Edit tour

Windows Analysis Report
qg155Ew08h.exe

Overview

General Information

Sample name:	qg155Ew08h.exe renamed because original name is a hash value
Original sample name:	5710e8153d3061cb80c0a4c8d1d59fec.exe
Analysis ID:	1483442
MD5:	5710e8153d3061cb80c0a4c8d1d59fec
SHA1:	1aaa05a14f5643d5e4b7db83fe0c305ebde11808
SHA256:	dd4f243c9479d1de2347886a12ef03febcfc4a1ce97af2b604736b68d5e62105
Tags:	exeRedLineStealer
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected RedLine Stealer

.NET source code contains potential unpacker

.NET source code contains very large array initializations

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

qg155Ew08h.exe (PID: 2568 cmdline: "C:\Users\user\Desktop\qg155Ew08h.exe" MD5: 5710E8153D3061CB80C0A4C8D1D59FEC)

conhost.exe (PID: 6484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MSBuild.exe (PID: 6664 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": "5.42.92.213:46419", "Bot Id": "665841", "Authorization Header": "b8fe8b26d0b2238ec32b881cbf7ba27f"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1661491659.000000006CFA9000.00000004.00000001.01000000.00000007.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.1793001097.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.1795321792.0000000002F73000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: qg155Ew08h.exe PID: 2568	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: qg155Ew08h.exe PID: 2568	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 6664	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 6664	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.qg155Ew08h.exe.6cfa9000.4.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2.2.MSBuild.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.qg155Ew08h.exe.6cfa9000.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.qg155Ew08h.exe.6cf80000.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Suricata Signatures

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T14:37:08.405171+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T14:37:09.623236+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 13.85.23.86 - Destination IP: 192.168.2.4

Timestamp:	2024-07-27T14:37:15.714266+0200
SID:	2022930
Source Port:	443
Destination Port:	49731
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T14:37:03.491370+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T14:36:57.816554+0200
SID:	2046045
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T14:37:06.418276+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T14:37:09.145538+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T14:37:05.530839+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T14:37:08.931062+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T14:37:06.155029+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T14:37:06.883843+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T14:37:05.739318+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T14:37:07.423761+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T14:37:09.355776+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T14:37:04.988499+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T14:37:08.622887+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) - Source IP: 5.42.92.213 - Destination IP: 192.168.2.4

Timestamp:	2024-07-27T14:37:03.496914+0200
SID:	2046056
Source Port:	46419
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T14:37:04.570201+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T14:37:07.418457+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T14:37:06.669520+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T14:37:04.779491+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T14:37:04.153821+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T14:37:05.321083+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T14:37:03.072073+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T14:37:05.947381+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.92.213

Timestamp:	2024-07-27T14:37:07.092288+0200
SID:	2043231
Source Port:	49730
Destination Port:	46419
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 5.42.92.213 - Destination IP: 192.168.2.4

Timestamp:	2024-07-27T14:36:58.028717+0200
SID:	2043234
Source Port:	46419
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: qg155Ew08h.exe

Avira: detected

Found malware configuration

Source: 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": "5.42.92.213:46419", "Bot Id": "665841", "Authorization Header": "b8fe8b26d0b2238ec32b881cbf7ba27f"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\d3d9.dll	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Roaming\d3d9.dll	Virustotal: Detection: 48%			Perma Link

Multi AV Scanner detection for submitted file

Source: qg155Ew08h.exe	ReversingLabs: Detection: 87%
Source: qg155Ew08h.exe	Virustotal: Detection: 47%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\d3d9.dll

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: qg155Ew08h.exe

Joe Sandbox ML: detected

Source: qg155Ew08h.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: qg155Ew08h.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 5.42.92.213:46419

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 5.42.92.213:46419

Source: Joe Sandbox View

ASN Name: RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU

Source: global traffic

TCP traffic: 192.168.2.4:49675 -> 173.222.162.32:443

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.213

Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1795321792.0000000002EA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1795321792.0000000002EA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002EA6000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1795321792.0000000002EF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1795321792.0000000002F73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002F73000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002F73000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002EA6000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15V
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002F73000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002F73000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002F73000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1795321792.0000000002EF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1795321792.0000000002EF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002DCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1795321792.0000000002DCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: MSBuild.exe, 00000002.00000002.1795321792.00000000030FD000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1795321792.0000000002DCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002DCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: MSBuild.exe, 00000002.00000002.1797689236.0000000003FE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: qg155Ew08h.exe, qg155Ew08h.exe, 00000000.00000002.1661491659.000000006CFA9000.00000004.00000001.01000000.00000007.sdmp, MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1793001097.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: MSBuild.exe, 00000002.00000002.1797689236.0000000003FE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: MSBuild.exe, 00000002.00000002.1797689236.0000000003FE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: MSBuild.exe, 00000002.00000002.1797689236.0000000003FE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: MSBuild.exe, 00000002.00000002.1797689236.0000000003FE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: MSBuild.exe, 00000002.00000002.1797689236.0000000003FE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabS
Source: MSBuild.exe, 00000002.00000002.1797689236.0000000003FE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: MSBuild.exe, 00000002.00000002.1797689236.0000000003FE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: MSBuild.exe, 00000002.00000002.1797689236.0000000003FE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown

Network traffic detected: HTTP traffic on port 49675 -> 443

System Summary

.NET source code contains very large array initializations

Source: qg155Ew08h.exe, -Module-.cs

Large array initialization: _202A_200F_202B_200F_206D_202E_200E_206E_200C_206D_206F_202D_200C_200F_202E_202D_206B_202B_202C_200E_200C_202B_206F_202A_202A_202D_206D_206C_202E_206C_202D_200E_200F_206D_200B_206B_206C_202A_200D_202B_202E: array initializer size 51696

Source: C:\Users\user\Desktop\qg155Ew08h.exe

Code function: 0_2_6CF87D10 GetModuleHandleW,GetProcAddress,NtQueryInformationProcess,

0_2_6CF87D10

Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_6CF812E0	0_2_6CF812E0
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_6CF88290	0_2_6CF88290
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_6CF88020	0_2_6CF88020
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_6CF81000	0_2_6CF81000
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_6CFA0B65	0_2_6CFA0B65
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_6CF94F10	0_2_6CF94F10
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_6CFAEB17	0_2_6CFAEB17
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_00FD23B8	0_2_00FD23B8
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_00FD0FF8	0_2_00FD0FF8
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_00FD09FA	0_2_00FD09FA
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_00FD095C	0_2_00FD095C
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_00FD3ADA	0_2_00FD3ADA
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_00FD22D1	0_2_00FD22D1
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_00FD0A7D	0_2_00FD0A7D
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_00FD0A41	0_2_00FD0A41
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_00FD0BFA	0_2_00FD0BFA
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_00FD0BAD	0_2_00FD0BAD
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_00FD0B77	0_2_00FD0B77
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_00FD3B4F	0_2_00FD3B4F
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_00FD0B13	0_2_00FD0B13
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_00FD0C79	0_2_00FD0C79
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_00FD2C68	0_2_00FD2C68
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_00FD2C59	0_2_00FD2C59
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_00FD0DC2	0_2_00FD0DC2
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_00FD0D6E	0_2_00FD0D6E
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_00FD0EDC	0_2_00FD0EDC
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_00FD0E98	0_2_00FD0E98
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_00FD0E49	0_2_00FD0E49
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_00FD0E02	0_2_00FD0E02
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_00FD3778	0_2_00FD3778
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_00FD3769	0_2_00FD3769
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_00FD0F26	0_2_00FD0F26
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_00FD0F1B	0_2_00FD0F1B
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_0A832F70	0_2_0A832F70
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_0A8336F0	0_2_0A8336F0
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_0A832770	0_2_0A832770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00ECDC74	2_2_00ECDC74

Source: C:\Users\user\Desktop\qg155Ew08h.exe

Code function: String function: 6CF960F0 appears 33 times

Source: qg155Ew08h.exe, 00000000.00000002.1656301681.0000000000D1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs qg155Ew08h.exe
Source: qg155Ew08h.exe, 00000000.00000002.1661491659.000000006CFEA000.00000004.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameCarnify.exe8 vs qg155Ew08h.exe
Source: qg155Ew08h.exe, 00000000.00000000.1650878257.00000000006E2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameVictor291Lily.txtL vs qg155Ew08h.exe
Source: qg155Ew08h.exe	Binary or memory string: OriginalFilenameVictor291Lily.txtL vs qg155Ew08h.exe

Source: qg155Ew08h.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/3@0/1

Source: C:\Users\user\Desktop\qg155Ew08h.exe

File created: C:\Users\user\AppData\Roaming\d3d9.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6484:120:WilError_03

Source: qg155Ew08h.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: qg155Ew08h.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Users\user\Desktop\qg155Ew08h.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: qg155Ew08h.exe	ReversingLabs: Detection: 87%
Source: qg155Ew08h.exe	Virustotal: Detection: 47%

Source: unknown	Process created: C:\Users\user\Desktop\qg155Ew08h.exe "C:\Users\user\Desktop\qg155Ew08h.exe"
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\qg155Ew08h.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\qg155Ew08h.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: qg155Ew08h.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: qg155Ew08h.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: qg155Ew08h.exe, -Module-.cs

.Net Code: _206B_200D_200C_206D_200E_200F_206A_200E_206B_200B_202E_200B_202D_206E_206B_206F_206F_206B_206A_206C_202C_206F_206D_206F_206B_202D_206A_206F_202A_206F_206B_206A_206F_200D_202C_200C_206E_206F_206A_200C_202E System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_6CFA1294 push ecx; ret	0_2_6CFA12A7
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_6CFA9180 pushfd ; iretd	0_2_6CFA9181
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_6CFAEB17 push es; retf	0_2_6CFAEB12
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_00FD3671 push edx; iretd	0_2_00FD3679
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_0A821DE4 push 1CF44569h; iretd	0_2_0A821DE9
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_0A82055D push ss; retf	0_2_0A820567
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00EC46E7 push ebx; ret	2_2_00EC46EA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00EC46E1 push ebx; ret	2_2_00EC46E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00EC46E3 push edx; ret	2_2_00EC46E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00EC465F push edx; ret	2_2_00EC4662
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00EC4658 push edx; ret	2_2_00EC465A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00EC47D7 push esi; ret	2_2_00EC47DA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00ECAD01 pushfd ; ret	2_2_00ECAD02
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00ECAD03 pushfd ; ret	2_2_00ECAD0A

Source: C:\Users\user\Desktop\qg155Ew08h.exe

File created: C:\Users\user\AppData\Roaming\d3d9.dll

Jump to dropped file

Source: C:\Users\user\Desktop\qg155Ew08h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: qg155Ew08h.exe PID: 2568, type: MEMORYSTR

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\qg155Ew08h.exe	Memory allocated: FD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Memory allocated: 2AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Memory allocated: 1100000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Memory allocated: 50A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Memory allocated: 60A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Memory allocated: 61D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Memory allocated: 71D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Memory allocated: 76A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Memory allocated: 86A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Memory allocated: 96A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: EA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2C80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 1210000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\qg155Ew08h.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 2394			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 7010			Jump to behavior

Source: C:\Users\user\Desktop\qg155Ew08h.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\d3d9.dll

Jump to dropped file

Source: C:\Users\user\Desktop\qg155Ew08h.exe TID: 6648	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7000	Thread sleep time: -31359464925306218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6688	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\qg155Ew08h.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: qg155Ew08h.exe	Binary or memory string: CttJFgANByUSUqqNlTacvGfhgfSLmkzdzLZqzQPIOtgNTPxOYzGB.dll
Source: qg155Ew08h.exe	Binary or memory string: CttJFgANByUSUqqNlTacvGfhgfS
Source: MSBuild.exe, 00000002.00000002.1793881514.0000000000F68000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\qg155Ew08h.exe

Code function: 0_2_6CF95F7A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CF95F7A

Source: C:\Users\user\Desktop\qg155Ew08h.exe

Code function: 0_2_6CF9BCEB GetProcessHeap,

0_2_6CF9BCEB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_6CF95AA1 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6CF95AA1
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_6CF95F7A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CF95F7A
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Code function: 0_2_6CF99F17 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CF99F17

Source: C:\Users\user\Desktop\qg155Ew08h.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\qg155Ew08h.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\qg155Ew08h.exe

Code function: 0_2_6CF88290 HuaweiShare,GetConsoleWindow,ShowWindow,CreateProcessW,VirtualAlloc,Wow64GetThreadContext,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,ReadProcessMemory,WriteProcessMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,CloseHandle,CloseHandle,CreateProcessW,VirtualAllocEx,WriteProcessMemory,CloseHandle,CloseHandle,

0_2_6CF88290

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\qg155Ew08h.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\qg155Ew08h.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 430000	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44E000	Jump to behavior
Source: C:\Users\user\Desktop\qg155Ew08h.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: B01008	Jump to behavior

Source: C:\Users\user\Desktop\qg155Ew08h.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

Jump to behavior

Source: C:\Users\user\Desktop\qg155Ew08h.exe

Code function: 0_2_6CF96138 cpuid

0_2_6CF96138

Source: C:\Users\user\Desktop\qg155Ew08h.exe	Queries volume information: C:\Users\user\Desktop\qg155Ew08h.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\qg155Ew08h.exe

