc2eb7317b4a7641022bf8a
Instruction ID: b83c2079982723c5dabe011de6ea08f5861dd3bc929ca87f730c759f161ab994
Opcode Fuzzy Hash: ad762d879a7154107691d578b78aa569cf4cb12a7fc2eb7317b4a7641022bf8a
Instruction Fuzzy Hash: FC41D572E05629AFDB118F57C880B9F7AB5EB417A8F11411AE815B7F82C7318D458BA0

Function 6CF65998 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 6CF659D5
dllmain_crt_dispatch.LIBCMT ref: 6CF659EC
dllmain_raw.LIBCMT ref: 6CF65A34
dllmain_crt_dispatch.LIBCMT ref: 6CF65A47
dllmain_raw.LIBCMT ref: 6CF65A5A

Memory Dump Source

Source File: 00000000.00000002.1685019446.000000006CF51000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1685002139.000000006CF50000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685060302.000000006CF72000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CF79000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CFBA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685181697.000000006CFC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_nuCc19sDOl.jbxd

Yara matches

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: fa5c9d97af155aa6e43e6f69fb0deb653bd71a76411c6838cb440a6dbbef8d69
Instruction ID: 2322c133840d40fce1b09b50ec250bd57a353ecf5810d4a2ac6a7e2e2bb9d221
Opcode Fuzzy Hash: fa5c9d97af155aa6e43e6f69fb0deb653bd71a76411c6838cb440a6dbbef8d69
Instruction Fuzzy Hash: D621B272D01629AFDB258F57CC80AAF3A79EB81BA8F114125F8157BF52C7318D018BE0

Function 6CF657E1 Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6CF6582E

Part of subcall function 6CF65CAB: InitializeSListHead.KERNEL32(6CFC4020,6CF65838,6CF77A90,00000010,6CF657C9,?,?,?,6CF659F1,?,00000001,?,?,00000001,?,6CF77AD8), ref: 6CF65CB0

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6CF65898

Memory Dump Source

Source File: 00000000.00000002.1685019446.000000006CF51000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1685002139.000000006CF50000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685060302.000000006CF72000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CF79000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CFBA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685181697.000000006CFC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_nuCc19sDOl.jbxd

Yara matches

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: 0039e73227207b6cd40d0130d85abb5ea6ebbfc42062b2b7378496395eb68d95
Instruction ID: 75e5eb858806b8e69dbdc46dd696eb7678bd007476d89cf86d76a3260538e8f7
Opcode Fuzzy Hash: 0039e73227207b6cd40d0130d85abb5ea6ebbfc42062b2b7378496395eb68d95
Instruction Fuzzy Hash: 35210532A893019ADF11ABB7D8043DE37B1AF062ADF21045AD48077FC3DB624549C661

Function 6CF6BE0C Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 6CF6BE58
GetFileType.KERNELBASE(00000000), ref: 6CF6BE6A

Memory Dump Source

Source File: 00000000.00000002.1685019446.000000006CF51000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1685002139.000000006CF50000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685060302.000000006CF72000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CF79000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CFBA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685181697.000000006CFC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_nuCc19sDOl.jbxd

Yara matches

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 9e3f4de4255df6e68ac528b05ea3c5a8c0ddba22fff3a3629edd02fb18456890
Instruction ID: 1d24275f6981a113a4ff0d5a9b2c86376e0a8261f7ea96c0686c7dd57554a0b6
Opcode Fuzzy Hash: 9e3f4de4255df6e68ac528b05ea3c5a8c0ddba22fff3a3629edd02fb18456890
Instruction Fuzzy Hash: 2C11B772614B5146C7304E3F88957937AA5A767234B340F1AF3B686DE2C730D545E245

Function 0AF05178 Relevance: 1.6, APIs: 1, Instructions: 53
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(00000000), ref: 0AF051E8

Memory Dump Source

Source File: 00000000.00000002.1684970669.000000000AEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aef0000_nuCc19sDOl.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: dd5a6bebd61307e07cf775a2980a5edc555aeb206504e99c65db9190b5a51f5b
Instruction ID: 31665d123e3fdec405d3ff67ba78dc0d864e894903332f8d91f956406df6a56a
Opcode Fuzzy Hash: dd5a6bebd61307e07cf775a2980a5edc555aeb206504e99c65db9190b5a51f5b
Instruction Fuzzy Hash: 6D1123B1D0061A9BCB10CF9AD944B9EFBF4FF48320F10852AD819B7250C774A940CFA5

Function 0AF05508 Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE ref: 0AF05567

Memory Dump Source

Source File: 00000000.00000002.1684970669.000000000AEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aef0000_nuCc19sDOl.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 3ca1b46b37e7e261dee844e9966420591ec6292c16cea11f1c90e01808f5b2e5
Instruction ID: d0cb0cba0cda499d2cb55ce4bc02ccef4662dc47b9cb2ba86f081dd242b20450
Opcode Fuzzy Hash: 3ca1b46b37e7e261dee844e9966420591ec6292c16cea11f1c90e01808f5b2e5
Instruction Fuzzy Hash: 731136B1800349CFCB20DF9AD444BEEBBF4EF48324F24842AD558A7250D779A944CFA5

Function 017B1778 Relevance: 1.3, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LyIS, xrefs: 017B17F0

Memory Dump Source

Source File: 00000000.00000002.1681967635.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17b0000_nuCc19sDOl.jbxd

Similarity

API ID:
String ID: LyIS
API String ID: 0-2021629764
Opcode ID: 670865dc6fb5edcb61a7fcf89a64381896cc7dfe0e5bd819c3b576467dc4a9f4
Instruction ID: a11cc0222355818ed16656c9250a72b69f517768c5fd1714251ba7683719e6b4
Opcode Fuzzy Hash: 670865dc6fb5edcb61a7fcf89a64381896cc7dfe0e5bd819c3b576467dc4a9f4
Instruction Fuzzy Hash: 4501F772B192155FD7588E7AA9901A2FBA6FBC6260364C17BC508CB351CB309916CB91

Function 017B0838 Relevance: 1.3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

s]fN, xrefs: 017B0863

Memory Dump Source

Source File: 00000000.00000002.1681967635.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17b0000_nuCc19sDOl.jbxd

Similarity

API ID:
String ID: s]fN
API String ID: 0-2657733947
Opcode ID: 130aaddb986e54351ecd389e6a6d33649ce4ffa93a97454fe48ae1c350bd608c
Instruction ID: ca7de5406313a65883a1f832f807591e1e01141e1774487da7f370d44355542d
Opcode Fuzzy Hash: 130aaddb986e54351ecd389e6a6d33649ce4ffa93a97454fe48ae1c350bd608c
Instruction Fuzzy Hash: DAF0AF74D14208EFCB84CFB4D98929EBFF1EB59210F24D5A6D905D7214E7309B518B80

Function 017B0848 Relevance: 1.3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

Strings

s]fN, xrefs: 017B0863

Memory Dump Source

Source File: 00000000.00000002.1681967635.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17b0000_nuCc19sDOl.jbxd

Similarity

API ID:
String ID: s]fN
API String ID: 0-2657733947
Opcode ID: 8ef0c0d2220c62e9ad7f45ca69954838f1987fa39c057e81ff14346aad957915
Instruction ID: b5b12b676d189f7bd75271ad94c90a06eb768aadad454b182255c31ccf11c4c3
Opcode Fuzzy Hash: 8ef0c0d2220c62e9ad7f45ca69954838f1987fa39c057e81ff14346aad957915
Instruction Fuzzy Hash: 20F05E74E14209EFDB84CFB5998828EFBF2FB85205F20C5A5E905D7208E7309B518B90

