Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1546038
MD5:	500904922500a6b286ebc7b6aa791e24
SHA1:	b09695e46e35a433dc00c41508b6ff47745247a7
SHA256:	8e08e9ad4ee4438acbb60b2922cf4578f93df6f4adcd01e1e8942a36bd5dc4d8
Tags:	exeuser-Bitsight
Infos:

Detection

Meduza Stealer, PureLog Stealer, RedLine, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Yara detected Meduza Stealer

Yara detected PureLog Stealer

Yara detected RedLine Stealer

Yara detected zgRAT

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

.NET source code contains very large array initializations

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 7032 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 500904922500A6B286EBC7B6AA791E24)

conhost.exe (PID: 7060 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MSBuild.exe (PID: 6324 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: RedLine

{"C2 url": "4.251.123.83:6677"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.1756178312.0000000000B02000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000002.00000002.1756178312.0000000000B02000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmp	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmp	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x45c1b:$s1: file:/// 0x45b53:$s2: {11111-22222-10009-11112} 0x45bab:$s3: {11111-22222-50001-00000} 0x423fa:$s4: get_Module 0x42864:$s5: Reverse 0x45226:$s6: BlockCopy 0x42c23:$s7: ReadByte 0x45c2d:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
00000002.00000002.1757650129.0000000002AA6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 6324	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 6324	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 6324	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.6cf1b000.4.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.file.exe.6cf1b000.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.file.exe.6cf1b000.4.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.file.exe.6cf1b000.4.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x45c1b:$s1: file:/// 0x45b53:$s2: {11111-22222-10009-11112} 0x45bab:$s3: {11111-22222-50001-00000} 0x423fa:$s4: get_Module 0x42864:$s5: Reverse 0x45226:$s6: BlockCopy 0x42c23:$s7: ReadByte 0x45c2d:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
2.2.MSBuild.exe.b00000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
2.2.MSBuild.exe.b00000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
2.2.MSBuild.exe.b00000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2.2.MSBuild.exe.b00000.0.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x45c1b:$s1: file:/// 0x45b53:$s2: {11111-22222-10009-11112} 0x45bab:$s3: {11111-22222-50001-00000} 0x423fa:$s4: get_Module 0x42864:$s5: Reverse 0x45226:$s6: BlockCopy 0x42c23:$s7: ReadByte 0x45c2d:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
0.2.file.exe.6cf00000.3.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.file.exe.6cf00000.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.file.exe.6cf00000.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.file.exe.6cf00000.3.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x5f41b:$s1: file:/// 0x5f353:$s2: {11111-22222-10009-11112} 0x5f3ab:$s3: {11111-22222-50001-00000} 0x5bbfa:$s4: get_Module 0x5c064:$s5: Reverse 0x5ea26:$s6: BlockCopy 0x5c423:$s7: ReadByte 0x5f42d:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
0.2.file.exe.6cf1b000.4.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.file.exe.6cf1b000.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.file.exe.6cf1b000.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.file.exe.6cf1b000.4.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x43e1b:$s1: file:/// 0x43d53:$s2: {11111-22222-10009-11112} 0x43dab:$s3: {11111-22222-50001-00000} 0x405fa:$s4: get_Module 0x40a64:$s5: Reverse 0x43426:$s6: BlockCopy 0x40e23:$s7: ReadByte 0x43e2d:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
Click to see the 11 entries

Suricata Signatures

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T12:06:59.992193+0100	2046056	1	A Network Trojan was detected	4.251.123.83	6677	192.168.2.4	49730	TCP

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T12:06:59.338810+0100	2046045	1	A Network Trojan was detected	192.168.2.4	49730	4.251.123.83	6677	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: MSBuild.exe.6324.2.memstrmin

Malware Configuration Extractor: RedLine {"C2 url": "4.251.123.83:6677"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\gdi32.dll

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.4:49730 -> 4.251.123.83:6677
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 4.251.123.83:6677 -> 192.168.2.4:49730

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 4.251.123.83:6677

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 4.251.123.83:6677

Source: Joe Sandbox View

ASN Name: LEVEL3US LEVEL3US

Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83

Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $^q3IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000003060000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $^qqC:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000003060000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $^qqC:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb(; equals www.youtube.com (Youtube)
Source: MSBuild.exe, 00000002.00000002.1770776237.0000000006104000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: MSBuild.exe, 00000002.00000002.1770776237.0000000006104000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb: equals www.youtube.com (Youtube)

Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faulth
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002AA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field1
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field1Response
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field1ResponseD
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field2
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field2Response
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002AA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field2ResponseD
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field3
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1757650129.0000000002AA6000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field3Response
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002AA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field3ResponseD
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002D5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.o
Source: MSBuild.exe, 00000002.00000002.1764728767.0000000003B81000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003B28000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003A4D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003BDA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003DAA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: MSBuild.exe, 00000002.00000002.1764728767.0000000003B81000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003B28000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003A4D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003BDA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003DAA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: MSBuild.exe, 00000002.00000002.1764728767.0000000003B81000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003B28000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003A4D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003BDA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003DAA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: MSBuild.exe, 00000002.00000002.1764728767.0000000003B81000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003B28000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003A4D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003BDA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003DAA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: MSBuild.exe, 00000002.00000002.1764728767.0000000003B81000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003B28000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003A4D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003BDA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003DAA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: MSBuild.exe, 00000002.00000002.1764728767.0000000003B81000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003B28000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003A4D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003BDA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003DAA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: MSBuild.exe, 00000002.00000002.1764728767.0000000003B81000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003B28000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003A4D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003BDA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003DAA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: MSBuild.exe, 00000002.00000002.1764728767.0000000003B81000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003B28000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003A4D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003BDA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003DAA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: MSBuild.exe, 00000002.00000002.1764728767.0000000003B81000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003B28000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003A4D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003BDA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003DAA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.file.exe.6cf1b000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 2.2.MSBuild.exe.b00000.0.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.file.exe.6cf00000.3.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.file.exe.6cf1b000.4.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Detects zgRAT Author: ditekSHen

.NET source code contains very large array initializations

Source: file.exe, -Module-.cs	Large array initialization: _202D_206D_206E_202B_206D_206C_200F_206D_206E_200E_200B_206A_200D_206E_202C_200B_202D_202D_206A_202A_202C_206A_200C_206B_200E_206B_200D_202B_206E_206B_202D_200F_200E_206F_206B_206A_206D_206B_206F_202D_202E: array initializer size 54080
Source: 0.2.file.exe.6cf1b000.4.raw.unpack, Strings.cs	Large array initialization: Strings: array initializer size 6160

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF03950 WindowsHandle,GetConsoleWindow,ShowWindow,VirtualAlloc,CreateProcessW,NtGetContextThread,NtAllocateVirtualMemory,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtWriteVirtualMemory,NtWriteVirtualMemory,NtReadVirtualMemory,NtWriteVirtualMemory,NtWriteVirtualMemory,NtCreateThreadEx,NtSetContextThread,NtResumeThread,CloseHandle,CloseHandle,VirtualAlloc,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtCreateThreadEx,NtSetContextThread,NtResumeThread,		0_2_6CF03950
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF03250 GetModuleHandleW,NtQueryInformationProcess,		0_2_6CF03250