Code function: 0_2_6CF95BC3 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6CF95BC3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: MSBuild.exe, 00000002.00000002.1802744090.000000000569F000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.qg155Ew08h.exe.6cfa9000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.qg155Ew08h.exe.6cfa9000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.qg155Ew08h.exe.6cf80000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1661491659.000000006CFA9000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1793001097.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: qg155Ew08h.exe PID: 2568, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6664, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002F73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\walletsLR^q
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002F73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $^q1C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002F73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $^q-cjelfplplebdjjenllpjcblmjkfcffne\|JaxxxLiberty
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002F73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.walletLR^q,
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002F73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLR^q
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002F73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.walletLR^q,
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002F73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $^q%appdata%`,^qdC:\Users\user\AppData\Roaming`,^qdC:\Users\user\AppData\Roaming\Binance
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002F73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLR^q
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002F73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $^q&%localappdata%\Coinomi\Coinomi\walletsLR^q\
Source: MSBuild.exe, 00000002.00000002.1795321792.0000000002F73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $^q5C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1795321792.0000000002F73000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6664, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.qg155Ew08h.exe.6cfa9000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.qg155Ew08h.exe.6cfa9000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.qg155Ew08h.exe.6cf80000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1661491659.000000006CFA9000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1793001097.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: qg155Ew08h.exe PID: 2568, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6664, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	411 Process Injection	1 Masquerading	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	351 Security Software Discovery	Remote Desktop Protocol	3 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	411 Process Injection	NTDS	241 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	124 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
qg155Ew08h.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.RedLine
qg155Ew08h.exe	47%	Virustotal		Browse
qg155Ew08h.exe	100%	Avira	HEUR/AGEN.1311038
qg155Ew08h.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\d3d9.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\d3d9.dll	75%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Roaming\d3d9.dll	49%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
bg.microsoft.map.fastly.net	0%	Virustotal		Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	0%	URL Reputation	safe
http://tempuri.org/Entity/Id14ResponseD	0%	URL Reputation	safe
http://tempuri.org/Entity/Id14ResponseD	0%	URL Reputation	safe
http://tempuri.org/Entity/Id23ResponseD	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	0%	URL Reputation	safe
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6ResponseD	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	0%	URL Reputation	safe
http://tempuri.org/Entity/Id4	0%	URL Reputation	safe
http://tempuri.org/Entity/Id7	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19Response	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	0%	URL Reputation	safe
http://tempuri.org/Entity/Id13ResponseD	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5ResponseD	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/sc	0%	URL Reputation	safe
http://tempuri.org/Entity/Id1ResponseD	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id20	0%	URL Reputation	safe
http://tempuri.org/Entity/Id20	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21	0%	URL Reputation	safe
http://tempuri.org/Entity/Id22	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	0%	URL Reputation	safe
http://tempuri.org/Entity/Id23	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24Response	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id1Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21ResponseD	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21ResponseD	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10	0%	URL Reputation	safe
http://tempuri.org/Entity/Id11	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15V	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10ResponseD	0%	URL Reputation	safe
http://tempuri.org/Entity/Id12	0%	URL Reputation	safe
http://tempuri.org/Entity/Id16Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id16Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	0%	URL Reputation	safe
http://tempuri.org/Entity/Id13	0%	URL Reputation	safe
http://tempuri.org/Entity/Id14	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15	0%	URL Reputation	safe
http://tempuri.org/Entity/Id16	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	0%	URL Reputation	safe
http://tempuri.org/Entity/Id17	0%	URL Reputation	safe
http://tempuri.org/Entity/Id18	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5Response	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	0%, Virustotal, Browse	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	MSBuild.exe, 00000002.00000002.1797689236.0000000003FE6000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14ResponseD	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	MSBuild.exe, 00000002.00000002.1795321792.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id12Response	MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/	MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15V	MSBuild.exe, 00000002.00000002.1795321792.0000000002EA6000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21Response	MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id9	MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8	MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6ResponseD	MSBuild.exe, 00000002.00000002.1795321792.00000000030FD000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5	MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id4	MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id7	MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6	MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id19Response	MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id13ResponseD	MSBuild.exe, 00000002.00000002.1795321792.0000000002F73000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15Response	MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5ResponseD	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6Response	MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ip.sb/ip	qg155Ew08h.exe, qg155Ew08h.exe, 00000000.00000002.1661491659.000000006CFA9000.00000004.00000001.01000000.00000007.sdmp, MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1793001097.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1ResponseD	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://tempuri.org/Entity/Id9Response	MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1795321792.0000000002DCA000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	MSBuild.exe, 00000002.00000002.1797689236.0000000003FE6000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id20	MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21	MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id22	MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://tempuri.org/Entity/Id23	MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1795321792.0000000002DCA000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://tempuri.org/Entity/Id24	MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id24Response	MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	MSBuild.exe, 00000002.00000002.1797689236.0000000003FE6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1Response	MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21ResponseD	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1795321792.0000000002EF0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id10	MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id11	MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1795321792.0000000002EA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id10ResponseD	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id12	MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id16Response	MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id13	MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1795321792.0000000002F73000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id14	MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15	MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id16	MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id17	MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id18	MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5Response	MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id19	MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15ResponseD	MSBuild.exe, 00000002.00000002.1795321792.0000000002F73000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://tempuri.org/Entity/Id10Response	MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1795321792.0000000002EA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id11ResponseD	MSBuild.exe, 00000002.00000002.1795321792.0000000002EA6000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8Response	MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id17ResponseD	MSBuild.exe, 00000002.00000002.1795321792.0000000002F73000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	MSBuild.exe, 00000002.00000002.1795321792.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8ResponseD	MSBuild.exe, 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
5.42.92.213	unknown	Russian Federation		39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1483442
Start date and time:	2024-07-27 14:36:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	qg155Ew08h.exe renamed because original name is a hash value
Original Sample Name:	5710e8153d3061cb80c0a4c8d1d59fec.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/3@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 94% Number of executed functions: 67 Number of non-executed functions: 30
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.85.23.86, 2.19.126.137, 2.19.126.163, 199.232.214.172, 192.229.221.95
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ocsp.edge.digicert.com, sls.update.microsoft.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, download.windowsupdate.com.edgesuite.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:37:03	API Interceptor	48x Sleep call for process: MSBuild.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
5.42.92.213	nuCc19sDOl.exe	Get hash	malicious	RedLine	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fp2e7a.wpc.phicdn.net	https://www.canva.com/design/DAGMDp-pdRs/DFmIVehjt-ABqDbwZmCQ6Q/view?utm_content=DAGMDp-pdRs&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
	nuCc19sDOl.exe	Get hash	malicious	RedLine	Browse	192.229.221.95
	d34e1p5zD2.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	Mu7iyblZk8.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	R86BRY7DdC.exe	Get hash	malicious	Snake Keylogger	Browse	192.229.221.95
	d34e1p5zD2.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	41DLTjkmOm.exe	Get hash	malicious	Remcos	Browse	192.229.221.95
	Ycj3d5NMhc.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	QUOTATION_JULQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	192.229.221.95
	https://azadengg.com/MTQwOTk4NzcwMg==sfmaxWjJWdUxYQm5lQzA0TXpVMU1EZ3dNMmxtZUdOb1lYWmxlbkpwYzNoaGFYSmliM0p1TG1OdmJRPT0=&c=E,1,LZxP3HHb1f9qSYvI9qirqXkUUBAc_Lly3K7xLwNdfYOBECyaKUoAd-t3gcHqWT79cExKeBU56i8wGFRIGcXn5xtHq6aoS1GJuvxV76lYjLuWHw,,&typo=1	Get hash	malicious	Unknown	Browse	192.229.221.95
bg.microsoft.map.fastly.net	createdthingstobefrankwithmeeverywhere.gIF.vbs	Get hash	malicious	GuLoader, Remcos	Browse	199.232.214.172
	https://www.canva.com/design/DAGMDp-pdRs/DFmIVehjt-ABqDbwZmCQ6Q/view?utm_content=DAGMDp-pdRs&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	nuCc19sDOl.exe	Get hash	malicious	RedLine	Browse	199.232.214.172
	d34e1p5zD2.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	QIKiV83Pkl.exe	Get hash	malicious	DCRat	Browse	199.232.214.172
	41DLTjkmOm.exe	Get hash	malicious	Remcos	Browse	199.232.210.172
	Ycj3d5NMhc.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	oz9Blof9tN.msi	Get hash	malicious	CobaltStrike	Browse	199.232.214.172
	QUOTATION_JULQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	199.232.210.172
	invoker.ps1	Get hash	malicious	Unknown	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	nuCc19sDOl.exe	Get hash	malicious	RedLine	Browse	5.42.92.213
	LisectAVT_2403002A_199.exe	Get hash	malicious	RedLine	Browse	5.42.65.68
	LisectAVT_2403002A_240.exe	Get hash	malicious	RisePro Stealer	Browse	5.42.65.117
	LisectAVT_2403002A_240.exe	Get hash	malicious	RisePro Stealer	Browse	5.42.65.117
	LisectAVT_2403002A_422.exe	Get hash	malicious	RedLine	Browse	5.42.65.68
	LisectAVT_2403002B_301.exe	Get hash	malicious	Bdaejec, GCleaner	Browse	5.42.65.115
	LisectAVT_2403002B_98.exe	Get hash	malicious	Bdaejec, GCleaner, Nymaim	Browse	5.42.64.3
	LisectAVT_2403002C_44.exe	Get hash	malicious	EICAR	Browse	5.42.96.78
	LisectAVT_2403002C_45.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	5.42.65.68
	LisectAVT_2403002A_479.exe	Get hash	malicious	RisePro Stealer	Browse	5.42.65.117

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3094
Entropy (8bit):	5.33145931749415
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymTqdqlq7qqjqc85VD:Pq5qHwCYqh3qtI6eqzxP0atTqdqlq7qV
MD5:	2A56468A7C0F324A42EA599BF0511FAF
SHA1:	404B343A86EDEDF5B908D7359EB8AA957D1D4333
SHA-256:	6398E0BD46082BBC30008BC72A2BA092E0A1269052153D343AA40F935C59957C
SHA-512:	19B79181C40AA51C7ECEFCD4C9ED42D5BA19EA493AE99654D3A763EA9B21B1ABE5B5739AAC425E461609E1165BCEA749CFB997DE0D35303B4CF2A29BDEF30B17
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\qg155Ew08h.exe.log

Download File

Process:	C:\Users\user\Desktop\qg155Ew08h.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Roaming\d3d9.dll