Function 017B1290 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1681967635.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17b0000_nuCc19sDOl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bba4dc6dd7811fb29763385881723380170f469d78135844f3f6eaa0e760fb34
Instruction ID: c8fbf6f11d4a99c46d2f2c9118e2a7b701af19d3317f2d2ba3b60cdce198ee8e
Opcode Fuzzy Hash: bba4dc6dd7811fb29763385881723380170f469d78135844f3f6eaa0e760fb34
Instruction Fuzzy Hash: 9F51C670A101069FD704EB68DD6069EB767FB80310B50C729D10B8BB69DB34ED9AC7D6

Function 017B1575 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1681967635.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17b0000_nuCc19sDOl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 509334322fcfe371d9876c30616b17b3d2a6f5a3f0c8caab9042533217e82881
Instruction ID: 062062ae86319f69bdcd036356fd13631079e51d4cc0c6f7db16498ad9df41b6
Opcode Fuzzy Hash: 509334322fcfe371d9876c30616b17b3d2a6f5a3f0c8caab9042533217e82881
Instruction Fuzzy Hash: 3B31E731B04215CFC705CA69A8E42BEFBF3AFC9210B6985ABD456DB291D734CD118B51

Function 017B3CB0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1681967635.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17b0000_nuCc19sDOl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f373966cf67e2f983ea8630e5c3cd41e89bf520b2cd20b005fb3da072a2c1c4
Instruction ID: c2ae3d98c49f673cb4c40b5a3b680bccabeba202a8477f21c34d0a6662e5e52c
Opcode Fuzzy Hash: 5f373966cf67e2f983ea8630e5c3cd41e89bf520b2cd20b005fb3da072a2c1c4
Instruction Fuzzy Hash: D9110231A1A3845FD7028B78E86069A7FB2BB87320B1A85B7D545DB263D6245C0AC362

Function 017B28E1 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1681967635.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17b0000_nuCc19sDOl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c4b841a6c9fc98dc86c6b17e442715719752eb4a71bf50540ae2de3ce74d5f5
Instruction ID: 9ad6a253cf0ec507c0b1ab649d0b162475cf405d414566d08c2c834ca8a810bb
Opcode Fuzzy Hash: 6c4b841a6c9fc98dc86c6b17e442715719752eb4a71bf50540ae2de3ce74d5f5
Instruction Fuzzy Hash: 33118E723192454F8B584A7A98812E3FF9BBFC61B0309C5B3D45EDB25BD724E8118350

Function 017B29A0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1681967635.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17b0000_nuCc19sDOl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aa636a5cb0017546542cd0b98c1d2667eb08da44e1cf6186226edbc9a8d5cc8
Instruction ID: 92ea0d2368c0b11fe8ee8e26cc164e99fc2447a22227f219ef71055978ab72ad
Opcode Fuzzy Hash: 6aa636a5cb0017546542cd0b98c1d2667eb08da44e1cf6186226edbc9a8d5cc8
Instruction Fuzzy Hash: 50014976B102005BC7198E3A9CC06EAFBE7FBCA620B05C56BD009CB356CA209C02C750

Function 017B1BD9 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1681967635.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17b0000_nuCc19sDOl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11a4b4a37edc48ce015d9677d71c4c3241884938cedbb65c65e6abf5e21442fe
Instruction ID: c6b2ab56b71161409d403ffb3e17fe13bde25df109e23fb14f6f4ddf6bd5054f
Opcode Fuzzy Hash: 11a4b4a37edc48ce015d9677d71c4c3241884938cedbb65c65e6abf5e21442fe
Instruction Fuzzy Hash: 54012D357053449FCB354E38D8105D97BB7EBC6321F08456BD94287257CB75AC25C791

Function 017B29B0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1681967635.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17b0000_nuCc19sDOl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 865e17303b054956b207d45bbe38c48d0e85dfd09765bdc9a4a6dc5524358bd1
Instruction ID: dac5624db01bb9b858c205fd6ad08326c0dc5c28aac613ff034c6d6c8f8df35d
Opcode Fuzzy Hash: 865e17303b054956b207d45bbe38c48d0e85dfd09765bdc9a4a6dc5524358bd1
Instruction Fuzzy Hash: 6EF0B4757105155BD3289E3F9CD0A6AFADBBBC9620B04C52AE50AD7345CB20AC11C690

Function 017B22DA Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1681967635.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17b0000_nuCc19sDOl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a334899277d86b0eac24a0caf62b57990c5d1bd542366c3378c4a22202a081d7
Instruction ID: 75a3a185067416f0ab060f840ff2043cf486f46ae26a0dda103a39f2fca43d54
Opcode Fuzzy Hash: a334899277d86b0eac24a0caf62b57990c5d1bd542366c3378c4a22202a081d7
Instruction Fuzzy Hash: CCC08CD598F3498FC3048B30AD6CBCAEF9AA741215F0B88898802E9193F19C812F8D11

Function 017B21B5 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1681967635.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17b0000_nuCc19sDOl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 939734121f5140b168bb69a3bfcea894dbc0bb48a9cabe13d516bb2ad3fab4a8
Instruction ID: f8113d507f0e24dd47b4d3fdf2cf2972e4c704071cd1c6d79069405cb5d0acc2
Opcode Fuzzy Hash: 939734121f5140b168bb69a3bfcea894dbc0bb48a9cabe13d516bb2ad3fab4a8
Instruction Fuzzy Hash: 73D0C975301700CBC7249B25EEE8599B7F2BB566193440166D807CA2A5C7B19861CF00

Function 017B09E5 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1681967635.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17b0000_nuCc19sDOl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6317a7cb72a42f5513de58d94a4c417a377e2bcbfeee9753205b18e2b8994a1
Instruction ID: ca90c84eacbdf59ffcd1908893c5c6ae37f79d7c7c8513cc7779aa413142d67e
Opcode Fuzzy Hash: f6317a7cb72a42f5513de58d94a4c417a377e2bcbfeee9753205b18e2b8994a1
Instruction Fuzzy Hash: 1BC080346701155FC704DB38DD5455DBBF1BF4430071005249403C7195EF304F54C740

Non-executed Functions

Function 6CF65FCA Relevance: 6.1, APIs: 4, Instructions: 70COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,00000000), ref: 6CF65FD6
IsDebuggerPresent.KERNEL32 ref: 6CF660A2
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6CF660BB
UnhandledExceptionFilter.KERNEL32(?), ref: 6CF660C5

Memory Dump Source

Source File: 00000000.00000002.1685019446.000000006CF51000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1685002139.000000006CF50000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685060302.000000006CF72000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CF79000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CFBA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685181697.000000006CFC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_nuCc19sDOl.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 519c86b1736ab75928a1f9afe023a0790b4462867fa2efb94762ef878ddec835
Instruction ID: b1edb66bf1d5a872537fdf593d5438f2c0f25ef109d6a209154b2a600bc219d4
Opcode Fuzzy Hash: 519c86b1736ab75928a1f9afe023a0790b4462867fa2efb94762ef878ddec835
Instruction Fuzzy Hash: 96310AB5D05228DBDF21DF65D949BCDBBB8AF08304F1041AAE40CAB740EB719A85CF55