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF03950	0_2_6CF03950
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF03250	0_2_6CF03250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF01210	0_2_6CF01210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF13595	0_2_6CF13595
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF02690	0_2_6CF02690
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF07A40	0_2_6CF07A40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF03750	0_2_6CF03750
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02701464	0_2_02701464
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0270245C	0_2_0270245C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_027058E1	0_2_027058E1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02705C98	0_2_02705C98
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02705908	0_2_02705908
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02703B8D	0_2_02703B8D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02703830	0_2_02703830
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02703820	0_2_02703820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_027058F9	0_2_027058F9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_027008AC	0_2_027008AC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02704167	0_2_02704167
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02704B48	0_2_02704B48
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02702D00	0_2_02702D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00DD7660	2_2_00DD7660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00DD0878	2_2_00DD0878
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00DD0869	2_2_00DD0869
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00DD7652	2_2_00DD7652
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00DD7660	2_2_00DD7660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06EE3FF1	2_2_06EE3FF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06EE1BD8	2_2_06EE1BD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06EE3890	2_2_06EE3890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06EF8770	2_2_06EF8770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06EF9568	2_2_06EF9568
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06EF3E50	2_2_06EF3E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06EFAF30	2_2_06EFAF30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06EF6A20	2_2_06EF6A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06EF48B0	2_2_06EF48B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06EF5600	2_2_06EF5600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06EF9558	2_2_06EF9558
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06EFAF20	2_2_06EFAF20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06EFED23	2_2_06EFED23
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06EFED30	2_2_06EFED30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06EF6A10	2_2_06EF6A10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06EF48A3	2_2_06EF48A3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06FB34E0	2_2_06FB34E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06FB5568	2_2_06FB5568
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06FB0040	2_2_06FB0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06FBE1D8	2_2_06FBE1D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06FBC4F8	2_2_06FBC4F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06FBD060	2_2_06FBD060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06FBB037	2_2_06FBB037
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06FD9DD0	2_2_06FD9DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06FDDAE8	2_2_06FDDAE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06FD72A8	2_2_06FD72A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06FD1A18	2_2_06FD1A18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06FDB3F8	2_2_06FDB3F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06FD6BA0	2_2_06FD6BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06FD30D8	2_2_06FD30D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06FDDAD8	2_2_06FDDAD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06FD80C8	2_2_06FD80C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06FDB920	2_2_06FDB920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06FDB910	2_2_06FDB910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06FFD708	2_2_06FFD708
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06FF6A88	2_2_06FF6A88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06FF1E58	2_2_06FF1E58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06FF1E48	2_2_06FF1E48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06FF4CF0	2_2_06FF4CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06FF1260	2_2_06FF1260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06FF1250	2_2_06FF1250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06FF5218	2_2_06FF5218
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06FF5209	2_2_06FF5209
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06FF9BD0	2_2_06FF9BD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_073C57E8	2_2_073C57E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_073C2408	2_2_073C2408
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_073C7318	2_2_073C7318
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_073CA360	2_2_073CA360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_073CD2D8	2_2_073CD2D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_073C8100	2_2_073C8100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_073C0E60	2_2_073C0E60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_073C2ED0	2_2_073C2ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_073CAC18	2_2_073CAC18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_073CD928	2_2_073CD928
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_073C49F8	2_2_073C49F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_073C730B	2_2_073C730B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_073C80F0	2_2_073C80F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_073C49EB	2_2_073C49EB

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 6CF08AF0 appears 33 times

Source: file.exe, 00000000.00000002.1678394243.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe, 00000000.00000000.1659709452.0000000000392000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameChloeJackUlysses.YHH vs file.exe
Source: file.exe, 00000000.00000002.1683751341.000000006CFA7000.00000004.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameGristles.exe" vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameChloeJackUlysses.YHH vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.file.exe.6cf1b000.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 2.2.MSBuild.exe.b00000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.file.exe.6cf00000.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.file.exe.6cf1b000.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.file.exe.6cf1b000.4.raw.unpack, Strings.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.file.exe.6cf1b000.4.raw.unpack, Class4.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.file.exe.6cf1b000.4.raw.unpack, Class4.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/3@0/1

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Roaming\gdi32.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7060:120:WilError_03

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.file.exe.6cf1b000.4.raw.unpack, Class4.cs

.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: file.exe, -Module-.cs

.Net Code: _202E_202C_206D_202C_200F_202D_206D_206E_206E_200D_206C_202C_200E_206E_202B_202E_206E_202B_206D_202E_206A_202A_206F_202D_200D_202C_200E_206B_206A_202A_206F_202A_200F_206A_200C_200F_202B_206E_202C_202A_202E System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF13CC4 push ecx; ret	0_2_6CF13CD7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02704FF6 push 35C238BBh; iretd	0_2_02705002
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02703F9D push esp; retf	0_2_02703F9E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06EEFC7A pushfd ; ret	2_2_06EEFC81
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06EE6D31 push es; ret	2_2_06EE6D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06EF5458 pushad ; iretd	2_2_06EF5465
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06EF1E6F push eax; iretd	2_2_06EF1E89
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06FBF9B6 push es; iretd	2_2_06FBF9B4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06FBF938 push es; iretd	2_2_06FBF9B4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_06FD0951 push es; ret	2_2_06FD0960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_073C04A0 push A4071891h; ret	2_2_073C0695
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_073C0618 push A4071891h; ret	2_2_073C0695
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_073C0600 push A4071891h; ret	2_2_073C0695
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_073C06CF push A4071891h; ret	2_2_073C0695