Download File

Process:	C:\Users\user\Desktop\qg155Ew08h.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	474112
Entropy (8bit):	6.069611518899029
Encrypted:	false
SSDEEP:	6144:3aQMm5qN8yhCXbEqzkjM5CgCcfAht4njAHnISLnl2M9V4AdFDDB:IOqN8yhWTQjMsgmkAHfnlzV9/
MD5:	AEC340845CE4278D9E3C51D0FB781ABF
SHA1:	FF2D1D46C5BA5DFE298A7ECD2FEABBA916D1D8B5
SHA-256:	0AFF3F6B9F45E1A30E948B8E2CC22F77C965ECD9B41D1E76C8545384FC690FFC
SHA-512:	15C9FC7DE8B3C0A7E92636C43CDA1C98417289369B15F544A02A1D4AB8EA252C0E48F40D1BC2EFCBABC954A0B7D34E49D2F912D916BC831C02E41B15A5B2D5DE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75% Antivirus: Virustotal, Detection: 49%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C.)...GQ..GQ..GQL.DP..GQL.BP..GQL.CP..GQL.FP..GQ z<Q..GQ..FQe.GQ.=BP..GQ.=CP..GQ.=DP..GQ..GQ..GQj=GP..GQj=EP..GQRich..GQ........................PE..L...\X.f...........!...&.....<......~Z....... ...............................p............@.........................@...T.......<............................P......`u...............................t..@............ ..P............................text............................... ..`.rdata..2h... ...j..................@..@.data...\............t..............@....reloc.......P......."..............@..B................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.73523840649229
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	qg155Ew08h.exe
File size:	630'272 bytes
MD5:	5710e8153d3061cb80c0a4c8d1d59fec
SHA1:	1aaa05a14f5643d5e4b7db83fe0c305ebde11808
SHA256:	dd4f243c9479d1de2347886a12ef03febcfc4a1ce97af2b604736b68d5e62105
SHA512:	6beb60cfe1adf6a2d9edb184709dcee04792c8f04c239006ec6bcb4e0749541efbc15ee73b590ac95e83a0e310594e463780f09f4b85aed00bd85c33c45f4a21
SSDEEP:	12288:JdHXZpAPZdx9+ysrGGbH8X1gajA9m+QHPto5sFTL3mXXiWthWAqThdbxKVTJz2rE:JdiZdPshclgaoWe
TLSH:	37D44EDC725072DFC85BC972CAA81C68EA5034BB871F920790671AEDDA5E897CF150F2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...\X.f................................. ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x49b0be
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x669F585C [Tue Jul 23 07:14:36 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9b068	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x9c000	0x698	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x9e000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x990c4	0x99200	1ca3df67483eb4066c3042b8acedcee2	False	0.614781568877551	data	6.74124225730025	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x9c000	0x698	0x800	7a1246d556db33ea51ead1ea8fb6de7f	False	0.3603515625	data	3.6420339846373286	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x9e000	0xc	0x200	579f5b1b53a23c254e9d951090fc04d0	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x9c0a0	0x40c	data			0.4140926640926641
RT_MANIFEST	0x9c4ac	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-27T14:37:08.405171+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T14:37:09.623236+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T14:37:15.714266+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49731	13.85.23.86	192.168.2.4
2024-07-27T14:37:03.491370+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T14:36:57.816554+0200	TCP	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T14:37:06.418276+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T14:37:09.145538+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T14:37:05.530839+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T14:37:08.931062+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T14:37:06.155029+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T14:37:06.883843+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T14:37:05.739318+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T14:37:07.423761+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T14:37:09.355776+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T14:37:04.988499+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T14:37:08.622887+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T14:37:03.496914+0200	TCP	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	46419	49730	5.42.92.213	192.168.2.4
2024-07-27T14:37:04.570201+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T14:37:07.418457+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T14:37:06.669520+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T14:37:04.779491+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T14:37:04.153821+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T14:37:05.321083+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T14:37:03.072073+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T14:37:05.947381+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T14:37:07.092288+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	46419	192.168.2.4	5.42.92.213
2024-07-27T14:36:58.028717+0200	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	46419	49730	5.42.92.213	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 27, 2024 14:36:51.943906069 CEST	49675	443	192.168.2.4	173.222.162.32
Jul 27, 2024 14:36:56.895421028 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:36:57.098421097 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:36:57.098951101 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:36:57.105771065 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:36:57.110738993 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:36:57.788666964 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:36:57.816554070 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:36:57.827356100 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:36:58.028717041 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:36:58.084605932 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:01.553472042 CEST	49675	443	192.168.2.4	173.222.162.32
Jul 27, 2024 14:37:03.072072983 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:03.077723980 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:03.281053066 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:03.281214952 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:03.281253099 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:03.281289101 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:03.281322956 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:03.281389952 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:03.281389952 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:03.338109016 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:03.491369963 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:03.496913910 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:03.697499037 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:03.740770102 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:04.153820992 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:04.158984900 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:04.159020901 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:04.159048080 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:04.480684996 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:04.522011042 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:04.570200920 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:04.575589895 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:04.776016951 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:04.779490948 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:04.784364939 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:04.986323118 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:04.988498926 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:04.994107008 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:05.194974899 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:05.240745068 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:05.321083069 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:05.326031923 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:05.526807070 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:05.530838966 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:05.535849094 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:05.737200022 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:05.739317894 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:05.744462967 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:05.944849968 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:05.947381020 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:05.953104019 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:06.153847933 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:06.155029058 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:06.159904957 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:06.361253023 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:06.412745953 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:06.418276072 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:06.423450947 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:06.623680115 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:06.669519901 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:06.674717903 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:06.875199080 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:06.883842945 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:06.888782978 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.089911938 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.092288017 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.098037958 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.298834085 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.350333929 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.418457031 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.423659086 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.423679113 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.423691034 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.423702002 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.423736095 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.423748970 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.423759937 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.423760891 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.423772097 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.423784018 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.423823118 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.423852921 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.423882961 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.423933029 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.423986912 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.428386927 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.428399086 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.428411007 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.428421974 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.428435087 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.428447008 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.428466082 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.428551912 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.428775072 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.428807020 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.428854942 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.428880930 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.428905964 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.428936005 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.428961992 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.429224014 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.433022022 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.433166981 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.433274984 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.433403969 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.433474064 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.433537006 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.433789015 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.433860064 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.433897972 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.433944941 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.434037924 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.434078932 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.434140921 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.434175968 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.434205055 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.434396982 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.434428930 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.434478998 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.434505939 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.434533119 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.434580088 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.434606075 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.434637070 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.434663057 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.434725046 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.434752941 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.434779882 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.434848070 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.434937954 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.434964895 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.435019970 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.435036898 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.435081005 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.435096025 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.435127020 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.435148001 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.435178041 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.435205936 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.435240030 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.435264111 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.435292006 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.435348034 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.435364962 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.435399055 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.435425043 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.435458899 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.435483932 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.435523987 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.437833071 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.437860012 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.437891960 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.437912941 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.437944889 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.437969923 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.437999010 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.438046932 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.438080072 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.438112974 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.438162088 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.438188076 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.438571930 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.438604116 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.438649893 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.438745022 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.438785076 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.438812017 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.438841105 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.438919067 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.438945055 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.438971043 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.439016104 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.439043045 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.439069033 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.439116001 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.439152956 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.439167023 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.439234018 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.439311981 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.439359903 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.439385891 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.439416885 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.439446926 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.439471960 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.439589977 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.439616919 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.439641953 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.440409899 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.440531969 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.440563917 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.440613031 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.440643072 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.440669060 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.440715075 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.440826893 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.440946102 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.440984011 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.441010952 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.441039085 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.441065073 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.441092968 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.441118956 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.441143990 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.441190004 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.441217899 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.441245079 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.441271067 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.441319942 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.441344976 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.441370964 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.441395998 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.441421032 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.441468000 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.441493988 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.441523075 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.441529989 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.441576004 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.441603899 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.441628933 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.441679955 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.441705942 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.441731930 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.441761971 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.441807985 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.442445993 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.442528963 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.442647934 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.442675114 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.442701101 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.442748070 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.442774057 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.442811966 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.442842007 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.442867994 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.442914009 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.443295002 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.443412066 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.443425894 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.443439007 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.443512917 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.443543911 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.443569899 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.443613052 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.443799019 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.444113970 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.444221973 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.446705103 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.446731091 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.446760893 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.446787119 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.446832895 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.446858883 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.446885109 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.446933031 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.446959972 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.446985960 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.447024107 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.447050095 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.447096109 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.447122097 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.447146893 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.447171926 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.447207928 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.447228909 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.447232008 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.447258949 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.447285891 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.447310925 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.447338104 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.447364092 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.447388887 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.447446108 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.447473049 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.447499037 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.447525024 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.447551012 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.447575092 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.447601080 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.447647095 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.447673082 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.447698116 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.447722912 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.447748899 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.447787046 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.447813034 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.447838068 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.447863102 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.447887897 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.447912931 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.447958946 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.448007107 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.448031902 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.448056936 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.448082924 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.448107958 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.448133945 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.448158979 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.448189020 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.448214054 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.449038982 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.449088097 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.449110031 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.449126959 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.449203014 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.449217081 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.449229956 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.449242115 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.449332952 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.449403048 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.449446917 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.449460030 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.449462891 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.449476004 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.449487925 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.449522018 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.449543953 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.449558020 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.449604034 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.449631929 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.449645042 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.449661016 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.449671030 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.449685097 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.449740887 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.449752092 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.449757099 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.449784040 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.449795008 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.449826002 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.449918032 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.449929953 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.449951887 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.449965000 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.449975014 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.449994087 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.450059891 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.450073004 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.450084925 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.450221062 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.450232983 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.450244904 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.450294971 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.450310946 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.450321913 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.450335026 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.450345993 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.450484037 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.450495005 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.450704098 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.451452017 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.451463938 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.451502085 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.451514006 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.451560020 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.454287052 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.454353094 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.454387903 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.454428911 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.454448938 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.454459906 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.454611063 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.454680920 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.454710960 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.454724073 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.454735041 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.454755068 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.454766035 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.454777956 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.454807997 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.454818964 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.454843044 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.454926014 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.454946995 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.454957962 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.454971075 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.455040932 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.455051899 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.455065012 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.455084085 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.455096006 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.455106974 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.455121040 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.455132961 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.455153942 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.455250978 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.455262899 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.455274105 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.455288887 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.455301046 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.455312014 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.455334902 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.455349922 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.455362082 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.455375910 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.455388069 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.455399990 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.455411911 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.455425024 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.455436945 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.455456018 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.455467939 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.455478907 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.455492020 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.455502987 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.455528021 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.455579996 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.455593109 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.455602884 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.455624104 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.459892988 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.459904909 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.459916115 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.459938049 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.459949017 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.459959984 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.459970951 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.459981918 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.459992886 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460002899 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460014105 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460025072 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460046053 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460057020 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460067987 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460078955 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460150003 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.460206985 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.460228920 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460242987 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460257053 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460269928 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460283041 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460294962 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460306883 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460309982 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460311890 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460313082 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460324049 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460381031 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460393906 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460405111 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460432053 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460443974 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460457087 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460468054 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460536957 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460550070 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460583925 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460596085 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460622072 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460633993 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460686922 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460735083 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460746050 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460756063 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460768938 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460778952 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460808992 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460827112 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460865021 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460875988 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460887909 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460931063 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.460942984 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.465133905 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.465156078 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.465167046 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.465233088 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.465245008 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.465255976 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.465333939 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.465348005 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.465359926 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.465372086 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.465446949 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.465502977 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.465533018 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.465543985 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.465554953 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.465565920 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.465576887 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.465588093 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.465598106 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.465620041 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.465631962 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.465642929 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.465655088 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.465769053 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.465781927 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.465791941 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.465811968 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.465822935 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.490767002 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.495734930 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.497941971 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.498081923 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.498081923 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.498167992 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:07.503078938 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.503139973 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.503154039 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.503165007 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.503185987 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.503215075 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.503227949 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.503345013 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.503356934 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.503449917 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.503506899 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.503521919 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.503616095 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.503628016 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.503639936 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:07.518393040 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:08.398471117 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:08.405170918 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:08.410981894 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:08.411020994 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:08.411031961 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:08.411048889 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:08.411128044 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:08.411155939 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:08.616213083 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:08.622886896 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:08.628262997 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:08.829960108 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:08.897296906 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:08.931061983 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:08.936616898 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:08.936650991 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:08.936677933 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:08.936708927 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:08.936734915 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:08.936759949 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:08.936789036 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:08.936814070 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:08.937439919 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:08.941538095 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:08.941566944 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:08.941592932 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:09.142929077 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:09.145538092 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:09.153157949 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:09.354123116 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:09.355776072 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:09.361238003 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:09.562417984 CEST	46419	49730	5.42.92.213	192.168.2.4
Jul 27, 2024 14:37:09.615905046 CEST	49730	46419	192.168.2.4	5.42.92.213
Jul 27, 2024 14:37:09.623235941 CEST	49730	46419	192.168.2.4	5.42.92.213

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 27, 2024 14:37:15.738496065 CEST	1.1.1.1	192.168.2.4	0x1915	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jul 27, 2024 14:37:15.738496065 CEST	1.1.1.1	192.168.2.4	0x1915	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jul 27, 2024 14:37:16.912096977 CEST	1.1.1.1	192.168.2.4	0xd0c6	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 14:37:16.912096977 CEST	1.1.1.1	192.168.2.4	0xd0c6	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	08:36:54
Start date:	27/07/2024
Path:	C:\Users\user\Desktop\qg155Ew08h.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\qg155Ew08h.exe"
Imagebase:	0x6e0000
File size:	630'272 bytes
MD5 hash:	5710E8153D3061CB80C0A4C8D1D59FEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1661491659.000000006CFA9000.00000004.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:36:54
Start date:	27/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:36:55
Start date:	27/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x840000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.1793001097.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.1795321792.0000000002D14000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.1795321792.0000000002F73000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	21.7%
Dynamic/Decrypted Code Coverage:	2.4%
Signature Coverage:	13.8%
Total number of Nodes:	624
Total number of Limit Nodes:	12

Executed Functions

Function 6CF88290 Relevance: 123.9, APIs: 21, Strings: 43, Instructions: 11893memoryinjectionthreadCOMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNELBASE ref: 6CF8F3C0
ShowWindow.USER32 ref: 6CF8F3D6
VirtualAlloc.KERNELBASE ref: 6CF92CB8
Wow64GetThreadContext.KERNEL32 ref: 6CF92D0A
VirtualAllocEx.KERNELBASE ref: 6CF92EFA
VirtualAllocEx.KERNEL32 ref: 6CF930E5
WriteProcessMemory.KERNELBASE ref: 6CF93143
ReadProcessMemory.KERNEL32 ref: 6CF93AFA
WriteProcessMemory.KERNEL32 ref: 6CF93BDD
WriteProcessMemory.KERNELBASE ref: 6CF93EE2
Wow64SetThreadContext.KERNEL32 ref: 6CF93F32
ResumeThread.KERNELBASE ref: 6CF93F5C
CloseHandle.KERNEL32 ref: 6CF9400D
CloseHandle.KERNEL32 ref: 6CF94021
CreateProcessW.KERNEL32 ref: 6CF94C93
VirtualAllocEx.KERNEL32 ref: 6CF94D2A
WriteProcessMemory.KERNEL32 ref: 6CF94E68
CloseHandle.KERNEL32 ref: 6CF94EC5
CloseHandle.KERNEL32 ref: 6CF94ED9

Strings

-:YG, xrefs: 6CF8F4D0
.U?V, xrefs: 6CF9413A
}0%M, xrefs: 6CF9390C
`mLP, xrefs: 6CF882B0
v@ud, xrefs: 6CF8DE9E
1Z$N, xrefs: 6CF8C280
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe, xrefs: 6CF92A75
]V>B, xrefs: 6CF8D42F
qq&9, xrefs: 6CF9228F
*WiN, xrefs: 6CF8F17C
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 6CF92A44
q=/z, xrefs: 6CF8F215
rLRU, xrefs: 6CF91B86
rLRU, xrefs: 6CF91B35
g},s, xrefs: 6CF8F734
.U?V, xrefs: 6CF940E9
@, xrefs: 6CF94D22
/:W, xrefs: 6CF90882
Ud{[, xrefs: 6CF8F114
n`, xrefs: 6CF93A4E
kernel32.dll, xrefs: 6CF8F3DC
xvBq, xrefs: 6CF92589
]p1;, xrefs: 6CF914C4
2uu9, xrefs: 6CF8D77F
xvBq, xrefs: 6CF92513
q=/z, xrefs: 6CF8F29D
`C, xrefs: 6CF92626
Lbjy, xrefs: 6CF8E864
Lr, xrefs: 6CF8DC7B
Yr`g, xrefs: 6CF8F856
E@,4, xrefs: 6CF917DD
ntdll.dll, xrefs: 6CF8F3F0
Ud{[, xrefs: 6CF8F177
sEu, xrefs: 6CF92D17
dLUn, xrefs: 6CF938D7
|rE, xrefs: 6CF8FECF
Lr, xrefs: 6CF8DD01
v@ud, xrefs: 6CF8DE35
n`, xrefs: 6CF939D1
|e5h, xrefs: 6CF8DA19
xW, xrefs: 6CF93FEC
'qy, xrefs: 6CF937D1
D, xrefs: 6CF94C03

Memory Dump Source

Source File: 00000000.00000002.1661154336.000000006CF81000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF80000, based on PE: true

Associated: 00000000.00000002.1661117584.000000006CF80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661418137.000000006CFA2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFEA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661708764.000000006CFF5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf80000_qg155Ew08h.jbxd

Yara matches

Similarity

API ID: Process$Memory$AllocCloseHandleVirtualWrite$Thread$ContextWindowWow64$ConsoleCreateReadResumeShow
String ID: 'qy$*WiN$-:YG$.U?V$.U?V$/:W$1Z$N$2uu9$@$C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe$D$E@,4$Lbjy$Lr$Lr$Ud{[$Ud{[$Yr`g$]V>B$]p1;$`mLP$dLUn$g},s$kernel32.dll$ntdll.dll$n`$n`$q=/z$q=/z$qq&9$rLRU$rLRU$sEu$v@ud$v@ud$xvBq$xvBq$|e5h$|rE$}0%M$`C$xW
API String ID: 1711602172-3874039472
Opcode ID: 14ffc7db718a82562853e17f71a4123639d10cbaec5579d826aa14e3e3c0fd30
Instruction ID: bb34d11356cfb8609ccfe7075d47d4cec283a230ad197f8008d0393975513446
Opcode Fuzzy Hash: 14ffc7db718a82562853e17f71a4123639d10cbaec5579d826aa14e3e3c0fd30
Instruction Fuzzy Hash: 1B24F432A552158FDF14CE2DC9C47CABBF1EB97359F109285E429E7A94C63A9E84CF00

Function 6CF812E0 Relevance: 53.7, APIs: 14, Strings: 13, Instructions: 6499filememoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6CF86DC7
GetModuleHandleA.KERNEL32 ref: 6CF86E18
K32GetModuleInformation.KERNEL32 ref: 6CF86E75
GetModuleFileNameA.KERNEL32 ref: 6CF86E9E
CreateFileMappingA.KERNEL32 ref: 6CF86F61
CloseHandle.KERNEL32 ref: 6CF86FBF
MapViewOfFile.KERNELBASE ref: 6CF87052
VirtualProtect.KERNELBASE ref: 6CF873E9
VirtualProtect.KERNELBASE ref: 6CF87495
FindCloseChangeNotification.KERNELBASE ref: 6CF875F4
CloseHandle.KERNEL32 ref: 6CF8761A
CloseHandle.KERNEL32 ref: 6CF8762B
MapViewOfFile.KERNEL32 ref: 6CF87C51

Strings

\l, xrefs: 6CF839B4
k(E0, xrefs: 6CF83F9F
$iU, xrefs: 6CF867B3
@, xrefs: 6CF873DD
(K?V, xrefs: 6CF838AA
(K?V, xrefs: 6CF83859
[!cR, xrefs: 6CF86012
u$,, xrefs: 6CF871E5
Z63, xrefs: 6CF8543A
x(~[, xrefs: 6CF81340
M, xrefs: 6CF84D2F
6Eq\, xrefs: 6CF841C2
I+5, xrefs: 6CF85096

Memory Dump Source

Source File: 00000000.00000002.1661154336.000000006CF81000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF80000, based on PE: true

Associated: 00000000.00000002.1661117584.000000006CF80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661418137.000000006CFA2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFEA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661708764.000000006CFF5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf80000_qg155Ew08h.jbxd

Yara matches

Similarity

API ID: CloseFileHandle$Module$ProtectViewVirtual$ChangeCreateCurrentFindInformationMappingNameNotificationProcess
String ID: $iU$(K?V$(K?V$6Eq\$@$I+5$Z63$[!cR$\l$k(E0$u$,$x(~[$M
API String ID: 847626866-3733139534
Opcode ID: 0df6afefe87c0ce6156d43465b61e0355b107768293893d547eb497ba4cec2dd
Instruction ID: e1255d58f83a92eec6297b13530775e8a45b66fe9f529eef621d4eaf43b47287
Opcode Fuzzy Hash: 0df6afefe87c0ce6156d43465b61e0355b107768293893d547eb497ba4cec2dd
Instruction Fuzzy Hash: 70C3EF33B52215CFDF05CE3CD9957DAB7F1EB83310F109246E819AB6A1D636A94A9F00