Function 6CF69F67 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 6CF6A05F
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 6CF6A069
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 6CF6A076

Memory Dump Source

Source File: 00000000.00000002.1685019446.000000006CF51000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1685002139.000000006CF50000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685060302.000000006CF72000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CF79000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CFBA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685181697.000000006CFC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_nuCc19sDOl.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: ed93ae2dde8f7b95928da33f07328dc59f650bf1e459f2143102f174782795be
Instruction ID: 30cd2b895549013ef9959866986a639bb459dc5cde8113721f5d17eb094a997f
Opcode Fuzzy Hash: ed93ae2dde8f7b95928da33f07328dc59f650bf1e459f2143102f174782795be
Instruction Fuzzy Hash: E831E574911228EBCB61DF25D888BCDBBB8BF08314F5042EAE41CA7650E7309B858F54

Function 6CF70BB5 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,6CF70BB0,?,?,00000008,?,?,6CF707B3,00000000), ref: 6CF70DE2

Memory Dump Source

Source File: 00000000.00000002.1685019446.000000006CF51000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1685002139.000000006CF50000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685060302.000000006CF72000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CF79000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CFBA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685181697.000000006CFC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_nuCc19sDOl.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: ba3b4e4b7ccb78b766dc180b0659f0dc3e1cc7f4d265f396b8a43b4625b42522
Instruction ID: 0e124fa4519119f6c55c8be75e6597d917ecee7341ea8ceccaed91e84406dea3
Opcode Fuzzy Hash: ba3b4e4b7ccb78b766dc180b0659f0dc3e1cc7f4d265f396b8a43b4625b42522
Instruction Fuzzy Hash: D6B1AC32210648DFD725CF28D486B957BE0FF05328F258699E8E9CF6A1C776E981CB50

Function 6CF66188 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6CF6619E

Memory Dump Source

Source File: 00000000.00000002.1685019446.000000006CF51000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1685002139.000000006CF50000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685060302.000000006CF72000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CF79000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CFBA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685181697.000000006CFC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_nuCc19sDOl.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 4fe563a41ff197948c739bd5e951f4c37883c7cad8d64d65d8ea70239039a268
Instruction ID: d765601158ae790c6c7f358794f18bebead4886dcbd2234917eff884e280381e
Opcode Fuzzy Hash: 4fe563a41ff197948c739bd5e951f4c37883c7cad8d64d65d8ea70239039a268
Instruction Fuzzy Hash: 2E516CB1F612058FEF55CF56C4817EABBF4FB89318F24852AE416EBA40D375AA00CB50

Function 017B39E0 Relevance: 1.4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

;, xrefs: 017B3A12

Memory Dump Source

Source File: 00000000.00000002.1681967635.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17b0000_nuCc19sDOl.jbxd

Similarity

API ID:
String ID: ;
API String ID: 0-919404518
Opcode ID: f0bf0b7a44946ec1c0e63d63e28b8032c00336b1d1f26a336b7871208d6df453
Instruction ID: a02a0a5413b82b32740605ddc2b60a5b82eb37c3cfc135e5e202f76ec0f9d1d4
Opcode Fuzzy Hash: f0bf0b7a44946ec1c0e63d63e28b8032c00336b1d1f26a336b7871208d6df453
Instruction Fuzzy Hash: 9E41D035F142598F8B40CFA889C5AAAFBB5BB8A200B219067E505FB251D334EE41CB91

Function 017B2E70 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

LNrp, xrefs: 017B2FCD

Memory Dump Source

Source File: 00000000.00000002.1681967635.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17b0000_nuCc19sDOl.jbxd

Similarity

API ID:
String ID: LNrp
API String ID: 0-3348034075
Opcode ID: 33ec8071e8fba807f9818ed22a52654ba08e7885dfb6070a2fdcc40ce7ad52f4
Instruction ID: 831737afaccd0b356b859800be6273d564a59b9a059d3c25822fef6ff3b13e9e
Opcode Fuzzy Hash: 33ec8071e8fba807f9818ed22a52654ba08e7885dfb6070a2fdcc40ce7ad52f4
Instruction Fuzzy Hash: BB41D372615206CFC710CA2AC4C97ABF7E6FB89310B58896AE056DFA15D734F942CF41

Function 017B39F0 Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

;, xrefs: 017B3A12

Memory Dump Source

Source File: 00000000.00000002.1681967635.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17b0000_nuCc19sDOl.jbxd

Similarity

API ID:
String ID: ;
API String ID: 0-919404518
Opcode ID: 5c9c4c0701376f47f5ba6fd9947db62c2fdc8dfbf507da5838df288b35589c26
Instruction ID: 90e865b715fc7528770b705ab9d94ef3e713d20c70a389509edc7da1c72041cf
Opcode Fuzzy Hash: 5c9c4c0701376f47f5ba6fd9947db62c2fdc8dfbf507da5838df288b35589c26
Instruction Fuzzy Hash: CF41CF35F1055A8F8B40CE68C9C5AAAF7F5BB89204B219166E505FB750D334EE81CB91

Function 6CF6BD3B Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 6CF6BD3B

Memory Dump Source

Source File: 00000000.00000002.1685019446.000000006CF51000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1685002139.000000006CF50000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685060302.000000006CF72000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CF79000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CFBA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685181697.000000006CFC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_nuCc19sDOl.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 1efe51588dd523a1aed67da317b576dc9a78b32ccbbbacf0c7b2e80f78f57e98
Instruction ID: b2ea7ed0aaa102b40f41e8740447748920769d2455ab8e655cf3b666496670e4
Opcode Fuzzy Hash: 1efe51588dd523a1aed67da317b576dc9a78b32ccbbbacf0c7b2e80f78f57e98
Instruction Fuzzy Hash: 99A01130B20200CB8B808F32A20A30A3AF8AA02A80302802CA80AC2000EA3880008F22

Function 6CF7EB17 Relevance: .8, Instructions: 816COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685085815.000000006CF79000.00000004.00000001.01000000.00000007.sdmp, Offset: 6CF79000, based on PE: true

Associated: 00000000.00000002.1685085815.000000006CFBA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685181697.000000006CFC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_nuCc19sDOl.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c1c04f1ff6574383b556a6376973668ba126c4031f6106f5aec94510e884408
Instruction ID: 3baccd505bbd76a3224298f5ba5a2b140dc2f3ba1d8b082d128d39f843f48878
Opcode Fuzzy Hash: 3c1c04f1ff6574383b556a6376973668ba126c4031f6106f5aec94510e884408
Instruction Fuzzy Hash: BB62346144E3C29FD7238B749C746D27FB0AE5721471E09DBD8C08F4A3E2191A6AD772

Function 6CF650E0 Relevance: .4, Instructions: 445COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685019446.000000006CF51000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1685002139.000000006CF50000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685060302.000000006CF72000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CF79000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CFBA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685181697.000000006CFC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_nuCc19sDOl.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e7143b91b8ac5d5b3d29e77247bd0038fbf4dca2a3d947c10b41a28a735e9d8
Instruction ID: 770c6f8217081b70ddc373a0bb4bccec3f81155a047e1fadda491871f5996a52
Opcode Fuzzy Hash: 4e7143b91b8ac5d5b3d29e77247bd0038fbf4dca2a3d947c10b41a28a735e9d8
Instruction Fuzzy Hash: 67F1D03AA45209CFCB04CEADE6953DEBBF2EB4A345F204116D811F7F56D22A8E058F15