Source: file.exe

Static PE information: section name: .text entropy: 7.831361955004328

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Roaming\gdi32.dll

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: \QEMU-GA.EXE

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 2510000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 2750000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 2510000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 4D80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 5D80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 5EB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 6EB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 7200000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 8200000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 9200000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: DD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2A20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 4A20000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 2077			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 7653			Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 6296	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2872	Thread sleep time: -36893488147419080s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3168	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe
Source: MSBuild.exe, 00000002.00000002.1770776237.00000000060A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_06FDE740 LdrLoadDll,

2_2_06FDE740

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CF0897A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CF0897A

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CF0E70B GetProcessHeap,

0_2_6CF0E70B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF084A1 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6CF084A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF0897A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CF0897A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF0C937 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CF0C937

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: B00000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: B00000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: B00000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: B02000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: B4E000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: BBA000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: B02000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: B4E000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: BBA000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 95B008	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CF08B38 cpuid

0_2_6CF08B38

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CF085C3 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6CF085C3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected Meduza Stealer

Source: Yara match

File source: Process Memory Space: MSBuild.exe PID: 6324, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.file.exe.6cf1b000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.b00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.6cf00000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.6cf1b000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1756178312.0000000000B02000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.file.exe.6cf1b000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.b00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.6cf00000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.6cf1b000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1756178312.0000000000B02000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6324, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: 0.2.file.exe.6cf1b000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.b00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.6cf00000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.6cf1b000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY

Found many strings related to Crypto-Wallets (likely being stolen)

Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: hieplnfojfccegoloniefimmbfjdgcgp\|Electrum
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ElectronCashE#
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: mhonjhhcgphdphdjcdoeodfdliikapmj\|Jaxx Liberty
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: idkppnahnmmggbmfkjhiakkbkdpnmnon\|Exodus
Source: MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: EthereumE#
Source: MSBuild.exe, 00000002.00000002.1770776237.0000000006104000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\*
Source: file.exe	String found in binary or memory: set_UseMachineKeyStore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior

Source: Yara match	File source: 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1757650129.0000000002AA6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6324, type: MEMORYSTR

Remote Access Functionality

Yara detected Meduza Stealer

Source: Yara match

File source: Process Memory Space: MSBuild.exe PID: 6324, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.file.exe.6cf1b000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.b00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.6cf00000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.6cf1b000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1756178312.0000000000B02000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.file.exe.6cf1b000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.b00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.6cf00000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.6cf1b000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1756178312.0000000000B02000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6324, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: 0.2.file.exe.6cf1b000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.b00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.6cf00000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.6cf1b000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	1 Masquerading	1 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	341 Security Software Discovery	Remote Desktop Protocol	3 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	1 Clipboard Data	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	311 Process Injection	NTDS	241 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	124 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	HEUR/AGEN.1311038
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\gdi32.dll	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	0%	URL Reputation	safe
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/sc	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/06/addressingex	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ	0%	URL Reputation	safe
http://www.w3.o	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	0%	URL Reputation	safe
http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2002/12/policy	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/dk	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue	0%	URL Reputation	safe