Function 6CF87D10 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 197
librarynativeloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 6CF87D2E
GetProcAddress.KERNEL32 ref: 6CF87D46
NtQueryInformationProcess.NTDLL ref: 6CF87E92

Strings

}To, xrefs: 6CF87FBB
NtQueryInformationProcess, xrefs: 6CF87D39
}To, xrefs: 6CF87F48
ntdll.dll, xrefs: 6CF87D25

Memory Dump Source

Source File: 00000000.00000002.1661154336.000000006CF81000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF80000, based on PE: true

Associated: 00000000.00000002.1661117584.000000006CF80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661418137.000000006CFA2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFEA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661708764.000000006CFF5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf80000_qg155Ew08h.jbxd

Yara matches

Similarity

API ID: AddressHandleInformationModuleProcProcessQuery
String ID: NtQueryInformationProcess$ntdll.dll$}To$}To
API String ID: 3384173408-806997609
Opcode ID: 39d4ab60e2e14332b767623aa13d8825c392b722f9b1e296a38ec8b3909508b0
Instruction ID: dcdfbff13bfd7247b0dbac07de421a8e1048974c894aaf8b34d388e216c69c11
Opcode Fuzzy Hash: 39d4ab60e2e14332b767623aa13d8825c392b722f9b1e296a38ec8b3909508b0
Instruction Fuzzy Hash: 3371A872B16208CFCB04CFACC5847DEBFF1EB06314F20841AE459ABB44E636994A9B11

Function 0A832F70 Relevance: 4.4, Strings: 3, Instructions: 698COMMON

Download Yara Rule

Strings

OD , xrefs: 0A83337E
z=4+, xrefs: 0A833681
o, xrefs: 0A8332AC

Memory Dump Source

Source File: 00000000.00000002.1661034081.000000000A820000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a820000_qg155Ew08h.jbxd

Similarity

API ID:
String ID: o$z=4+$OD
API String ID: 0-1376577083
Opcode ID: 836eeb6748e45875af743743fc3d042aa8e799c204717d3d0417c617db640e90
Instruction ID: 2dcc57515f35f1ae4b7023818fbad0ce5478d5836b5aad39297faeab786dc8e0
Opcode Fuzzy Hash: 836eeb6748e45875af743743fc3d042aa8e799c204717d3d0417c617db640e90
Instruction Fuzzy Hash: 2C422132A082559FCB65CB69C98557EFBF2EFC9300B14896AE496DF365C630ED01CB90

Function 00FD0C79 Relevance: 2.8, Strings: 2, Instructions: 261
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 00FD1013
Te^q, xrefs: 00FD114B

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: b1b453d8730dd296cfe60535172ef5c5b28dcdec7dd7ba29286ad9e0380e35e9
Instruction ID: 2c26f86ce502cff3fb72b0e30c9055c2cba886aa9ce97e621c756b15f7fbb48a
Opcode Fuzzy Hash: b1b453d8730dd296cfe60535172ef5c5b28dcdec7dd7ba29286ad9e0380e35e9
Instruction Fuzzy Hash: F1A1BE71A052448FC705DFA8C9589ADBFF2FF49310F19C0ABE458AB766CA31D805DB51

Function 00FD0D6E Relevance: 2.8, Strings: 2, Instructions: 255
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 00FD1013
Te^q, xrefs: 00FD114B

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: aec8975c244243ca6d70a91bfe6ed358bee998b42fe69a4e1e660b7adf7eb165
Instruction ID: a34ef071529f5fd056cafa6228ec33d28eae33c1a766062a501da643d7aeed24
Opcode Fuzzy Hash: aec8975c244243ca6d70a91bfe6ed358bee998b42fe69a4e1e660b7adf7eb165
Instruction Fuzzy Hash: 9A912971A092858FCB06DFB4C85966ABFB2FF46300F19809FD5519F293CA358806DB51

Function 00FD0BFA Relevance: 2.7, Strings: 2, Instructions: 233
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 00FD1013
Te^q, xrefs: 00FD114B

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: a8cbe41e7dc55c0063e4f4067f045031a658f15757fe63c402f08c2553347bf9
Instruction ID: 931594acbdcbd100e762a6150b62d7bcb9b4efa385fb77ce8782812b707c70b6
Opcode Fuzzy Hash: a8cbe41e7dc55c0063e4f4067f045031a658f15757fe63c402f08c2553347bf9
Instruction Fuzzy Hash: 5A910931A192898FC705DFB8C8945AEFFB2FF45300F29809FD451AB252CA359D06DB91

Function 00FD0A7D Relevance: 2.7, Strings: 2, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 00FD1013
Te^q, xrefs: 00FD114B

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: 7583b5d75e04dc3e6c2959af31a65bc887c34381bf717f7591265b621459f872
Instruction ID: 4e60119aed5468773f3dcb218c13477e525d1387a73e988d996db8b5e2c9e420
Opcode Fuzzy Hash: 7583b5d75e04dc3e6c2959af31a65bc887c34381bf717f7591265b621459f872
Instruction Fuzzy Hash: 1981D431A092858FC705DFB8C8595AEBFB2FF46300F19C0ABD455AB762CA31D906DB91

Function 00FD095C Relevance: 2.7, Strings: 2, Instructions: 220
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 00FD1013
Te^q, xrefs: 00FD114B

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: 1a2f209306a9a362264c5ba6479719e85b699a0c4f87e1ce873bb3ed2fc5f44e
Instruction ID: dc759a01b2ce93ae56c96856f83bc2aa194f08260914a7f89187b9cf4bfdb24a
Opcode Fuzzy Hash: 1a2f209306a9a362264c5ba6479719e85b699a0c4f87e1ce873bb3ed2fc5f44e
Instruction Fuzzy Hash: C681F631A092858FC705DFB8C85966EBFA3FF86300F1984AFD5519B392CA358906DB91

Function 00FD0E49 Relevance: 2.7, Strings: 2, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 00FD1013
Te^q, xrefs: 00FD114B

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: 92480d75735f65ee14108df4a8609b0ba4976c54654cdea000da799cff5e2069
Instruction ID: 5377bedf40c54669350955cd6c557b413126ba83ff7c36188f9c98c1ce07420b
Opcode Fuzzy Hash: 92480d75735f65ee14108df4a8609b0ba4976c54654cdea000da799cff5e2069
Instruction Fuzzy Hash: C8712731A092858FC705DFB8C85966EBFB3FF86310F19C0AFD4519B292CA358906DB91

Function 00FD0A41 Relevance: 2.7, Strings: 2, Instructions: 215
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 00FD1013
Te^q, xrefs: 00FD114B

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: 45af326ea1149f5906958cb1f23bc26d491f4baff12104e1489c25928092e82b
Instruction ID: 1f8115a720a99ee24a295d4dc236fe0bd92a315b982bc5c3b68328b967c6464c
Opcode Fuzzy Hash: 45af326ea1149f5906958cb1f23bc26d491f4baff12104e1489c25928092e82b
Instruction Fuzzy Hash: 58712931A192858FC705DFB8C8596AEBFB2FF46300F1980AFD5519B392CA358906DB91

Function 00FD0B13 Relevance: 2.7, Strings: 2, Instructions: 213
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 00FD1013
Te^q, xrefs: 00FD114B

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: e327e3ee28c826ace994a2454cdc8ec53a2e275ac173ce6bc051f9b908434640
Instruction ID: 012144c9e04fd98a8651173839dc39734266ae57edf7c245aba3fadbbd4d5e24
Opcode Fuzzy Hash: e327e3ee28c826ace994a2454cdc8ec53a2e275ac173ce6bc051f9b908434640
Instruction Fuzzy Hash: 77710831A092858FC705DFB8C85966DBFB2FF86300F19C0AFD5559B2A2CA358D06DB91

Function 00FD0DC2 Relevance: 2.7, Strings: 2, Instructions: 213
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 00FD1013
Te^q, xrefs: 00FD114B

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: 6f16075a1e9a192b790c0d9797bc6a5d2076e7656fcf70564e1414b48bc2ab4c
Instruction ID: 0a1d701a2eb0d086f4f97d38784b8d6bc48c3e3b434a5c66a637fd26b902ecbc
Opcode Fuzzy Hash: 6f16075a1e9a192b790c0d9797bc6a5d2076e7656fcf70564e1414b48bc2ab4c
Instruction Fuzzy Hash: 49711B31A192858FC705DFB8C8596AEBFB2FF46300F19C0AFD5519B2A2CA358D06DB51

Function 00FD0E02 Relevance: 2.7, Strings: 2, Instructions: 213
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 00FD1013
Te^q, xrefs: 00FD114B

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: 1cd6bb9426778efc7edd0c3c8223f0be2ef1187f0e7c03c913ef8e8c718e08e8
Instruction ID: 90c66c90ab5ec797566fd7c40478d42aabbc969c53d9c6547e5794bbfe497182
Opcode Fuzzy Hash: 1cd6bb9426778efc7edd0c3c8223f0be2ef1187f0e7c03c913ef8e8c718e08e8
Instruction Fuzzy Hash: 75712931A192858FC705DFB8C8596AEBFB2FF46300F19C0AFD4509B692CA358D06DB91

Function 00FD09FA Relevance: 2.7, Strings: 2, Instructions: 211COMMON

Download Yara Rule

Strings

Te^q, xrefs: 00FD1013
Te^q, xrefs: 00FD114B

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: 5ca6ba7895a1efc5aaf0c7aa50cc0272bed287e75d62b229ed54e5b267c3315b
Instruction ID: 5b05d73492bb88b4324af76b2e94d931687cd97a79e774da708fcea70d1c8257
Opcode Fuzzy Hash: 5ca6ba7895a1efc5aaf0c7aa50cc0272bed287e75d62b229ed54e5b267c3315b
Instruction Fuzzy Hash: 59711A31A092858FC705DFB8C85966DBFB2FF86300F19C0AFD5519B6A2CA358D06DB91

Function 00FD0BAD Relevance: 2.7, Strings: 2, Instructions: 211COMMON

Download Yara Rule

Strings

Te^q, xrefs: 00FD1013
Te^q, xrefs: 00FD114B

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: a5268a42e840d371b07f16d64ee168c6d6f279307171719e125ad70b70a46b9f
Instruction ID: cb4fc9790690667d30f213a9e31a46332f8ddb7d1223200c9916687e9f70f5f9
Opcode Fuzzy Hash: a5268a42e840d371b07f16d64ee168c6d6f279307171719e125ad70b70a46b9f
Instruction Fuzzy Hash: 53712A31A192858FC705DFB8C8596AEBFB2FF46300F1980AFD5519B392CA358D06DB51

Function 00FD0B77 Relevance: 2.7, Strings: 2, Instructions: 211COMMON

Download Yara Rule

Strings

Te^q, xrefs: 00FD1013
Te^q, xrefs: 00FD114B

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: 702b8ffe8c4d8b2427f008015a51d3dc2235c68eb949464cc6363bd255b9f92a
Instruction ID: 46d1794bea0f9eec6ed9669906013d612be455f840d2e7cf3272a05659b9c25e
Opcode Fuzzy Hash: 702b8ffe8c4d8b2427f008015a51d3dc2235c68eb949464cc6363bd255b9f92a
Instruction Fuzzy Hash: CE712A31A1A2858FC705DFB8CC5966DBFB2FF46300F1980AFD4519B692CA358D06DB51

Function 00FD0EDC Relevance: 2.7, Strings: 2, Instructions: 208COMMON

Download Yara Rule

Strings

Te^q, xrefs: 00FD1013
Te^q, xrefs: 00FD114B

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: 95944085774bbf3fca8e2f616a088e0e76c353553d0251cbf10e6a7c967fe3ea
Instruction ID: 072a9433781673e0eada8becf5371271b9a325eb86efe190f6237ece75465894
Opcode Fuzzy Hash: 95944085774bbf3fca8e2f616a088e0e76c353553d0251cbf10e6a7c967fe3ea
Instruction Fuzzy Hash: 9D714C31A192858FC705DFB8CC5966EBFB2FF46300F1980AFD4519B292CA358D06DB51

Function 00FD0E98 Relevance: 2.7, Strings: 2, Instructions: 208COMMON

Download Yara Rule

Strings

Te^q, xrefs: 00FD1013
Te^q, xrefs: 00FD114B

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: 877e5d637fc43c8fb8a44370d25d82f0d57378685b693b4d78439513a648e001
Instruction ID: fa8538ae4116f53b4d59845c119ac0d8c9435cedd29271370aa320adaa2c47c8
Opcode Fuzzy Hash: 877e5d637fc43c8fb8a44370d25d82f0d57378685b693b4d78439513a648e001
Instruction Fuzzy Hash: 2F714A31A092958FC705DFB8CC596AEBFB2FF46310F1980AFD4519B392CA358906DB91

Function 00FD0F26 Relevance: 2.7, Strings: 2, Instructions: 207COMMON

Download Yara Rule

Strings

Te^q, xrefs: 00FD1013
Te^q, xrefs: 00FD114B

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: 8208fdfe8721a318a8211692e3d651feb7cdd25874d3b4c2fec83d3e2aaa4730
Instruction ID: 7e7c8954f18507da85ad89179946054c0141e3cf4d7af091c2f166b8de3707c4
Opcode Fuzzy Hash: 8208fdfe8721a318a8211692e3d651feb7cdd25874d3b4c2fec83d3e2aaa4730
Instruction Fuzzy Hash: F4710931A092858FC705DFB8CC5966DBFB2FF46300F1984AFD5519B292CA358D06DB91

Function 00FD0F1B Relevance: 2.7, Strings: 2, Instructions: 174COMMON

Download Yara Rule

Strings

Te^q, xrefs: 00FD1013
Te^q, xrefs: 00FD114B

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: a7f5e5f105b45fe7872f6e01904e1800d18a2cab0a56a3944bbaeddc78902cf7
Instruction ID: 9d50b374929e2c97411b8a6faf68c9289431d6f93b5908bb22f77a94c19b9f65
Opcode Fuzzy Hash: a7f5e5f105b45fe7872f6e01904e1800d18a2cab0a56a3944bbaeddc78902cf7
Instruction Fuzzy Hash: 3151F871A092858FC705DFB8C85966EBFB2FF86300F1980AFD5519B362CA358905DB91

Function 00FD0FF8 Relevance: 2.6, Strings: 2, Instructions: 125COMMON

Download Yara Rule

Strings

Te^q, xrefs: 00FD1013
Te^q, xrefs: 00FD114B

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: ab439a7e08205655409d0e50122ce88496429185ef12fcaa8d80ee45f20acd98
Instruction ID: a8590a8655f499d4d737eed8d9b9f6d9702566b0739b5ab3699df9452e83d22c
Opcode Fuzzy Hash: ab439a7e08205655409d0e50122ce88496429185ef12fcaa8d80ee45f20acd98
Instruction Fuzzy Hash: 25419071B001199FDB08DFA9C88967EFAB7FF84700F24842AE515EB361CB358D419B91