Function 0AF04388 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684970669.000000000AEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aef0000_nuCc19sDOl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26c1c7a585c11fedf383300c06378f8780edaa0a002dacba166f592402136df9
Instruction ID: fbd5fd81fc8c2552ffed93e0e7b91ba5492e419d8d09c70cc7fcc66f2cd5be12
Opcode Fuzzy Hash: 26c1c7a585c11fedf383300c06378f8780edaa0a002dacba166f592402136df9
Instruction Fuzzy Hash: A3A1EF30B142549BCB68CF6DD48497EFBF2AFC9301B14992AE596DB2A5C330EC41DB80

Function 017B0972 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1681967635.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17b0000_nuCc19sDOl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b60ca2321b19f24d138be5057c6a985b8fa851345c6d4679f9186a8d97f508e5
Instruction ID: 84961c2789438e731a8bf54c4b3989bb7f97018418ec7d4455a0bb604965d55d
Opcode Fuzzy Hash: b60ca2321b19f24d138be5057c6a985b8fa851345c6d4679f9186a8d97f508e5
Instruction Fuzzy Hash: 6031AF70E11209CF9748CF6AC584ADFFBB2BB89210B16C4A7F4A5AB225D730C941CF85

Function 017B0927 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1681967635.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17b0000_nuCc19sDOl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 279db3d8050db10192b8482ded46d4724c1b333c39862e802c36f5897e97487b
Instruction ID: 057c8864d293a968d9c23deae0817ab9f6daab9b28d68ddc4b1c9fff2e1f73aa
Opcode Fuzzy Hash: 279db3d8050db10192b8482ded46d4724c1b333c39862e802c36f5897e97487b
Instruction Fuzzy Hash: 75318F70E11109CFA748CF5AC5846DFFBB2BB89210B16D497F4A6AB265D730C941CF45

Function 017B0C40 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1681967635.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17b0000_nuCc19sDOl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22071a154da9ca76fbc91482b7ebfea8e89d6c7c1d503ed865ba6611c2ff5bb9
Instruction ID: a80f37162c2d8e44f67b177715b0b52b2a3dc9467f089790ed14b1478e85d9ee
Opcode Fuzzy Hash: 22071a154da9ca76fbc91482b7ebfea8e89d6c7c1d503ed865ba6611c2ff5bb9
Instruction Fuzzy Hash: CF31CE30E10108CF9788CF59C584ADFFBB2BB89220B16D497F466AB265E730C9418F86

Function 017B0A87 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1681967635.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17b0000_nuCc19sDOl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45ab8ee8661c642d69b6c5c89d689c010c964527db60e7f484c7b0159874c8d2
Instruction ID: ead190a38280ec753f48d4f4cc3d30bd96bad21fb1a81dd5c91f9be6c14b32e2
Opcode Fuzzy Hash: 45ab8ee8661c642d69b6c5c89d689c010c964527db60e7f484c7b0159874c8d2
Instruction Fuzzy Hash: 8431AD30E10209CF9748CF6AC584ADFFBF2BB89210B16D49BF4A6AB265D730C9458F45

Function 6CF679FA Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 6CF67B19
___TypeMatch.LIBVCRUNTIME ref: 6CF67C27
_UnwindNestedFrames.LIBCMT ref: 6CF67D79
CallUnexpected.LIBVCRUNTIME ref: 6CF67D94

Strings

csm, xrefs: 6CF67A37
csm, xrefs: 6CF67AA4
csm, xrefs: 6CF67B50

Memory Dump Source

Source File: 00000000.00000002.1685019446.000000006CF51000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1685002139.000000006CF50000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685060302.000000006CF72000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CF79000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CFBA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685181697.000000006CFC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_nuCc19sDOl.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: cd8693324b92e1de6949871a545a8e771d43cdf47c45992496ab1dde88e7dbeb
Instruction ID: 303f8bf64582f757d05bfabc30321314206123a604490997ad20e808a0cae2fa
Opcode Fuzzy Hash: cd8693324b92e1de6949871a545a8e771d43cdf47c45992496ab1dde88e7dbeb
Instruction Fuzzy Hash: B2B17971801209EFCF05CFA6C980A9EBBB5FF05328B25465BE8106BE15D731EA55CFA1

Function 6CF66AA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6CF66AD7
___except_validate_context_record.LIBVCRUNTIME ref: 6CF66ADF
_ValidateLocalCookies.LIBCMT ref: 6CF66B68
__IsNonwritableInCurrentImage.LIBCMT ref: 6CF66B93
_ValidateLocalCookies.LIBCMT ref: 6CF66BE8

Strings

csm, xrefs: 6CF66B7D

Memory Dump Source

Source File: 00000000.00000002.1685019446.000000006CF51000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1685002139.000000006CF50000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685060302.000000006CF72000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CF79000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CFBA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685181697.000000006CFC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_nuCc19sDOl.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 34fabd999862b2e51e04e9ad4e46089004927f289ee9923bbbadc50e1a188981
Instruction ID: 3a38c303031ade6b640ce37b631f8b4ace3c837e3e4666b26c0eaa51ff75a5cb
Opcode Fuzzy Hash: 34fabd999862b2e51e04e9ad4e46089004927f289ee9923bbbadc50e1a188981
Instruction Fuzzy Hash: 2B418F34A01218DBCF00CF6AC884ADEBBB5AF4532CF148195F818DBB51D776EA19CB91

Function 6CF6B96A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,6CF6BA79,00000000,6CF69280,00000000,00000000,00000001,?,6CF6BBF2,00000022,FlsSetValue,6CF73CD8,6CF73CE0,00000000), ref: 6CF6BA2B

Strings

api-ms-, xrefs: 6CF6B9C1
ext-ms-, xrefs: 6CF6B9D5

Memory Dump Source

Source File: 00000000.00000002.1685019446.000000006CF51000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1685002139.000000006CF50000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685060302.000000006CF72000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CF79000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CFBA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685181697.000000006CFC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_nuCc19sDOl.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: dac9074de15ae03da0c911b298254c46c6999be7262f76f1b9794038b3d62f2b
Instruction ID: 6fac51316501a6b0b4671f4b0eb935dd3c377e879918c04013cfbe4725ae1ea2
Opcode Fuzzy Hash: dac9074de15ae03da0c911b298254c46c6999be7262f76f1b9794038b3d62f2b
Instruction Fuzzy Hash: 3A210532F11221EBCB268B279C44B4F7778DB423A4F250A14FD26A7E80DB31E900D6E0

Function 6CF6704C Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6CF66C81,6CF65DA0,6CF657B9,?,6CF659F1,?,00000001,?,?,00000001,?,6CF77AD8,0000000C,6CF65AEA), ref: 6CF6705A
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6CF67068
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6CF67081
SetLastError.KERNEL32(00000000,6CF659F1,?,00000001,?,?,00000001,?,6CF77AD8,0000000C,6CF65AEA,?,00000001,?), ref: 6CF670D3

Memory Dump Source

Source File: 00000000.00000002.1685019446.000000006CF51000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1685002139.000000006CF50000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685060302.000000006CF72000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CF79000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CFBA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685181697.000000006CFC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_nuCc19sDOl.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: d0026bd5793ba669b0d59ce7498a72d33e920e2e67427b89b4db1bf8e10b688b
Instruction ID: e85e18c8016918cf18953cf5cebfae088d0f01ffed28757b3015a9e291a91348
Opcode Fuzzy Hash: d0026bd5793ba669b0d59ce7498a72d33e920e2e67427b89b4db1bf8e10b688b
Instruction Fuzzy Hash: 2001B17272D3257EAA551B7B6C846D73774EB037BE734032BE55043DD0EF5249088260