Name	Malicious	Antivirus Detection	Reputation
4.251.123.83:6677	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	MSBuild.exe, 00000002.00000002.1764728767.0000000003B81000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003B28000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003A4D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003BDA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003DAA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003E03000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	MSBuild.exe, 00000002.00000002.1764728767.0000000003B81000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003B28000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003A4D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003BDA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003DAA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003E03000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faulth	MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://discord.com/api/v9/users/	MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/example/Field1Response	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/example/Field1ResponseD	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	MSBuild.exe, 00000002.00000002.1757650129.0000000002AA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ip.sb/ip	MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	MSBuild.exe, 00000002.00000002.1764728767.0000000003B81000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003B28000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003A4D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003BDA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003DAA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003E03000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	MSBuild.exe, 00000002.00000002.1764728767.0000000003B81000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003B28000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003A4D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003BDA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003DAA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003E03000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/example/Field3ResponseD	MSBuild.exe, 00000002.00000002.1757650129.0000000002AA6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/example/Field1	MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/example/Field2	MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/example/Field3	MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	MSBuild.exe, 00000002.00000002.1764728767.0000000003B81000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003B28000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003A4D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003BDA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003DAA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003E03000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/D	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/06/addressingex	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	MSBuild.exe, 00000002.00000002.1764728767.0000000003B81000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003B28000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003A4D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003BDA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003DAA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003E03000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.w3.o	MSBuild.exe, 00000002.00000002.1757650129.0000000002D5D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/example/Field3Response	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1757650129.0000000002AA6000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	MSBuild.exe, 00000002.00000002.1764728767.0000000003B81000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003B28000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003A4D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003BDA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003DAA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1764728767.0000000003E03000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	MSBuild.exe, 00000002.00000002.1757650129.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2002/12/policy	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue	MSBuild.exe, 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
4.251.123.83	unknown	United States		3356	LEVEL3US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546038
Start date and time:	2024-10-31 12:06:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/3@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 106 Number of non-executed functions: 26
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
07:07:00	API Interceptor	47x Sleep call for process: MSBuild.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LEVEL3US	file.exe	Get hash	malicious	Stealc, Vidar	Browse	4.150.155.223
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	4.152.133.8
	W6Z9uSRsKQ.elf	Get hash	malicious	Unknown	Browse	207.123.91.118
	wZU2edEGL3.elf	Get hash	malicious	Unknown	Browse	9.94.32.251
	SuNMTBkfPo.elf	Get hash	malicious	Unknown	Browse	9.136.107.129
	8v2IShmMos.elf	Get hash	malicious	Unknown	Browse	4.177.198.213
	v6pwbOEUpl.elf	Get hash	malicious	Unknown	Browse	9.3.34.7
	j3Lr4Fk7Kb.elf	Get hash	malicious	Mirai	Browse	9.97.128.7
	belks.mips.elf	Get hash	malicious	Mirai	Browse	9.196.2.177
	belks.x86.elf	Get hash	malicious	Mirai	Browse	8.232.159.211