Function 00FD22D1 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

c/(, xrefs: 00FD2512

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID: c/(
API String ID: 0-1181213848
Opcode ID: 1063116e03b5d9952a97a9bdfb3e50fe7effe00b0f8b538fdd8ba8a3182caf7e
Instruction ID: 9f14f9e9b06e5d795022632725e2b579a5a55f3564aeedf6f8a89f053d66259f
Opcode Fuzzy Hash: 1063116e03b5d9952a97a9bdfb3e50fe7effe00b0f8b538fdd8ba8a3182caf7e
Instruction Fuzzy Hash: 86A1247251D2958FC745CF78C895595BFA2FB2230071982ABD8928B652C730EA46E7C2

Function 00FD23B8 Relevance: 1.5, Strings: 1, Instructions: 255COMMON

Download Yara Rule

Strings

c/(, xrefs: 00FD2512

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID: c/(
API String ID: 0-1181213848
Opcode ID: cb7b23d97cfbf5762f0ae5358730d339c28a44fa12fb20bc18e8b45efc00a911
Instruction ID: 937ec923f1d42c72b09631c771a37853f84c216adc8938f366a7534a69df5284
Opcode Fuzzy Hash: cb7b23d97cfbf5762f0ae5358730d339c28a44fa12fb20bc18e8b45efc00a911
Instruction Fuzzy Hash: 0FA15532618255CFC385CF28C880915BBB2FB25300B5A866BD856DB762C734ED06FBD2

Function 0A8336F0 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1661034081.000000000A820000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a820000_qg155Ew08h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a849c343911db604073f09eda20195b7cd6b950d370f38e302455a2d0ff2b24a
Instruction ID: 8321983b311ea56097af19adfd30afb621c475a6631f5883038178c41d40f051
Opcode Fuzzy Hash: a849c343911db604073f09eda20195b7cd6b950d370f38e302455a2d0ff2b24a
Instruction Fuzzy Hash: FB41497BF1810BAB87589AB9CD8207FB666EBC42053154C369802DF3A0DF34CE0187D2

Function 6CF95898 Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6CF958DF
___scrt_uninitialize_crt.LIBCMT ref: 6CF958F9

Memory Dump Source

Source File: 00000000.00000002.1661154336.000000006CF81000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF80000, based on PE: true

Associated: 00000000.00000002.1661117584.000000006CF80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661418137.000000006CFA2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFEA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661708764.000000006CFF5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf80000_qg155Ew08h.jbxd

Yara matches

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: c7ed2a7a7518642a3d94ea5ab6efd1f666b4b768e1647c6f7f2025cec611359f
Instruction ID: 85e038c858ea788bc5995b30d81e3b2bac8e0fae638d74852a701901c7faa4b5
Opcode Fuzzy Hash: c7ed2a7a7518642a3d94ea5ab6efd1f666b4b768e1647c6f7f2025cec611359f
Instruction Fuzzy Hash: 1E41D772E05225EFFF118F69C880F9E7AB4EB857AEF114316E82567B50C7314D458BA0

Function 6CF95948 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 6CF95985
dllmain_crt_dispatch.LIBCMT ref: 6CF9599C
dllmain_raw.LIBCMT ref: 6CF959E4
dllmain_crt_dispatch.LIBCMT ref: 6CF959F7
dllmain_raw.LIBCMT ref: 6CF95A0A

Memory Dump Source

Source File: 00000000.00000002.1661154336.000000006CF81000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF80000, based on PE: true

Associated: 00000000.00000002.1661117584.000000006CF80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661418137.000000006CFA2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFEA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661708764.000000006CFF5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf80000_qg155Ew08h.jbxd

Yara matches

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 163f115904895e48df2afca96c0b8d1a41b4e3012ce651ed5cf98f56573dc83e
Instruction ID: afac10e1f2aa6486bc15c70959487e53b703dedd01b95a8fb5ee558dc37b6807
Opcode Fuzzy Hash: 163f115904895e48df2afca96c0b8d1a41b4e3012ce651ed5cf98f56573dc83e
Instruction Fuzzy Hash: 9621A672D05225EFFF218F55C880EAF7A78EB816AEB014315F81457A10C3318D058B90

Function 6CF95791 Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6CF957DE

Part of subcall function 6CF95C5B: InitializeSListHead.KERNEL32(6CFF4020,6CF957E8,6CFA7A90,00000010,6CF95779,?,?,?,6CF959A1,?,00000001,?,?,00000001,?,6CFA7AD8), ref: 6CF95C60

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6CF95848

Memory Dump Source

Source File: 00000000.00000002.1661154336.000000006CF81000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF80000, based on PE: true

Associated: 00000000.00000002.1661117584.000000006CF80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661418137.000000006CFA2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFEA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661708764.000000006CFF5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf80000_qg155Ew08h.jbxd

Yara matches

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: 16968b564230d94fcaf80769537cfc8cc2cbf15d79ddd680f2247eb749efb889
Instruction ID: 6d0b0b1803f96ca838c0e9383097df902d729d898a4abe758008f1c64c33643a
Opcode Fuzzy Hash: 16968b564230d94fcaf80769537cfc8cc2cbf15d79ddd680f2247eb749efb889
Instruction Fuzzy Hash: 34212132A49201AAFF106BF494087DD7BB09F022AFF21065AD5956BFD1CB23044EC7A2

Function 6CF9BDBC Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 6CF9BE08
GetFileType.KERNELBASE(00000000), ref: 6CF9BE1A

Memory Dump Source

Source File: 00000000.00000002.1661154336.000000006CF81000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF80000, based on PE: true

Associated: 00000000.00000002.1661117584.000000006CF80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661418137.000000006CFA2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFEA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661708764.000000006CFF5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf80000_qg155Ew08h.jbxd

Yara matches

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: ddc8a15bcb163abddc50a6b112437cf87d4eedca84744b7022370ade7f32583c
Instruction ID: a52c3e1c83c3f4ba6aee348e27f4d3b254fd8ceda8b5527a265a21bc243d9445
Opcode Fuzzy Hash: ddc8a15bcb163abddc50a6b112437cf87d4eedca84744b7022370ade7f32583c
Instruction Fuzzy Hash: A111EC726087014AEF305E3E8C99757BAADAB47234B340F5EE2B6C69F1C331D586D684

Function 0A835BA8 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000), ref: 0A835C18

Memory Dump Source

Source File: 00000000.00000002.1661034081.000000000A820000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a820000_qg155Ew08h.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 20d008cadf3b23910bc20e64dee27d818c6865a9750a6d3c30f9e186921fd491
Instruction ID: f86e8e60ce140c0a2d99aa9ab8533b0fb595b630ab6ac94843db924006bb3555
Opcode Fuzzy Hash: 20d008cadf3b23910bc20e64dee27d818c6865a9750a6d3c30f9e186921fd491
Instruction Fuzzy Hash: EC1112B6D006599FCB14CF9AD944A9EFBF4FB48324F10812AD819A7350C778A944CFE5

Function 0A835F38 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE ref: 0A835F97

Memory Dump Source

Source File: 00000000.00000002.1661034081.000000000A820000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a820000_qg155Ew08h.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 5f746d9889ea297ec545c25c4f64acda604c7fefdd967723b7b9694346500375
Instruction ID: 6d1baf86744bbddb8c87db6f0a6b6f6adb2c414b5dfca6d8a54a73f7146a2c47
Opcode Fuzzy Hash: 5f746d9889ea297ec545c25c4f64acda604c7fefdd967723b7b9694346500375
Instruction Fuzzy Hash: 361133B2800249CFCB20DF9AC544BDEBBF4EF48324F21846AD558A7350D778A944CFA5

Function 00FD3A38 Relevance: 1.3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

Strings

P n, xrefs: 00FD3A77

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID: P n
API String ID: 0-2893258591
Opcode ID: 62aeb1b4001b587fece7976204c67b7794b872d9930bf3419062cede45200c53
Instruction ID: 0c492b10058426e0a615b92849334198b903d154aa6369967984d276cea9e2af
Opcode Fuzzy Hash: 62aeb1b4001b587fece7976204c67b7794b872d9930bf3419062cede45200c53
Instruction Fuzzy Hash: FD014E31D142484FD70487B948005AF7FE7BF85310F14863AD456FB3C1D6388906E752

Function 00FD1A26 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cf25bc886a8a3a43ec4214755043cafde55d96ebb674a823336949590269242
Instruction ID: 09ab68ab47c186f6107d73e83c4ed66c387dbc21d089cfae04b4b749553d1449
Opcode Fuzzy Hash: 7cf25bc886a8a3a43ec4214755043cafde55d96ebb674a823336949590269242
Instruction Fuzzy Hash: 37410171E04249DFCB15CBA8C8611AEBBB3FF89300F28852BE445EB711D7349A06DB91

Function 00FD3AA5 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05c4e94c658170baa2db72587169d591aed6ff7a94ca0a593ffa3097a6c89767
Instruction ID: 682829c630ae17be9fe72b6196d7deec8e5c33832c2cd551632f632c29ee8c10
Opcode Fuzzy Hash: 05c4e94c658170baa2db72587169d591aed6ff7a94ca0a593ffa3097a6c89767
Instruction Fuzzy Hash: 6F413732A2E2C58FC751C734C9A6159BFA3EF42200719C9EBC5D497A86C2688947EB53

Function 00FD1470 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b806335d37fc53eacacab503f03e00771df46a4003bcf894eafd3b42fcf942e8
Instruction ID: 933cfb41211382c9a8f070cc0c460e52f31c02cbb4c36d8458ebc196dcc944f8
Opcode Fuzzy Hash: b806335d37fc53eacacab503f03e00771df46a4003bcf894eafd3b42fcf942e8
Instruction Fuzzy Hash: C631DA76E042599FCB05CBAAD8505AEBBF3BFCA300B298157E406EB361D3349D06DB51

Function 00FD1AB0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df64c71cafab3f96d074e81200fa45e08e4cf070d5f23aa01112653381191957
Instruction ID: b234890f60cb8a329a7b69e083d97f85ac21d6ef2f285d78d6e82c99edf64900
Opcode Fuzzy Hash: df64c71cafab3f96d074e81200fa45e08e4cf070d5f23aa01112653381191957
Instruction Fuzzy Hash: 34110371E145989FDB19CBA8C85159EBBF7BFCA300B288557E401E7320D7708802DB50

Function 00FD1679 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db594a092cb1ed8367d7d225363dba8a60acc2739d09bba78fce19bdd26da414
Instruction ID: 83069b796d101b93c565524cfb0e62caef06db11488f18da7fa6c24219c5edc5
Opcode Fuzzy Hash: db594a092cb1ed8367d7d225363dba8a60acc2739d09bba78fce19bdd26da414
Instruction Fuzzy Hash: 70012466B096816FC305CE7A2940052FFE7BBC631071CC27BD009C7722C764D815E791

Function 00FD2750 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5b7e8982665ad8c755ff3ff45733f8fa20ccb85d3c4b63a7fe5597627855cd2
Instruction ID: c156b9f700500df635c78e961c2409fa4ac079e71ebe737130e078eaeb7639c3
Opcode Fuzzy Hash: d5b7e8982665ad8c755ff3ff45733f8fa20ccb85d3c4b63a7fe5597627855cd2
Instruction Fuzzy Hash: 3F017B3120C2C18FC76A4739A81045BBF93DFE322531C85AFE05BCB361CA25D907A751

Function 00FD27E8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42c4c43dedb1f396e729c6d72974443beb53fb888a5302ea04a4f47bc83c2919
Instruction ID: 009d2381dd4344a47121a2f9ddc35c2df1e72a4e53a2bf8edc6e21b585006791
Opcode Fuzzy Hash: 42c4c43dedb1f396e729c6d72974443beb53fb888a5302ea04a4f47bc83c2919
Instruction Fuzzy Hash: CC017D767096844FD3068B3A4C84A26FFE7EBC9310B28C06BE50DC7BA1CA348C05D780

Function 00FD15E0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dce38c54921e124e7b15e3c4c5a5f5d16bd4163e5cebe4267daf8e3f11c6b316
Instruction ID: e2d52f8e37b6ef7b035eb26521cd35e2b8da8adbd597d7cf04391b4091b48d73
Opcode Fuzzy Hash: dce38c54921e124e7b15e3c4c5a5f5d16bd4163e5cebe4267daf8e3f11c6b316
Instruction Fuzzy Hash: 03018633304284DBD7609A599580753B7E7FB993607AC4D3BE047CBB14C675E880A701

Function 00FD27F8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e48235de5ec40fc15acb13b4473136620b99690f85d56f987e4420c2dedb47e
Instruction ID: f5b6cf4af092c7c941f1e22ff944ff4260c4cdb317f5e659b509436470351c98
Opcode Fuzzy Hash: 1e48235de5ec40fc15acb13b4473136620b99690f85d56f987e4420c2dedb47e
Instruction Fuzzy Hash: C1F090767005095BD3589A3E9D84A26FACBF7C8760B24C42BE50DC7794DA31DC15A6D0

Function 00FD0839 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fcc903a678a890fcf584f53142ad83abd91f8e0846888093277f95605c2d460
Instruction ID: 00611f5f00103a0cdb1de2a9491bb753e9831ce5c27782b98da0d7c7efb61b2d
Opcode Fuzzy Hash: 6fcc903a678a890fcf584f53142ad83abd91f8e0846888093277f95605c2d460
Instruction Fuzzy Hash: 5BF06274D05209EFCB44DFB8D98968DBFB2EB9A600F2485B6D446D7360E6308A15AB40

Function 00FD0848 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82473c396d53519b24960e4731770874ed91eea31f6bc0530f7892ccba95a19c
Instruction ID: 8eeeccdc3969746759f385ab3414626cb242c0289d108dc2981c8a55bfe0f8a8
Opcode Fuzzy Hash: 82473c396d53519b24960e4731770874ed91eea31f6bc0530f7892ccba95a19c
Instruction Fuzzy Hash: 0BF05474E0520DEFCB44DFB8994428DBFF2EB95300F2484B6D845D7364E6309A15A780

Function 00FD0934 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d8d07c297f6e880d211307916c4a53edbf4108287715d554c3fa563c1e053df
Instruction ID: c8a1ae7f0f832de8d6f866990aa25682596ceaa759ad9b276ae99ed405d50bfe
Opcode Fuzzy Hash: 6d8d07c297f6e880d211307916c4a53edbf4108287715d554c3fa563c1e053df
Instruction Fuzzy Hash: E0E0C2347211269FCB24AB3CD96823877A3EB94B00F184A37C506D33A5EEB0CC496740