Function 6CF6AB9E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\nuCc19sDOl.exe, xrefs: 6CF6ABBA

Memory Dump Source

Source File: 00000000.00000002.1685019446.000000006CF51000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1685002139.000000006CF50000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685060302.000000006CF72000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CF79000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CFBA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685181697.000000006CFC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_nuCc19sDOl.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\nuCc19sDOl.exe
API String ID: 0-2464264941
Opcode ID: 5d032c4be9a252a0b37b828a73fd26227d2245f4def0d4edd60f650c90ecb5ed
Instruction ID: 3180e3d0c0a69e8b5b15ef32449bc884abce4064eda9ea1c31afafc197cee678
Opcode Fuzzy Hash: 5d032c4be9a252a0b37b828a73fd26227d2245f4def0d4edd60f650c90ecb5ed
Instruction Fuzzy Hash: DE216D71604225AF9B019F77899099B7BE9FF0576C7048A18F91997E40E731E8508BA0

Function 6CF68BAE Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,C0FC7CE4,00000000,?,00000000,6CF714B2,000000FF,?,6CF68B48,?,?,6CF68B1C,?), ref: 6CF68BE3
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6CF68BF5
FreeLibrary.KERNEL32(00000000,?,00000000,6CF714B2,000000FF,?,6CF68B48,?,?,6CF68B1C,?), ref: 6CF68C17

Strings

CorExitProcess, xrefs: 6CF68BED
mscoree.dll, xrefs: 6CF68BDC

Memory Dump Source

Source File: 00000000.00000002.1685019446.000000006CF51000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1685002139.000000006CF50000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685060302.000000006CF72000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CF79000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CFBA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685181697.000000006CFC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_nuCc19sDOl.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: a4804a1b0bb81c53f4f3fb91464e99a868813aaea4236ed8aedec49c3fb7f2b9
Instruction ID: 4c9af202a6bbb8cb7f19dd811b5b4972818e0257ed0fbb7edf7c3a4eeb387253
Opcode Fuzzy Hash: a4804a1b0bb81c53f4f3fb91464e99a868813aaea4236ed8aedec49c3fb7f2b9
Instruction Fuzzy Hash: E2016731A11529EFDB128F51DC08FAE7BB9FB05755F00452AE811A2A90DB769904CB60

Function 6CF6D625 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 6CF6D6AA
__alloca_probe_16.LIBCMT ref: 6CF6D773
__freea.LIBCMT ref: 6CF6D7DA

Part of subcall function 6CF6C7CA: HeapAlloc.KERNEL32(00000000,6CF6B117,6CF6C4E4,?,6CF6B117,00000220,?,?,6CF6C4E4), ref: 6CF6C7FC

__freea.LIBCMT ref: 6CF6D7ED
__freea.LIBCMT ref: 6CF6D7FA

Memory Dump Source

Source File: 00000000.00000002.1685019446.000000006CF51000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1685002139.000000006CF50000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685060302.000000006CF72000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CF79000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CFBA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685181697.000000006CFC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_nuCc19sDOl.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 643607b804b25fd9922a369afc76f1ead5a6d6b99b2905eade35e5c8765b5f10
Instruction ID: 203b4c5c50072e378c1815372c193ab98f28d2cf2b9bcbec3f350b7d79bbaf29
Opcode Fuzzy Hash: 643607b804b25fd9922a369afc76f1ead5a6d6b99b2905eade35e5c8765b5f10
Instruction Fuzzy Hash: 5451B172601206AFEB218F66CC84EABBBB9EF44718B310529FD1897E10EB75C814D761

Function 6CF67622 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,6CF675D3,00000000,?,00000001,?,?,?,6CF676C2,00000001,FlsFree,6CF733B0,FlsFree), ref: 6CF6762F
GetLastError.KERNEL32(?,6CF675D3,00000000,?,00000001,?,?,?,6CF676C2,00000001,FlsFree,6CF733B0,FlsFree,00000000,?,6CF67121), ref: 6CF67639
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 6CF67661

Strings

api-ms-, xrefs: 6CF67646

Memory Dump Source

Source File: 00000000.00000002.1685019446.000000006CF51000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1685002139.000000006CF50000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685060302.000000006CF72000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CF79000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CFBA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685181697.000000006CFC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_nuCc19sDOl.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 38b3d41b0fd02df7654aa7d3f46aa0836d66b0be5545ede89ae733a179e82814
Instruction ID: 1028eb68a77dfa05d8b6f33dc1cee0e7ffc85aeef375da9035e436ee38568dcb
Opcode Fuzzy Hash: 38b3d41b0fd02df7654aa7d3f46aa0836d66b0be5545ede89ae733a179e82814
Instruction Fuzzy Hash: 43E01A30A44205FAEB611B62EC0DF4A3E76AB01B48F604025F90DA8D91DB63951099B6

Function 6CF6DD32 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(C0FC7CE4,00000000,00000000,?), ref: 6CF6DD95

Part of subcall function 6CF6B76C: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6CF6D7D0,?,00000000,-00000008), ref: 6CF6B7CD

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6CF6DFE7
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6CF6E02D
GetLastError.KERNEL32 ref: 6CF6E0D0

Memory Dump Source

Source File: 00000000.00000002.1685019446.000000006CF51000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1685002139.000000006CF50000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685060302.000000006CF72000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CF79000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CFBA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685181697.000000006CFC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_nuCc19sDOl.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: ceb8b7ecf2f3d40a4858ad709ab3a5657f77431c9e1681772d52065058cbd07c
Instruction ID: 505e0893d053edbb2619e614076dde00e2fe0a87977016a4753280e26c718e32
Opcode Fuzzy Hash: ceb8b7ecf2f3d40a4858ad709ab3a5657f77431c9e1681772d52065058cbd07c
Instruction Fuzzy Hash: 86D18D76E05248AFDF11CFA9C880AEEBBB5FF09314F24426AE455EBB41D730A945CB50

Function 6CF677A3 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6CF6786A
___AdjustPointer.LIBCMT ref: 6CF6788D
___AdjustPointer.LIBCMT ref: 6CF67929

Memory Dump Source

Source File: 00000000.00000002.1685019446.000000006CF51000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1685002139.000000006CF50000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685060302.000000006CF72000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CF79000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CFBA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685181697.000000006CFC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_nuCc19sDOl.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: b67f5f9979fc1100c0892e011625589455af5f34b60792401212605e9f218bed
Instruction ID: 0f5d1f61231d02ae24b7bd90d1cb4bd54dd71c088558abf03246e5074c3ea02b
Opcode Fuzzy Hash: b67f5f9979fc1100c0892e011625589455af5f34b60792401212605e9f218bed
Instruction Fuzzy Hash: 2351AE72A05606EFEB158F66D840BAA77B4EF05718F30462BE81597F90E731EC84CB90

Function 6CF6A3B8 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 6CF6B76C: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6CF6D7D0,?,00000000,-00000008), ref: 6CF6B7CD

GetLastError.KERNEL32 ref: 6CF6A41C
__dosmaperr.LIBCMT ref: 6CF6A423
GetLastError.KERNEL32(?,?,?,?), ref: 6CF6A45D
__dosmaperr.LIBCMT ref: 6CF6A464

Memory Dump Source

Source File: 00000000.00000002.1685019446.000000006CF51000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1685002139.000000006CF50000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685060302.000000006CF72000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CF79000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CFBA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685181697.000000006CFC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_nuCc19sDOl.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 0218b404b0d99dc599618aecbf5fba8e1e59cb629ce4b2693ddb1d97ed928c20
Instruction ID: 271bdf8d5211216e5d8a9ab422853b26aa8538db8b4038741aec6bea1aef1ad5
Opcode Fuzzy Hash: 0218b404b0d99dc599618aecbf5fba8e1e59cb629ce4b2693ddb1d97ed928c20
Instruction Fuzzy Hash: F721BE31604235EF9B109FB78C84A9BB7F9FF053687148629E85987E20DB31EC148BA0

Function 6CF6B80F Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6CF6B817

Part of subcall function 6CF6B76C: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6CF6D7D0,?,00000000,-00000008), ref: 6CF6B7CD

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6CF6B84F
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6CF6B86F

Memory Dump Source

Source File: 00000000.00000002.1685019446.000000006CF51000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1685002139.000000006CF50000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685060302.000000006CF72000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CF79000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CFBA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685181697.000000006CFC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_nuCc19sDOl.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: c15f4291469a7bbba1323dabc308dd1ad6c5e07fea5075031ee4707851358570
Instruction ID: 79a7e805c754e7fdca96de7ba63e32b7b183de3fbc70b0b33f26f33efd73b11d
Opcode Fuzzy Hash: c15f4291469a7bbba1323dabc308dd1ad6c5e07fea5075031ee4707851358570
Instruction Fuzzy Hash: 651104B2A05525BFAB1117B79CCCCAF7AACDE4629D7000924F901D2F00EB75CD0695B0

Function 6CF6F6A6 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,6CF6EE66,00000000,00000001,00000000,?,?,6CF6E124,?,00000000,00000000), ref: 6CF6F6BD
GetLastError.KERNEL32(?,6CF6EE66,00000000,00000001,00000000,?,?,6CF6E124,?,00000000,00000000,?,?,?,6CF6E6C7,00000000), ref: 6CF6F6C9

Part of subcall function 6CF6F68F: CloseHandle.KERNEL32(FFFFFFFE,6CF6F6D9,?,6CF6EE66,00000000,00000001,00000000,?,?,6CF6E124,?,00000000,00000000,?,?), ref: 6CF6F69F

___initconout.LIBCMT ref: 6CF6F6D9

Part of subcall function 6CF6F651: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6CF6F680,6CF6EE53,?,?,6CF6E124,?,00000000,00000000,?), ref: 6CF6F664

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,6CF6EE66,00000000,00000001,00000000,?,?,6CF6E124,?,00000000,00000000,?), ref: 6CF6F6EE

Memory Dump Source

Source File: 00000000.00000002.1685019446.000000006CF51000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1685002139.000000006CF50000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685060302.000000006CF72000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CF79000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CFBA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685181697.000000006CFC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_nuCc19sDOl.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 4dc99ca0187f0be07b75e2dbd151eb04851cb6c4707807a053c390faa8ea2a10
Instruction ID: 4cb9e275f1e51b668cab8eeb3027b54cd484ad5669f74fae7de98881370f574c
Opcode Fuzzy Hash: 4dc99ca0187f0be07b75e2dbd151eb04851cb6c4707807a053c390faa8ea2a10
Instruction Fuzzy Hash: F5F0A236651128BBCF925F96DC0CBCA3F77FB0A3B5B154110FA1996920C6338960DBA4

Function 6CF67D9F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 6CF67DC4

Strings

MOC, xrefs: 6CF67DD6
RCC, xrefs: 6CF67DDE

Memory Dump Source

Source File: 00000000.00000002.1685019446.000000006CF51000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1685002139.000000006CF50000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685060302.000000006CF72000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CF79000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685085815.000000006CFBA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1685181697.000000006CFC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_nuCc19sDOl.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 434c0023deb8d30de3699316f6cc0dc3698eac7ec39d5d376be9ce9ef80cd96f
Instruction ID: ff66025896a314a15b884641fc3e7b5604c8d7ca157f738d01ee5e674a85d604
Opcode Fuzzy Hash: 434c0023deb8d30de3699316f6cc0dc3698eac7ec39d5d376be9ce9ef80cd96f
Instruction Fuzzy Hash: 34415B71900209AFCF06CFA5CD80AEE7BB5FF48308F25815AF91467A50D3359955DBA0

Analysis Process: MSBuild.exePID: 6864, Parent PID: 6652COMMON

Execution Graph

Execution Coverage:	11.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	159
Total number of Limit Nodes:	11

Executed Functions

Function 06A00040 Relevance: 2.9, Strings: 2, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

., xrefs: 06A002C0
1, xrefs: 06A00345

Memory Dump Source

Source File: 00000002.00000002.1830879687.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a00000_MSBuild.jbxd

Similarity

API ID:
String ID: .$1
API String ID: 0-1839485796
Opcode ID: f8cf324abeeba82b6a056bb33d9d6d1215266a840f9e3815476300acadc9089f
Instruction ID: 1f07a5563b66ed9b347ecb3cb50eb1d3e4d6fa411d78fa7dc9ec602d172e215d
Opcode Fuzzy Hash: f8cf324abeeba82b6a056bb33d9d6d1215266a840f9e3815476300acadc9089f
Instruction Fuzzy Hash: 6EF1E274E01228CFDB68DF65D894B9DBBB2BF89305F5081A9E40EA7290DB755E81CF10

Function 04E61B90 Relevance: 1.8, APIs: 1, Instructions: 309
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1824047626.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4e60000_MSBuild.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 7c84da6b186234b73c3b8ba6c7a458b4e22d6bb48c62e6b97ef211ceb9d94aef
Instruction ID: 6132cbb8a26b9f3626e83b11e853bf00bcf916911e2c3e39807f8fc4971c7c2d
Opcode Fuzzy Hash: 7c84da6b186234b73c3b8ba6c7a458b4e22d6bb48c62e6b97ef211ceb9d94aef
Instruction Fuzzy Hash: 56A19E71D09388EFEB128FA5C8509DDBFB1EF0A344F19859EE4859B262D6349846CB11

Function 0261AE30 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0261B086

Memory Dump Source

Source File: 00000002.00000002.1819145419.0000000002610000.00000040.00000800.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2610000_MSBuild.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 66b91f5e8ed78c3f84007aeb5f77914908a20d24e9d158719a9650b0c66d76ed
Instruction ID: e7766bec33f175c9ef618aa4b9e4784b6f2ed91b3fccbb34b36f8ba8aed5c881
Opcode Fuzzy Hash: 66b91f5e8ed78c3f84007aeb5f77914908a20d24e9d158719a9650b0c66d76ed
Instruction Fuzzy Hash: 63710FB0A01B458FD724DF6AD14079ABBF2FF88304F048A2DD48A97B50DB75E949CB91

Function 04E61CE4 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04E61E02

Memory Dump Source

Source File: 00000002.00000002.1824047626.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4e60000_MSBuild.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: e02bfb1ca6c79970a6fc3da197967e9ececd7c11952f12842e23f4ea0e8b05e8
Instruction ID: 818022a872d952185f931cc775024b01410e7f23692a754fef547e1ecbfc314b
Opcode Fuzzy Hash: e02bfb1ca6c79970a6fc3da197967e9ececd7c11952f12842e23f4ea0e8b05e8
Instruction Fuzzy Hash: 3A51D0B1D003099FDB15CF99C884ADEFBB5FF48354F24812AE819AB210D775A845CF91