Function 00FD1EDF Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b246b3c6fb1e1887afeee67ad201b86339fd675ca4ae42d760aaf4a765f842c
Instruction ID: 7d447917a9797ee92f54e89737b6412c9e41f6487ce1354a44de26b72f85f3cb
Opcode Fuzzy Hash: 8b246b3c6fb1e1887afeee67ad201b86339fd675ca4ae42d760aaf4a765f842c
Instruction Fuzzy Hash: EBE0E275911608DFC714CBA4C58068EBBF6FF8C310F68595AD801A2320C232AE02CE10

Function 00FD3F8B Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dcdab6744efc7a653a1f8c59cede5f2c3b2a3ab98b2ed20214074065e227ec1
Instruction ID: 6a527fa3bb265fbb6b7370ffa9094daba1d7d605f0a2367b9503f4b016c01769
Opcode Fuzzy Hash: 2dcdab6744efc7a653a1f8c59cede5f2c3b2a3ab98b2ed20214074065e227ec1
Instruction Fuzzy Hash: 42C0803BD041158DCA01E754F9005E4FF13D58536575445F7C3645310AC3B103555681

Function 00FD1C0B Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd1898d7e154ba3076f58a7840205285746b50e2a60b6cb96b1d24aeaf98e9dc
Instruction ID: b0f88235aa3e1003290900094ce380249fd1483c59907b2cddb8afd1ee52b4a2
Opcode Fuzzy Hash: bd1898d7e154ba3076f58a7840205285746b50e2a60b6cb96b1d24aeaf98e9dc
Instruction Fuzzy Hash: B5C08C6924AB40AA82002F208E141263BA2F6222203182282E852DA432CCA2C693FA81

Non-executed Functions

Function 6CF95F7A Relevance: 6.1, APIs: 4, Instructions: 70COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,00000000), ref: 6CF95F86
IsDebuggerPresent.KERNEL32 ref: 6CF96052
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6CF9606B
UnhandledExceptionFilter.KERNEL32(?), ref: 6CF96075

Memory Dump Source

Source File: 00000000.00000002.1661154336.000000006CF81000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF80000, based on PE: true

Associated: 00000000.00000002.1661117584.000000006CF80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661418137.000000006CFA2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFEA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661708764.000000006CFF5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf80000_qg155Ew08h.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 7dc63289fcdb1813f92d59fdd0a6a47bfdc8a3caaa270adcdbc1fb18cc78abea
Instruction ID: b53ac5444a5c981af6d4659acbe7eef715ab5083181d4dc3e4a137b23e635e89
Opcode Fuzzy Hash: 7dc63289fcdb1813f92d59fdd0a6a47bfdc8a3caaa270adcdbc1fb18cc78abea
Instruction Fuzzy Hash: 34310CB5D05218DBEF60DFA5D989BCDBBB8AF08304F10419AE40DAB250E7719A85CF45

Function 6CF99F17 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 6CF9A00F
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 6CF9A019
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 6CF9A026

Memory Dump Source

Source File: 00000000.00000002.1661154336.000000006CF81000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF80000, based on PE: true

Associated: 00000000.00000002.1661117584.000000006CF80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661418137.000000006CFA2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFEA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661708764.000000006CFF5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf80000_qg155Ew08h.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 9dab437837d49dbc3c840d85b71f1067f5f8ea027fa7d9a44915e91b3aa2ed32
Instruction ID: 6eed1cf17ea3c725ca777047b9a4f19df221b3529cfe4761ba24f3136138dc92
Opcode Fuzzy Hash: 9dab437837d49dbc3c840d85b71f1067f5f8ea027fa7d9a44915e91b3aa2ed32
Instruction Fuzzy Hash: 8631B374D11228ABDF61DF65D888BCDBBB8BF08314F5042DAE41CA7250E7749B858F45

Function 6CF81000 Relevance: 2.7, Strings: 2, Instructions: 223COMMON

Download Yara Rule

Strings

|'?, xrefs: 6CF812CE
|'?, xrefs: 6CF811F7

Memory Dump Source

Source File: 00000000.00000002.1661154336.000000006CF81000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF80000, based on PE: true

Associated: 00000000.00000002.1661117584.000000006CF80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661418137.000000006CFA2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFEA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661708764.000000006CFF5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf80000_qg155Ew08h.jbxd

Yara matches

Similarity

API ID:
String ID: |'?$|'?
API String ID: 0-911386148
Opcode ID: b455b0aa2276749988312db6239b4820602b900ea6bb25f564eeee80342b69a8
Instruction ID: f3f40d531f30b8cb3a82095369982f03cbceb3768140a7d3b3e763cfae129468
Opcode Fuzzy Hash: b455b0aa2276749988312db6239b4820602b900ea6bb25f564eeee80342b69a8
Instruction Fuzzy Hash: 0B711336B4524A8FDB04CEBCC9917DF7BF2EB4A324F249229C431E7795C23A89459B50

Function 6CF94F10 Relevance: 1.8, Strings: 1, Instructions: 570COMMONLIBRARYCODE

Download Yara Rule

Strings

r8"[, xrefs: 6CF9551E

Memory Dump Source

Source File: 00000000.00000002.1661154336.000000006CF81000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF80000, based on PE: true

Associated: 00000000.00000002.1661117584.000000006CF80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661418137.000000006CFA2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFEA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661708764.000000006CFF5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf80000_qg155Ew08h.jbxd

Yara matches

Similarity

API ID:
String ID: r8"[
API String ID: 0-2432814463
Opcode ID: a9cce3b4dac7e1981f5a91664958fe444d9cecdb7dbf7d4a02f4f644124a8716
Instruction ID: cb8eda54364f7c14929956338f0de127a5a04546274ac4baa4d73a497974ecc7
Opcode Fuzzy Hash: a9cce3b4dac7e1981f5a91664958fe444d9cecdb7dbf7d4a02f4f644124a8716
Instruction Fuzzy Hash: 7F12F476E442098FEF08CEBCE5D07CE7BF2EB4A356F108205D526E7B54C62989068F15

Function 6CFA0B65 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,6CFA0B60,?,?,00000008,?,?,6CFA0763,00000000), ref: 6CFA0D92

Memory Dump Source

Source File: 00000000.00000002.1661154336.000000006CF81000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF80000, based on PE: true

Associated: 00000000.00000002.1661117584.000000006CF80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661418137.000000006CFA2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFEA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661708764.000000006CFF5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf80000_qg155Ew08h.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 06a8345cff7d6b73c07f31326811433ffda5eec9535042f8147e04610158b7bc
Instruction ID: 46063695fade899ab4b3d86802a1908166281576b1b52c529076086a5a379a96
Opcode Fuzzy Hash: 06a8345cff7d6b73c07f31326811433ffda5eec9535042f8147e04610158b7bc
Instruction Fuzzy Hash: 1FB19C32210648DFD705CF68D486B95BBE0FF05368F258658E8EACF6A1C375E982CB40

Function 6CF96138 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6CF9614E

Memory Dump Source

Source File: 00000000.00000002.1661154336.000000006CF81000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF80000, based on PE: true

Associated: 00000000.00000002.1661117584.000000006CF80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661418137.000000006CFA2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFEA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661708764.000000006CFF5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf80000_qg155Ew08h.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 5482182f7583da8c6408677f8c32a50e69260d7338d33983cb0ee748e719edc3
Instruction ID: 62e3a4699b5503f51a738d76dfdb564f0a94e1f3739128183207e619138a5906
Opcode Fuzzy Hash: 5482182f7583da8c6408677f8c32a50e69260d7338d33983cb0ee748e719edc3
Instruction Fuzzy Hash: 4E517AB1E212098BEF85CF55E58179EBBF4FB89318F21812AE425EB740D374A944CF90

Function 00FD2C59 Relevance: 1.4, Strings: 1, Instructions: 119COMMON

Download Yara Rule

Strings

eo{, xrefs: 00FD2C81

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID: eo{
API String ID: 0-14062754
Opcode ID: 52c7281224b7eae250ea9ebac8a75dc9a1f9a7ed461700282bb3f0a6bc6414d8
Instruction ID: 031cc173fc3dc5bf03e35384a2d4a06ab243c9e7fb1f001182e58b518c1f84fa
Opcode Fuzzy Hash: 52c7281224b7eae250ea9ebac8a75dc9a1f9a7ed461700282bb3f0a6bc6414d8
Instruction Fuzzy Hash: E041C2726246068FC794CB29C94165BFBF3FF95310B68C86BD156CB760D234D940EB82

Function 00FD2C68 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

eo{, xrefs: 00FD2C81

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID: eo{
API String ID: 0-14062754
Opcode ID: 5e946f05f2dfca9ec123a4ac89a5ef777724cd2bf0c30b133362c9339afde884
Instruction ID: 039fbbe35c22ddcbd4564154fa04fe6e6e98d325b968972400aa7fa4ec91ffa7
Opcode Fuzzy Hash: 5e946f05f2dfca9ec123a4ac89a5ef777724cd2bf0c30b133362c9339afde884
Instruction Fuzzy Hash: 15419072624606CFC794CB29C98561BB7F7FB94360B68C82BD126CB764D234E941EF81

Function 6CF9BCEB Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 6CF9BCEB

Memory Dump Source

Source File: 00000000.00000002.1661154336.000000006CF81000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF80000, based on PE: true

Associated: 00000000.00000002.1661117584.000000006CF80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661418137.000000006CFA2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFEA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661708764.000000006CFF5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf80000_qg155Ew08h.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: fbb07a5de19d394ca717b1ecf76dc8a880dde2038170164866ae97d28f33d851
Instruction ID: 4f03f08f4508e74cd66d52f73faec756c88dc4d76798f6783bf494ff6be51006
Opcode Fuzzy Hash: fbb07a5de19d394ca717b1ecf76dc8a880dde2038170164866ae97d28f33d851
Instruction Fuzzy Hash: 91A01130B20200CB8B80CEB2A30A30CBAFCAA02A80302802CA80AC0020EA3880008F02

Function 6CFAEB17 Relevance: .8, Instructions: 816COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1661491659.000000006CFA9000.00000004.00000001.01000000.00000007.sdmp, Offset: 6CFA9000, based on PE: true

Associated: 00000000.00000002.1661491659.000000006CFEA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661708764.000000006CFF5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf80000_qg155Ew08h.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c1c04f1ff6574383b556a6376973668ba126c4031f6106f5aec94510e884408
Instruction ID: 863da2f6b5b5ff2d6e78decb9d98cd9f5e2a9862c919cb69db55b086dfa24942
Opcode Fuzzy Hash: 3c1c04f1ff6574383b556a6376973668ba126c4031f6106f5aec94510e884408
Instruction Fuzzy Hash: E662346144E3C29FD7138B749C746E2BFB0AE5721471E09DBD8C08F4A3E2191A6AD772

Function 0A832770 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1661034081.000000000A820000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a820000_qg155Ew08h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72ea17dd4ad6af7d5b0b94d8ee907c370351f5e717124f7738813f3d57072f41
Instruction ID: db3311bc600c03f08576962b7b12a11860c8ccf0d26d21ca4cbe3d435e04559b
Opcode Fuzzy Hash: 72ea17dd4ad6af7d5b0b94d8ee907c370351f5e717124f7738813f3d57072f41
Instruction Fuzzy Hash: 9AD13572B182158FCB15CB69C9815BEFBF2EFD9310B1489AAD496DB255E730EC41CB80

Function 6CF88020 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1661154336.000000006CF81000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF80000, based on PE: true

Associated: 00000000.00000002.1661117584.000000006CF80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661418137.000000006CFA2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFEA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661708764.000000006CFF5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf80000_qg155Ew08h.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c46b430844fe8ba97a27ad9f074e09fb7f5d024e35265b934fc815f13acb0a81
Instruction ID: 746a23361cfe2d666b247d8b526c3a2e1d5dc2fe5e3861fdbc7589314e98303f
Opcode Fuzzy Hash: c46b430844fe8ba97a27ad9f074e09fb7f5d024e35265b934fc815f13acb0a81
Instruction Fuzzy Hash: AF61E076E166058FCF08CEBCD9846DEBBF2EB4A320F148316E521E77D0D23599058B54

Function 00FD3ADA Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7e0a56b83682c021ae43d89d4f53d2dbd7bf71bbe09c69fbc1537bd28e29f0b
Instruction ID: b130d03082adb0ec048311b02fa8b72fd1bc7c41919ef0e96f4f72b67bf57f31
Opcode Fuzzy Hash: b7e0a56b83682c021ae43d89d4f53d2dbd7bf71bbe09c69fbc1537bd28e29f0b
Instruction Fuzzy Hash: F3413572A2E285CFC755CB34C996048BFE3EF06210719CAABC5948BA46C224D947EB43

Function 00FD3769 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0871ad24a14551f5348df2eee60538bf0c053c66c3afb7e4e95294bcb6b1a5ad
Instruction ID: dd5d7fb6048f2655f0c073c69b74ea88c6f584f0cea689638acfd2d938c9806c
Opcode Fuzzy Hash: 0871ad24a14551f5348df2eee60538bf0c053c66c3afb7e4e95294bcb6b1a5ad
Instruction Fuzzy Hash: 0141FDF7F185458FC7008F58CC45A6EBBB6AB89304F288567DA19EB751D134CE01EB92

Function 00FD3778 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93dbc349800d280a8a08f5bda089fcfac19dbe6b96d33461bb2ef06f37a30af5
Instruction ID: 25b69087cfdc94acaf6cf2dd7be0ca518a480eab1920ad03b5eaadecf86bfcd5
Opcode Fuzzy Hash: 93dbc349800d280a8a08f5bda089fcfac19dbe6b96d33461bb2ef06f37a30af5
Instruction Fuzzy Hash: CA31F0F7F185458FC7408F58CC45A6AB7F7AB88304F1885679A19EB750D230DE01EB82

Function 00FD3B4F Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1657812644.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_qg155Ew08h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4c0b5e035cebcdabf3a5829a9101d42ccb5ec5ecc17d0168f7a757f91b968c4
Instruction ID: d427a9cd3bff11c5f45b0b31141013245bbf08cd25839aa963d3198b3bb45fab
Opcode Fuzzy Hash: c4c0b5e035cebcdabf3a5829a9101d42ccb5ec5ecc17d0168f7a757f91b968c4
Instruction Fuzzy Hash: 5B21C377E14509CF9B98CB28C640569B7B3BF89300B29C227CA45EB715D378DE42AB53

Function 6CF979AA Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 6CF97AC9
___TypeMatch.LIBVCRUNTIME ref: 6CF97BD7
_UnwindNestedFrames.LIBCMT ref: 6CF97D29
CallUnexpected.LIBVCRUNTIME ref: 6CF97D44

Strings

csm, xrefs: 6CF979E7
csm, xrefs: 6CF97B00
csm, xrefs: 6CF97A54

Memory Dump Source

Source File: 00000000.00000002.1661154336.000000006CF81000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF80000, based on PE: true