Function 04E60AA8 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04E61E02

Memory Dump Source

Source File: 00000002.00000002.1824047626.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4e60000_MSBuild.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 67385e4ccd341103b58fad32797b7e2144eb707677f86ae9b0c5856a2fa34f10
Instruction ID: d35696db20fe27992498d3972fc2297a76b25b383d4404085d140c4102aedb25
Opcode Fuzzy Hash: 67385e4ccd341103b58fad32797b7e2144eb707677f86ae9b0c5856a2fa34f10
Instruction Fuzzy Hash: 1151CFB1D00349AFDB15CF99C984ADEFBB5FF48354F24812AE819AB210D774A845CF91

Function 04E60BFC Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04E64381

Memory Dump Source

Source File: 00000002.00000002.1824047626.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4e60000_MSBuild.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: b8e48feb1dd9efb31a0321b0d05e185edc7e7b4d96afb512f0332fede7a7764e
Instruction ID: 16bd2f857c818cdbacc71e49a00cfdd34515819602f41c3566aa42656c95197c
Opcode Fuzzy Hash: b8e48feb1dd9efb31a0321b0d05e185edc7e7b4d96afb512f0332fede7a7764e
Instruction Fuzzy Hash: 9E4136B4A40209DFDB04CF99C488AAEBBF5FF88314F24C459D519AB361D334A840CBA4

Function 02614248 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 026159F1

Memory Dump Source

Source File: 00000002.00000002.1819145419.0000000002610000.00000040.00000800.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2610000_MSBuild.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a2b5ce1d14e33a16d7577c1cc36074b1c062a95f9ebace48de4234d3adbac378
Instruction ID: 9cce6d1129cec3abf35ee6cc4cc46bde9690fdcb456116b22b38d5a340e8bcb0
Opcode Fuzzy Hash: a2b5ce1d14e33a16d7577c1cc36074b1c062a95f9ebace48de4234d3adbac378
Instruction Fuzzy Hash: 8541E0B0C00619DBDB24CFA9C884B8DBBB5FF88304F24806AD409AB255DB756949CF91

Function 02615935 Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 026159F1

Memory Dump Source

Source File: 00000002.00000002.1819145419.0000000002610000.00000040.00000800.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2610000_MSBuild.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: df7133010c4e7c4a80eb4aa445e338401fc8ec4b10275120d1d824c55cd79e77
Instruction ID: a80c661ba369e9ac4119f413c0304dfe1075f215da60c5240047b35d8b94e32c
Opcode Fuzzy Hash: df7133010c4e7c4a80eb4aa445e338401fc8ec4b10275120d1d824c55cd79e77
Instruction Fuzzy Hash: 434102B0D00719CEDB24DFA9C884B8DFBF5BF44304F24805AD009AB255DB756949CF91

Function 0261C9A0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0261D2C6,?,?,?,?,?), ref: 0261D387

Memory Dump Source

Source File: 00000002.00000002.1819145419.0000000002610000.00000040.00000800.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2610000_MSBuild.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 657ffde120d53252256544a15368ad4190a3088058659e3de9ad479c0bc636c3
Instruction ID: b84b195cf513e4159c84621f5154d6857b767432e5d72f64c726a2a47b957f88
Opcode Fuzzy Hash: 657ffde120d53252256544a15368ad4190a3088058659e3de9ad479c0bc636c3
Instruction Fuzzy Hash: 5E21E4B5900218DFDB10CF9AD984ADEFBF4FB48310F14801AE958A7310D374A950CFA4

Function 0261D2F9 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0261D2C6,?,?,?,?,?), ref: 0261D387

Memory Dump Source

Source File: 00000002.00000002.1819145419.0000000002610000.00000040.00000800.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2610000_MSBuild.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 86e37efd523cef451152bc165e3ed52a789e0115f89a2d6b717359a6fa21319b
Instruction ID: 9e209ec31c8481b4021fc588a8eff8e5676f76d20d810ed3aab1e4cd955d7c2c
Opcode Fuzzy Hash: 86e37efd523cef451152bc165e3ed52a789e0115f89a2d6b717359a6fa21319b
Instruction Fuzzy Hash: CB21E4B59002189FDB10CF9AD584ADEBBF4FB48324F14801AE958B3310D378A950CFA4

Function 0261B2A0 Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0261B101,00000800,00000000,00000000), ref: 0261B312

Memory Dump Source

Source File: 00000002.00000002.1819145419.0000000002610000.00000040.00000800.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2610000_MSBuild.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: fa369b4661dc4ecdacff6a04501400ee92d4bd08c960e8a4111f0910cb87eb01
Instruction ID: 1c1b3375c0899296dae3e72bb19fcee0a534f3a7b5b04a3231b9a33061d88b8b
Opcode Fuzzy Hash: fa369b4661dc4ecdacff6a04501400ee92d4bd08c960e8a4111f0910cb87eb01
Instruction Fuzzy Hash: CC1103B69002488FDB10CFAAD544ADEFBF4EB88314F14846AD469A7210C379A545CFA5

Function 0261A870 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0261B101,00000800,00000000,00000000), ref: 0261B312

Memory Dump Source

Source File: 00000002.00000002.1819145419.0000000002610000.00000040.00000800.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2610000_MSBuild.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 83a4355ea67a2e6ac3e3a6f728445a2ec6a7a5bb3818bb9e90a2662e7d909c14
Instruction ID: 7364e7102c6888309bc47f8dbd5338d7604dfa26416df9351d939d282bc5ffdc
Opcode Fuzzy Hash: 83a4355ea67a2e6ac3e3a6f728445a2ec6a7a5bb3818bb9e90a2662e7d909c14
Instruction Fuzzy Hash: 8E1114B69003499FDB14CF9AD444AEEFBF4EB48314F14842EE419A7310C375A545CFA4

Function 06A056EC Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000,?,?,?,?,00000000,00000E20,?,?,06A05AC6), ref: 06A05BCE

Memory Dump Source

Source File: 00000002.00000002.1830879687.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a00000_MSBuild.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f4d52334cbf68f067e558d79592c7d2e5e1ffc84b40eb9a144f8fa69c63d75e4
Instruction ID: fb983dadcc3289aaeb8fa08e5c51c11655ec4b928f0c33e393763e364abe81aa
Opcode Fuzzy Hash: f4d52334cbf68f067e558d79592c7d2e5e1ffc84b40eb9a144f8fa69c63d75e4
Instruction Fuzzy Hash: 4C1112B1D002088BDB10EF9AD544B9EFBF4EF88310F14846AD459AB251E379A545CFA5

Function 06A05B67 Relevance: 1.6, APIs: 1, Instructions: 51libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000,?,?,?,?,00000000,00000E20,?,?,06A05AC6), ref: 06A05BCE

Memory Dump Source

Source File: 00000002.00000002.1830879687.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a00000_MSBuild.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: deb0758e6da2640fe9b3757240e7f91b04e204402e0f6d532e9599a898455f63
Instruction ID: 289b2150a18f7aba8654d31e1cce114e084b87232fde1a0cc5640fb8a8ac82d7
Opcode Fuzzy Hash: deb0758e6da2640fe9b3757240e7f91b04e204402e0f6d532e9599a898455f63
Instruction Fuzzy Hash: 371132B5C002088FDB20DFAAD944BDEFBF4EF88320F14842AD459AB210D378A545CFA1