Associated: 00000000.00000002.1661117584.000000006CF80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661418137.000000006CFA2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFEA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661708764.000000006CFF5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf80000_qg155Ew08h.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: b26be460ddf7a60d1519a9d3391b2fdc8958922aa384476060b062ba75f98c4d
Instruction ID: dd32fda33698a32c9885ed35c546d664f34dcd04b60ada28a399577515ef78f7
Opcode Fuzzy Hash: b26be460ddf7a60d1519a9d3391b2fdc8958922aa384476060b062ba75f98c4d
Instruction Fuzzy Hash: 51B17871800309EFEF0ACFA5D88099EBBB5FF44318F15425BE811ABA21D731DA65CB91

Function 6CF96A50 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6CF96A87
___except_validate_context_record.LIBVCRUNTIME ref: 6CF96A8F
_ValidateLocalCookies.LIBCMT ref: 6CF96B18
__IsNonwritableInCurrentImage.LIBCMT ref: 6CF96B43
_ValidateLocalCookies.LIBCMT ref: 6CF96B98

Strings

csm, xrefs: 6CF96B2D

Memory Dump Source

Source File: 00000000.00000002.1661154336.000000006CF81000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF80000, based on PE: true

Associated: 00000000.00000002.1661117584.000000006CF80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661418137.000000006CFA2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFEA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661708764.000000006CFF5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf80000_qg155Ew08h.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 913b982d07dda4c9c1aa2732fbd3e17de350659784b2e4226e3a35f08eecfac1
Instruction ID: b4e980be05b43e8c00d14f97022d5a2be5b2c810f7f2db2a2a7bccc347ab46e5
Opcode Fuzzy Hash: 913b982d07dda4c9c1aa2732fbd3e17de350659784b2e4226e3a35f08eecfac1
Instruction Fuzzy Hash: 3A418E35A00208ABDF40CF69C884A9EBBB5AF4636CF108155F819DBB51E732E905CBD1

Function 6CF9B91A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,6CF9BA29,00000000,6CF99230,00000000,00000000,00000001,?,6CF9BBA2,00000022,FlsSetValue,6CFA3CD8,6CFA3CE0,00000000), ref: 6CF9B9DB

Strings

ext-ms-, xrefs: 6CF9B985
api-ms-, xrefs: 6CF9B971

Memory Dump Source

Source File: 00000000.00000002.1661154336.000000006CF81000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF80000, based on PE: true

Associated: 00000000.00000002.1661117584.000000006CF80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661418137.000000006CFA2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFEA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661708764.000000006CFF5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf80000_qg155Ew08h.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: d3e9a814941ef8e3b2d2b5c514b36cdf19af689b35d920601f379b68979af0d8
Instruction ID: 45a863d6092e71cd89e7eb30dc4431ffba40ae690310f8d3d161621b533bb090
Opcode Fuzzy Hash: d3e9a814941ef8e3b2d2b5c514b36cdf19af689b35d920601f379b68979af0d8
Instruction Fuzzy Hash: BD21EE32F15214EBEF315A66DC84B4E7779DF43364B250A14E819A7780DB71ED00C6D1

Function 6CF96FFE Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6CF96C31,6CF95D50,6CF95769,?,6CF959A1,?,00000001,?,?,00000001,?,6CFA7AD8,0000000C,6CF95A9A), ref: 6CF9700C
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6CF9701A
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6CF97033
SetLastError.KERNEL32(00000000,6CF959A1,?,00000001,?,?,00000001,?,6CFA7AD8,0000000C,6CF95A9A,?,00000001,?), ref: 6CF97085

Memory Dump Source

Source File: 00000000.00000002.1661154336.000000006CF81000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF80000, based on PE: true

Associated: 00000000.00000002.1661117584.000000006CF80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661418137.000000006CFA2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFEA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661708764.000000006CFF5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf80000_qg155Ew08h.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 4639496f245fd3261dcd81873244d2adf5583468b01fe27f2bb9ad85e7764cd7
Instruction ID: 81c675274075d4ad942aa4073ad2e9c273b55761d90db2c051a8e1b26bcb3f69
Opcode Fuzzy Hash: 4639496f245fd3261dcd81873244d2adf5583468b01fe27f2bb9ad85e7764cd7
Instruction Fuzzy Hash: E7018432B1D3259EBE5519BE7C84A9B7678EB02A7C734032BF664469F0FF5248089245

Function 6CF9AB4E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\qg155Ew08h.exe, xrefs: 6CF9AB6A

Memory Dump Source

Source File: 00000000.00000002.1661154336.000000006CF81000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF80000, based on PE: true

Associated: 00000000.00000002.1661117584.000000006CF80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661418137.000000006CFA2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFEA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661708764.000000006CFF5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf80000_qg155Ew08h.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\qg155Ew08h.exe
API String ID: 0-1313919018
Opcode ID: 18ffd01c9a2379ccb1457892cfc5113cf0a712a11c6dab8738d0cd98b94b2e6f
Instruction ID: 60b81083dc60559f011def6f048057413c24464842858b5985f22289f96ace7e
Opcode Fuzzy Hash: 18ffd01c9a2379ccb1457892cfc5113cf0a712a11c6dab8738d0cd98b94b2e6f
Instruction Fuzzy Hash: FD218E31A04215AFAF119E7A884099B77F9FF4276C7054A19E9198BA40E730E8548B60

Function 6CF98B5E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,8E09C9F2,00000000,?,00000000,6CFA1462,000000FF,?,6CF98AF8,?,?,6CF98ACC,?), ref: 6CF98B93
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6CF98BA5
FreeLibrary.KERNEL32(00000000,?,00000000,6CFA1462,000000FF,?,6CF98AF8,?,?,6CF98ACC,?), ref: 6CF98BC7

Strings

mscoree.dll, xrefs: 6CF98B8C
CorExitProcess, xrefs: 6CF98B9D

Memory Dump Source

Source File: 00000000.00000002.1661154336.000000006CF81000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF80000, based on PE: true

Associated: 00000000.00000002.1661117584.000000006CF80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661418137.000000006CFA2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFEA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661708764.000000006CFF5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf80000_qg155Ew08h.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 06110399cfacec455ef28c597ae7909897660784b4be0b3a4d3d5d7c4f705c3d
Instruction ID: fa7d9088f059aa78bbc852d0e66556ea9971083d71fee061570c22de3207b983
Opcode Fuzzy Hash: 06110399cfacec455ef28c597ae7909897660784b4be0b3a4d3d5d7c4f705c3d
Instruction Fuzzy Hash: 42018671A24519EFDF428F95CC09FAEFBB9FB05714F048526FC22A2A90DB76D904CA50

Function 6CF9D5D5 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 6CF9D65A
__alloca_probe_16.LIBCMT ref: 6CF9D723
__freea.LIBCMT ref: 6CF9D78A

Part of subcall function 6CF9C77A: HeapAlloc.KERNEL32(00000000,6CF9B0C7,6CF9C494,?,6CF9B0C7,00000220,?,?,6CF9C494), ref: 6CF9C7AC

__freea.LIBCMT ref: 6CF9D79D
__freea.LIBCMT ref: 6CF9D7AA

Memory Dump Source

Source File: 00000000.00000002.1661154336.000000006CF81000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF80000, based on PE: true

Associated: 00000000.00000002.1661117584.000000006CF80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661418137.000000006CFA2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFEA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661708764.000000006CFF5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf80000_qg155Ew08h.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: a8517753b9b4c35971554d292e51451b88d04fb67fe0548b71ab50fa0e9f886d
Instruction ID: 637ba8f720ba37b4c7ade7497acf86c8502c43ee80504d1d8c9c9d942a0054fb
Opcode Fuzzy Hash: a8517753b9b4c35971554d292e51451b88d04fb67fe0548b71ab50fa0e9f886d
Instruction Fuzzy Hash: BA51AF76601206AFFF259EA5CC80EAB3BB9EF84318B310529FD14D7A10EB34D8548761

Function 6CF975D2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,6CF97583,00000000,?,00000001,?,?,?,6CF97672,00000001,FlsFree,6CFA33B0,FlsFree), ref: 6CF975DF
GetLastError.KERNEL32(?,6CF97583,00000000,?,00000001,?,?,?,6CF97672,00000001,FlsFree,6CFA33B0,FlsFree,00000000,?,6CF970D3), ref: 6CF975E9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 6CF97611

Strings

api-ms-, xrefs: 6CF975F6

Memory Dump Source

Source File: 00000000.00000002.1661154336.000000006CF81000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF80000, based on PE: true

Associated: 00000000.00000002.1661117584.000000006CF80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661418137.000000006CFA2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFEA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661708764.000000006CFF5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf80000_qg155Ew08h.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: e0a3ee4a76b857e18cbd55cc77199718d61298ae2a00454e63bb5b2952fbf588
Instruction ID: 3c383023ff1340c92a8fde1d0c8568ba56228b4e5e3a8fa03df1a2de7a74c03e
Opcode Fuzzy Hash: e0a3ee4a76b857e18cbd55cc77199718d61298ae2a00454e63bb5b2952fbf588
Instruction Fuzzy Hash: 8DE01A30744305FAFF601AA3EC0DB4D7A76AB02B48F208421F90EA8891EB62E5108999

Function 6CF9DCE2 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(8E09C9F2,00000000,00000000,?), ref: 6CF9DD45

Part of subcall function 6CF9B71C: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6CF9D780,?,00000000,-00000008), ref: 6CF9B77D

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6CF9DF97
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6CF9DFDD
GetLastError.KERNEL32 ref: 6CF9E080

Memory Dump Source

Source File: 00000000.00000002.1661154336.000000006CF81000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF80000, based on PE: true

Associated: 00000000.00000002.1661117584.000000006CF80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661418137.000000006CFA2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFEA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661708764.000000006CFF5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf80000_qg155Ew08h.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 1936b58616147b9f16abe875b60b37af546374008611d6813b65c52e8dcea78c
Instruction ID: ac4005e9b546a74add211c7eccc2cc88d015a7264fb53efbb437c2e42e76025e
Opcode Fuzzy Hash: 1936b58616147b9f16abe875b60b37af546374008611d6813b65c52e8dcea78c
Instruction Fuzzy Hash: 3DD17975E012489FEF04CFE8D880AEDBBB5FF09304F28412AE965AB751D731A906CB50

Function 6CF97753 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6CF9781A
___AdjustPointer.LIBCMT ref: 6CF9783D
___AdjustPointer.LIBCMT ref: 6CF978D9

Memory Dump Source

Source File: 00000000.00000002.1661154336.000000006CF81000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF80000, based on PE: true

Associated: 00000000.00000002.1661117584.000000006CF80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661418137.000000006CFA2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFEA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661708764.000000006CFF5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf80000_qg155Ew08h.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 6a34deb506417bf9e3cf191b49a918408f25530d1ef1626fddcbd8dcc06e131f
Instruction ID: 807db1dcbbb0d227cbbcccb08f30062465a67ef8668e8d1669628edea42b378a
Opcode Fuzzy Hash: 6a34deb506417bf9e3cf191b49a918408f25530d1ef1626fddcbd8dcc06e131f
Instruction Fuzzy Hash: 0451B272A05302EFFF198F55D840BAAB7A4EF44718F34452FE82597AA0E731E844CB91

Function 6CF9A368 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 6CF9B71C: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6CF9D780,?,00000000,-00000008), ref: 6CF9B77D

GetLastError.KERNEL32 ref: 6CF9A3CC
__dosmaperr.LIBCMT ref: 6CF9A3D3
GetLastError.KERNEL32(?,?,?,?), ref: 6CF9A40D
__dosmaperr.LIBCMT ref: 6CF9A414

Memory Dump Source

Source File: 00000000.00000002.1661154336.000000006CF81000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF80000, based on PE: true

Associated: 00000000.00000002.1661117584.000000006CF80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661418137.000000006CFA2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFEA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661708764.000000006CFF5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf80000_qg155Ew08h.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 6d46af583f9f7db5878cbe636f8b432a084c88a1892dae9911ca1c992dfb1914
Instruction ID: bf92d183620f08f86a527e342d14663c380d1f645e51a221d8a391472a5c6264
Opcode Fuzzy Hash: 6d46af583f9f7db5878cbe636f8b432a084c88a1892dae9911ca1c992dfb1914
Instruction Fuzzy Hash: A321B031E04215AFFF108FAB888495BB7F9FF453687158628EC1987A10E732EC54CB90

Function 6CF9B7BF Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6CF9B7C7

Part of subcall function 6CF9B71C: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6CF9D780,?,00000000,-00000008), ref: 6CF9B77D

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6CF9B7FF
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6CF9B81F

Memory Dump Source

Source File: 00000000.00000002.1661154336.000000006CF81000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF80000, based on PE: true

Associated: 00000000.00000002.1661117584.000000006CF80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661418137.000000006CFA2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFEA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661708764.000000006CFF5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf80000_qg155Ew08h.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: c307c4356e50c511ddbb4cead76496f34554df4545f4dce4d276f7316b246dc0
Instruction ID: f84c45fa90d818af59f60618ad06d0c631e0b639b418c92ef19faed193356946
Opcode Fuzzy Hash: c307c4356e50c511ddbb4cead76496f34554df4545f4dce4d276f7316b246dc0
Instruction Fuzzy Hash: 90112BB2E19215BFBF2117B65CCCCAF7A6CCF4A2987110925F501D1A00EB75CD068571

Function 6CF9F656 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,6CF9EE16,00000000,00000001,00000000,?,?,6CF9E0D4,?,00000000,00000000), ref: 6CF9F66D
GetLastError.KERNEL32(?,6CF9EE16,00000000,00000001,00000000,?,?,6CF9E0D4,?,00000000,00000000,?,?,?,6CF9E677,00000000), ref: 6CF9F679

Part of subcall function 6CF9F63F: CloseHandle.KERNEL32(FFFFFFFE,6CF9F689,?,6CF9EE16,00000000,00000001,00000000,?,?,6CF9E0D4,?,00000000,00000000,?,?), ref: 6CF9F64F

___initconout.LIBCMT ref: 6CF9F689

Part of subcall function 6CF9F601: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6CF9F630,6CF9EE03,?,?,6CF9E0D4,?,00000000,00000000,?), ref: 6CF9F614

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,6CF9EE16,00000000,00000001,00000000,?,?,6CF9E0D4,?,00000000,00000000,?), ref: 6CF9F69E

Memory Dump Source

Source File: 00000000.00000002.1661154336.000000006CF81000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF80000, based on PE: true

Associated: 00000000.00000002.1661117584.000000006CF80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661418137.000000006CFA2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFEA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661708764.000000006CFF5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf80000_qg155Ew08h.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 78c5b8fda49a6d0887cebf668c26465ed7d07ddfb5b39c9e5a378516963c721c
Instruction ID: c77d57e43ec1138165ff86421117294f24a874982fa97e19dc2e7ccc710117a8
Opcode Fuzzy Hash: 78c5b8fda49a6d0887cebf668c26465ed7d07ddfb5b39c9e5a378516963c721c
Instruction Fuzzy Hash: C2F0AC36A55224BBDFD21FD6DC08A8D7F76FB0A3A5B154110FA1D96520CA33C820DB95