Function 0261B020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0261B086

Memory Dump Source

Source File: 00000002.00000002.1819145419.0000000002610000.00000040.00000800.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2610000_MSBuild.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: e4d4294187ebc4725b1f2506e69a877a89e27c41eaf46976fb8f49c7acac4e42
Instruction ID: 884d87311fa022dfcd6f5b4a9b7c58b20c3eb47c92f82a0ec9f17f5202cb0b1a
Opcode Fuzzy Hash: e4d4294187ebc4725b1f2506e69a877a89e27c41eaf46976fb8f49c7acac4e42
Instruction Fuzzy Hash: BD110FB5C003498FCB20DF9AD444ADEFBF4AB88324F14842AD469B7210C379A645CFA1

Function 00D0D774 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1818885552.0000000000D0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d0d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6a06051c9c5af48b2adc75d877db1084813ae11681fa7249e3559eafab28721
Instruction ID: 6c991d15a621df28717d04886a544972c4308b65b3d64abd57fb36913ffc9e8f
Opcode Fuzzy Hash: b6a06051c9c5af48b2adc75d877db1084813ae11681fa7249e3559eafab28721
Instruction Fuzzy Hash: 6B210671500240EFCB05DF94D9C4B2ABFA6FB88314F24C66AE94D4A295C336D816CBB1

Function 00D0D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1818885552.0000000000D0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d0d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 765e05317e27dbb1209815caf0575a6deda6ec1c0f4cc0e85569ea184d29e001
Instruction ID: 2ea0720fe8d3432bf58a7a1792cf44d0ef69ae166efe0c741e9e9b8141e1223f
Opcode Fuzzy Hash: 765e05317e27dbb1209815caf0575a6deda6ec1c0f4cc0e85569ea184d29e001
Instruction Fuzzy Hash: C2212871500204DFDB05DF54D9C0B2ABF66FB94324F24C16EE90D4B296C336E856C6B2

Function 00D0D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1818885552.0000000000D0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d0d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb219c419a9211ef970516381bc5be97afb0a43ba7f1b717eb5960ff7103ff9a
Instruction ID: c8f032b72612bf88dacf623413e34bc56b38c3586566a25af2ed8f9fd210149a
Opcode Fuzzy Hash: cb219c419a9211ef970516381bc5be97afb0a43ba7f1b717eb5960ff7103ff9a
Instruction Fuzzy Hash: 3C212271504240DFCB05DF54D9C8B2ABF66FB98318F24C56AEC490B296C336D856CAB2

Function 00D1D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1818915719.0000000000D1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d1d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25ed65c786ef21cbb42d47f5afc97f08f8b6009cbffff225778ef50a9634fcf7
Instruction ID: 96447c69f705f0099fe27973031d410a9249b4b8942470274192503ad791cca4
Opcode Fuzzy Hash: 25ed65c786ef21cbb42d47f5afc97f08f8b6009cbffff225778ef50a9634fcf7
Instruction Fuzzy Hash: 2721F575504200EFCB14DF14E984B56BB66EB88314F24C56DE8494B296CB3AD887CA71

Function 00D1D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1818915719.0000000000D1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d1d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a68eddf181f66e315be2bb0614b0e4ab5b0c3094a2bc5e07fb0eeab9cea6a9e
Instruction ID: 963916f0a23bf8a93c8ddddf68fa743873cd9e094383df6dfba5daea120adc4b
Opcode Fuzzy Hash: 0a68eddf181f66e315be2bb0614b0e4ab5b0c3094a2bc5e07fb0eeab9cea6a9e
Instruction Fuzzy Hash: EB2183755093809FC702CF24D594755BF71EB46314F28C5DAD8498F2A7C33A984ACB62

Function 00D0D76F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1818885552.0000000000D0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d0d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7c8d58dc0dea2b6e01ffeb94055e7b182a7219ccea2c20f3472bf21e95a7b9d
Instruction ID: b923b600bb250980b2b34fefdba006ba6dde8898214f2e9eac6e3d1530f45e4d
Opcode Fuzzy Hash: c7c8d58dc0dea2b6e01ffeb94055e7b182a7219ccea2c20f3472bf21e95a7b9d
Instruction Fuzzy Hash: 6F21A276504280DFCB16CF54D9C4B16BF72FB98314F28C6AADD490B256C33AD816CBA1

Function 00D0D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1818885552.0000000000D0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d0d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 15fa31cffd7eb211055817ee4802608e32f9913dd551a422b37d386afc185811
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 8E112672404240CFCB02CF44D5C4B16BF72FB94324F28C2AADC090B256C33AE85ACBA1

Function 00D0D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1818885552.0000000000D0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d0d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 733d014f4c4c7a228d0bc6e3056949839fb56a014eea2df1ba80c22afe4e7f88
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 7911E976504240CFCB15CF54D9C4B16BF72FB94314F28C5AADC490B696C336D45ACBA1

Function 00D0DA6D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1818885552.0000000000D0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d0d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8eb1f69f3a3e4be77b72049e7db8570596a2905befdaeb530e8e9e551ae76320
Instruction ID: 1f19f205a2378dcf5ca09bfe075e43512973682ac268cd21026360d7f40e2784
Opcode Fuzzy Hash: 8eb1f69f3a3e4be77b72049e7db8570596a2905befdaeb530e8e9e551ae76320
Instruction Fuzzy Hash: 7B01A23160D3449AEB108A69D984767FF99EF61334F1CC46BED4E4A2C6C279DC40C671

Function 00D0DA6C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1818885552.0000000000D0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d0d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fc3644f57cfbdb861918fea58616cf2c9eec4af36952c5fd3c4f93c63fd3ed3
Instruction ID: cd1f706ca3ecbd321ea7e9a03cf5aa03666a4ce29cf29a56c0faa8933effcbae
Opcode Fuzzy Hash: 4fc3644f57cfbdb861918fea58616cf2c9eec4af36952c5fd3c4f93c63fd3ed3
Instruction Fuzzy Hash: 84F06D71509344AAEB108A1AD8C4BA6FFA8EF61734F18C45AED4D5B286C2799C44CAB1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report nuCc19sDOl.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\nuCc19sDOl.exe.log

C:\Users\user\AppData\Roaming\d3d9.dll

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Windows Analysis Report
nuCc19sDOl.exe

Function 6CF575A0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 254
librarynativeloaderCOMMON

Function 017B24E7 Relevance: 4.0, Strings: 3, Instructions: 201
COMMON

Function 017B2528 Relevance: 3.9, Strings: 3, Instructions: 176
COMMON

Function 017B2518 Relevance: 3.9, Strings: 3, Instructions: 176
COMMON

Function 017B1053 Relevance: 2.6, Strings: 2, Instructions: 150
COMMON

Function 017B1070 Relevance: 2.6, Strings: 2, Instructions: 139
COMMON

Function 0AF04748 Relevance: 1.7, Strings: 1, Instructions: 448
COMMON

Function 017B08DF Relevance: 1.4, Strings: 1, Instructions: 112
COMMON

Function 6CF658E8 Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Function 6CF65998 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Function 6CF657E1 Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Function 6CF6BE0C Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 0AF05178 Relevance: 1.6, APIs: 1, Instructions: 53
libraryCOMMON

Function 0AF05508 Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Function 017B1778 Relevance: 1.3, Strings: 1, Instructions: 51
COMMON