Function 6CF97D4F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 6CF97D74

Strings

RCC, xrefs: 6CF97D8E
MOC, xrefs: 6CF97D86

Memory Dump Source

Source File: 00000000.00000002.1661154336.000000006CF81000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF80000, based on PE: true

Associated: 00000000.00000002.1661117584.000000006CF80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661418137.000000006CFA2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661491659.000000006CFEA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1661708764.000000006CFF5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf80000_qg155Ew08h.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 1b4dec60af6788b2d1ec96afea333e8f19dd6e53c51c493419e98ceaec3ded52
Instruction ID: 4df17431805573b4ef3ac392b28fa0638f2075f55ba49eaa6d03e0f9ed6adfd8
Opcode Fuzzy Hash: 1b4dec60af6788b2d1ec96afea333e8f19dd6e53c51c493419e98ceaec3ded52
Instruction Fuzzy Hash: 6A414A71A00209EFEF06DF94CC81AEEBBB5FF48308F25815AF914A7660D3359951DB91

Analysis Process: MSBuild.exePID: 6664, Parent PID: 2568COMMON

Execution Graph

Execution Coverage:	6.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	90
Total number of Limit Nodes:	5

Executed Functions

Function 00ECD0A8 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00ECD136
GetCurrentThread.KERNEL32 ref: 00ECD173
GetCurrentProcess.KERNEL32 ref: 00ECD1B0
GetCurrentThreadId.KERNEL32 ref: 00ECD209

Memory Dump Source

Source File: 00000002.00000002.1793850528.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ec0000_MSBuild.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 61150cb1963d8fd022289c3facae6193daea4653737dfbfb0b6ed0d0d51a0a6f
Instruction ID: 9ae56b89188be0108d5ffc953f769505a821360ad51a0e8bce473fba58274d58
Opcode Fuzzy Hash: 61150cb1963d8fd022289c3facae6193daea4653737dfbfb0b6ed0d0d51a0a6f
Instruction Fuzzy Hash: D05178B09012498FDB14CFA9DA48B9EBBF1EF88304F24856DE059A7360DB359984CF65

Function 00ECD0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00ECD136
GetCurrentThread.KERNEL32 ref: 00ECD173
GetCurrentProcess.KERNEL32 ref: 00ECD1B0
GetCurrentThreadId.KERNEL32 ref: 00ECD209

Memory Dump Source

Source File: 00000002.00000002.1793850528.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ec0000_MSBuild.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 3749f6937f95030189422752fcce762be4532953b108f46886aafb8adbe7e2d3
Instruction ID: ba99e8cc6e19736e216e40673d32d5ac9f408746a7a13705b5ef4d6fcc1f1208
Opcode Fuzzy Hash: 3749f6937f95030189422752fcce762be4532953b108f46886aafb8adbe7e2d3
Instruction Fuzzy Hash: C15178B0901209CFDB14DFA9DA48B9EBBF1EF88314F248569E019B7360CB359984CF65

Function 00EC4248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00EC59F1

Memory Dump Source

Source File: 00000002.00000002.1793850528.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ec0000_MSBuild.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 8a33b9d19c20a8b079a57d0345d3d7e229eb538d7b673e8a039e35920cdaff70
Instruction ID: 9a83d81899fd4cb361e9bb2f8dc4d2a357ccbc911363c2a1c1b3a90ba74d508b
Opcode Fuzzy Hash: 8a33b9d19c20a8b079a57d0345d3d7e229eb538d7b673e8a039e35920cdaff70
Instruction Fuzzy Hash: 9641D2B1C00719CADB24CFAAC944B9EBBB5FF49304F24816AD408BB255DB756986CF90

Function 00EC593B Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00EC59F1

Memory Dump Source

Source File: 00000002.00000002.1793850528.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ec0000_MSBuild.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 9ed9e46dd0aba3c127eba856b48c640d119053545abf8b78647985a996665df1
Instruction ID: c819114131d06f17f38cedc31a5ebedddf61991fefd2c956526345bc780e1f9d
Opcode Fuzzy Hash: 9ed9e46dd0aba3c127eba856b48c640d119053545abf8b78647985a996665df1
Instruction Fuzzy Hash: E941D4B1C00719CEDB14CFA9C984B8DBBB5FF45304F24816AD408BB255DB756986CF90

Function 00ECD2F9 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00ECD387

Memory Dump Source

Source File: 00000002.00000002.1793850528.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ec0000_MSBuild.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: fae7b9eeb0b22d108fcf8844debbc34799d1e511a89286432e5f54cad2485908
Instruction ID: 0121b1ac0b2d372006b2c90e70e89cdb51f72239c5627ccfbf7ff4ab4264353e
Opcode Fuzzy Hash: fae7b9eeb0b22d108fcf8844debbc34799d1e511a89286432e5f54cad2485908
Instruction Fuzzy Hash: 5C21E3B5900259DFDB10CFAAD984ADEFFF4EB48314F14842AE958A7350C375A950CFA1

Function 00ECD300 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00ECD387

Memory Dump Source

Source File: 00000002.00000002.1793850528.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ec0000_MSBuild.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 41dd63b9a99ccd33a6b28dd787188d4e5d9da3af4c283be6f3c8cec5d163dcab
Instruction ID: b431b0f6a75500d6fa903670c2fe6d42f3467f1f649da9244e4091955a470106
Opcode Fuzzy Hash: 41dd63b9a99ccd33a6b28dd787188d4e5d9da3af4c283be6f3c8cec5d163dcab
Instruction Fuzzy Hash: 9D21E4B5900258DFDB10CF9AD984ADEFBF4FB48310F14802AE958A3310C375A950CFA5

Function 00ECA870 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00ECB101,00000800,00000000,00000000), ref: 00ECB312

Memory Dump Source

Source File: 00000002.00000002.1793850528.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ec0000_MSBuild.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 3d4f10b3b491d249894aee7514386b7236ad098595813e64749bbc706454a872
Instruction ID: 0d534858e46808012a62a7762c468cfca5b36f249e7b98e0d41c61d4300bb182
Opcode Fuzzy Hash: 3d4f10b3b491d249894aee7514386b7236ad098595813e64749bbc706454a872
Instruction Fuzzy Hash: FA1103B69002498FCB10CF9AC545BDEFBF4EB48310F10842EE859A7210C375A945CFA5

Function 00ECB2A3 Relevance: 1.6, APIs: 1, Instructions: 52
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00ECB101,00000800,00000000,00000000), ref: 00ECB312

Memory Dump Source

Source File: 00000002.00000002.1793850528.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ec0000_MSBuild.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c96400197612f280677012e7e721cb28c9359036de42d4ced304981029c4bab
Instruction ID: 8fdb521c29c60981c5f7b37619d239b6a86bf9a5ca4390f6f9a20db1cfa5c685
Opcode Fuzzy Hash: 8c96400197612f280677012e7e721cb28c9359036de42d4ced304981029c4bab
Instruction Fuzzy Hash: A51123B68002498FCB14CFAAC544BDEFBF4EF88320F14842ED859A7210C375A545CFA1

Function 00ECB01B Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00ECB086

Memory Dump Source

Source File: 00000002.00000002.1793850528.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ec0000_MSBuild.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f2d7956e2addaeaa51161abf0fbcd35364baa2b68cfd9b05c2a8789c52d25d72
Instruction ID: c5a0efb205e96c8112f38b668f95a18f47927e7b9978e20e35238074069583d1
Opcode Fuzzy Hash: f2d7956e2addaeaa51161abf0fbcd35364baa2b68cfd9b05c2a8789c52d25d72
Instruction Fuzzy Hash: 8A111FB1C00249CECB20CFAAD545BDEFBF4AF88314F14806AD468B7210C376A546CFA4

Function 00ECB020 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00ECB086

Memory Dump Source

Source File: 00000002.00000002.1793850528.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ec0000_MSBuild.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: dd40c08a8fe3844c0f711757f09f77960034243692981a54dfb21c89307fab8f
Instruction ID: 63d4b6b58b7e89e394083f1abf2abfeb9425e742ce8df58cab563c9b3edf105f
Opcode Fuzzy Hash: dd40c08a8fe3844c0f711757f09f77960034243692981a54dfb21c89307fab8f
Instruction Fuzzy Hash: 8911CDB5C00349CBCB20DF9AC545B9EFBF4AB88324F14842AD869B7210C376A545CFA5

Function 00E4D774 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1793532776.0000000000E4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e4d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e649ec4f5f5268198331fbc755e92041fa2f78ac41c7fa373bdf9ba21f7e1604
Instruction ID: 3e190e2f10bab1156629a0e4bacdcb68932cb7c4a141e72ce2c2aa1cd3d855c1
Opcode Fuzzy Hash: e649ec4f5f5268198331fbc755e92041fa2f78ac41c7fa373bdf9ba21f7e1604
Instruction Fuzzy Hash: FA210672508244EFCB09DF14EDC4B26BFA5FB9C318F24C669E9095A255C336D816CBA1

Function 00E4D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1793532776.0000000000E4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e4d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1de64a82635c7e57bb5cba68d1dd7d5d7fe251ea1744a7fa1f1db2876893eca
Instruction ID: c9d9ffe82fcf539ddf3c9128897231dbb69887c24c758fb6f86c82b00006527b
Opcode Fuzzy Hash: b1de64a82635c7e57bb5cba68d1dd7d5d7fe251ea1744a7fa1f1db2876893eca
Instruction Fuzzy Hash: B5213771608240DFCB05DF14EDC0B2BBF65FB98318F20C569E9095B256C73AD856CBA1

Function 00E4D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1793532776.0000000000E4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e4d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7c26e8ef9b3735da09d67677ce05fde2f594e909b9e1df1c44e29235419c433
Instruction ID: 43a39be695b149be521690b8fd3cda8544313d016060ee36706493a249d420af
Opcode Fuzzy Hash: c7c26e8ef9b3735da09d67677ce05fde2f594e909b9e1df1c44e29235419c433
Instruction Fuzzy Hash: 18213771508204DFDB05DF14EDC0B2ABF65FB98328F20C16DE9095B256C33AE856CBA2

Function 00E5D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1793588571.0000000000E5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e5d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17774148c8661480007b651078b19755ac2d45b6599e01ebf0159a3fcacf228a
Instruction ID: 6801959b5c9e5e214d6c08a70cd415fad79e93e3d9398aba9c53c56a55e1fcc8
Opcode Fuzzy Hash: 17774148c8661480007b651078b19755ac2d45b6599e01ebf0159a3fcacf228a
Instruction Fuzzy Hash: 9921F271608200DFDB24DF14D9C4B26BBA6EB84319F20C969DD0A5B296C33AD84BCA61

Function 00E5D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1793588571.0000000000E5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e5d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b61b4f99e3d5c0177326a2df22963314285fc89f441f2aeddc4ff6ddba8a7d2
Instruction ID: b5db99ddb42f08a9b2a314dae233ac8a889895a0425165a5c5558fa7e8d21fda
Opcode Fuzzy Hash: 9b61b4f99e3d5c0177326a2df22963314285fc89f441f2aeddc4ff6ddba8a7d2
Instruction Fuzzy Hash: 9021537550D3808FDB12CF24D994715BF71EB46318F28C5EAD8498F6A7C33A980ACB62

Function 00E4D76F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1793532776.0000000000E4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e4d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7c8d58dc0dea2b6e01ffeb94055e7b182a7219ccea2c20f3472bf21e95a7b9d
Instruction ID: 995074c2fe895847dd306fa66b2a6ea707891b5604b503177d14a92f66f67e42
Opcode Fuzzy Hash: c7c8d58dc0dea2b6e01ffeb94055e7b182a7219ccea2c20f3472bf21e95a7b9d
Instruction Fuzzy Hash: 3621A276504284DFCB16CF14E9C4B26BF72FB98318F24C6A9DD491B256C33AD816CB91

Function 00E4D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1793532776.0000000000E4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e4d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: db68138040e8059d9082ce373cd06fbd1cba7f70a7f524e3b6ec4883ba41c0c0
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 2A112676404240CFCB12CF10D9C4B16BF71FB94328F24C2A9DC090B656C33AE85ACBA1

Function 00E4D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1793532776.0000000000E4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e4d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: f3ffcce361ddf4d41ee9afa77f695bb19c81addc52d80eab3b783c115fca39d2
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: FC11E676504280CFCB16CF14E9C4B16BF71FB94328F24C6A9DC494B656C33AD85ACBA1

Function 00E4DA59 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1793532776.0000000000E4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e4d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b607bec39263d216f5d0f9a23dd1205761707f7916372a53e796695729aa701
Instruction ID: 8697d4806766331bce6fdd24a37d2ad384278f9a6e04fa4b69f1e50197a1f927
Opcode Fuzzy Hash: 4b607bec39263d216f5d0f9a23dd1205761707f7916372a53e796695729aa701
Instruction Fuzzy Hash: 5C012B7100C3009AE7108A65ED84767FF98EF41374F18C96AED091A286C279DC40D671

Function 00E4DA58 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1793532776.0000000000E4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e4d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5662b9304892b85eb07879d01b9f0c3dda3a031ab3d89ca2e1638fd77b95cdb7
Instruction ID: 92dd846d6f6041e873a35adbec02fbcad58b5c6ecfd46c2e40daef20a82abddb
Opcode Fuzzy Hash: 5662b9304892b85eb07879d01b9f0c3dda3a031ab3d89ca2e1638fd77b95cdb7
Instruction Fuzzy Hash: 0FF0C2710083409AE7208A16DC84B62FFA8EF51778F18C55AED081E286C2799841CAB0

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report qg155Ew08h.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\qg155Ew08h.exe.log

C:\Users\user\AppData\Roaming\d3d9.dll

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
qg155Ew08h.exe

Function 6CF87D10 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 197
librarynativeloaderCOMMON

Function 00FD0C79 Relevance: 2.8, Strings: 2, Instructions: 261
COMMON

Function 00FD0D6E Relevance: 2.8, Strings: 2, Instructions: 255
COMMON

Function 00FD0BFA Relevance: 2.7, Strings: 2, Instructions: 233
COMMON

Function 00FD0A7D Relevance: 2.7, Strings: 2, Instructions: 231
COMMON

Function 00FD095C Relevance: 2.7, Strings: 2, Instructions: 220
COMMON

Function 00FD0E49 Relevance: 2.7, Strings: 2, Instructions: 216
COMMON

Function 00FD0A41 Relevance: 2.7, Strings: 2, Instructions: 215
COMMON

Function 00FD0B13 Relevance: 2.7, Strings: 2, Instructions: 213
COMMON

Function 00FD0DC2 Relevance: 2.7, Strings: 2, Instructions: 213
COMMON

Function 00FD0E02 Relevance: 2.7, Strings: 2, Instructions: 213
COMMON

Function 6CF95898 Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Function 6CF95948 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Function 6CF95791 Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Function 6CF9BDBC Relevance: 3.1, APIs: 2, Instructions: 65
COMMON