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2543
Entropy (8bit):	5.331950323785858
Encrypted:	false
SSDEEP:	48:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HDfHKdHKLBHK7HKmTHQmHKtXoDHsLHqH5J:Pq5qHwCYqh3oPtI6eqzxTqdqlq7qqjqI
MD5:	D1C706335BBF6ECA4BECB0CACD9231EB
SHA1:	AC27DA2AC6FEC7C7F24C9796CB7BCECD5EF8F382
SHA-256:	45449CD3FC0C10386A37510D13C883FEF94883D11D757FDD0FFE4EDAF0DAAD75
SHA-512:	D5A4D33B362C4EF19CD0E43F2F518258EE45A1A32DED992B851276DF3BC8A4559E7D1872B155E10DAF1FF6B38C65AF472AF429B8362EBBB12976B3454C1FE68B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Roaming\gdi32.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	855040
Entropy (8bit):	5.6181812603560655
Encrypted:	false
SSDEEP:	12288:UKRhdAJtGfliyDB6NcP/BzYhy7EVe6JVM926xir0l6G8tGxBFLs8HVTN3gLkW/Eb:UK5qk
MD5:	44CB7F156344FBA97C4C9DD485276C8A
SHA1:	B508628B9163E236D9EF1BA95868AE128ABB05CD
SHA-256:	0F2BA82668B74F28DDB7B95233EE21FE32BFB1BD3ADB0C5B2F34D3001443ED3C
SHA-512:	C79C538A0F6BC88017F3AAA5A551C8CE92B7E92786CCA5168BB5604F5B1AB9DE45B79681D06ADE2B10A7E002B7FE600FBE59991FA9B454999B5B207F88991F16
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........>3.._]]._]]._]].'^\._]].'X\._]].'Y\._]].'\\._]]..&]._]]._\]._]]..X\._]]..Y\._]]..^\._]]._]]._]]..]\._]].._\._]]Rich._]]........................PE..L....9#g...........!...&.0..........~........@...............................@............@.............................X...X...P............................ ......................................P...@............@..X............................text..../.......0.................. ..`.rdata..Bb...@...d...4..............@..@.data...tk.......b..................@....reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.8122854091440574
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	file.exe
File size:	271'360 bytes
MD5:	500904922500a6b286ebc7b6aa791e24
SHA1:	b09695e46e35a433dc00c41508b6ff47745247a7
SHA256:	8e08e9ad4ee4438acbb60b2922cf4578f93df6f4adcd01e1e8942a36bd5dc4d8
SHA512:	baa756bc44306c37774115fe0bd14f1e9735d25def4042a9035c8903e153aee3e1be8fcde286632609e96923256f8d69b0424ee0c30ab4a95de494462fc0e3e6
SSDEEP:	6144:QVZd5702Ameiqqv6Hrs3LI6VRPob7QEAI1AeOPvNb:+exmeiqrHrN6VuX5AeOPvNb
TLSH:	9D44BF9CB65476CFC86BC971CEA82C64EA61B877430F9247A06716ED990CA97CF011F3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....9#g.............................7... ...@....@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4437ae
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6723391E [Thu Oct 31 08:00:30 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4375c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x44000	0x6d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x46000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x417b4	0x41800	3f0024870ed7d584f059c6cbddf13d62	False	0.8963725548664122	data	7.831361955004328	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x44000	0x6d8	0x800	aaef290f02fed851a193f32434cc2dc0	False	0.38232421875	data	3.735234737511919	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x46000	0xc	0x200	8658c1b1f347026cd1e3e838036b5a8c	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x440a0	0x448	data			0.4324817518248175
RT_MANIFEST	0x444e8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-31T12:06:59.338810+0100	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	1	192.168.2.4	49730	4.251.123.83	6677	TCP
2024-10-31T12:06:59.992193+0100	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	4.251.123.83	6677	192.168.2.4	49730	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 12:06:58.312254906 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:06:58.317732096 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:06:58.317804098 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:06:58.332364082 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:06:58.337269068 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:06:59.306874037 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:06:59.338809967 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:06:59.343698978 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:06:59.696351051 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:06:59.736031055 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:06:59.740917921 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:06:59.991625071 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:06:59.991638899 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:06:59.991650105 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:06:59.991661072 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:06:59.991672039 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:06:59.991683960 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:06:59.991694927 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:06:59.991705894 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:06:59.991717100 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:06:59.991728067 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:06:59.991729975 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:06:59.991821051 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:06:59.991821051 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:06:59.992192984 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:06:59.992273092 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:06:59.992331028 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:06:59.996680975 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:00.037889004 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:00.110941887 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:00.110960007 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:00.110975027 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:00.111015081 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:00.111061096 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:00.111073017 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:00.111083031 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:00.111119986 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:00.111119986 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:00.111426115 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:00.162856102 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.304802895 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.309880018 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.309897900 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.309915066 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.309925079 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.309932947 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.309957981 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.309967041 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.309979916 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.310004950 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.310015917 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.310081005 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.310223103 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.310286999 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.314860106 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.314870119 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.314904928 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.314918995 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.314928055 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.314937115 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.314953089 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.314959049 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.314996958 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.315021992 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.315026045 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.315061092 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.315071106 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.315083027 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.315105915 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.315141916 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.315179110 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.315193892 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.315254927 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.319950104 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.319993019 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.320012093 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.320066929 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.320075989 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.320077896 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.320116997 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.320168972 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.320194006 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.320266008 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.320295095 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.320343018 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.320358038 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.320413113 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.320424080 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.320425987 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.320435047 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.320481062 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.320506096 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.320518017 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.320527077 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.320549965 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.320559978 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.320614100 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.320624113 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.320637941 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.320647001 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.320699930 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.320708990 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.320717096 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.320724964 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.320734978 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.320744038 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.320802927 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.324927092 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.324995041 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.325005054 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.325088024 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.325131893 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.325140953 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.325324059 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.325333118 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.325366020 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.325429916 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.325453043 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.325462103 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.325478077 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.325488091 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.325519085 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.325550079 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.325553894 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.325558901 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.325575113 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.325584888 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.325620890 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.325629950 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.325655937 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.325664997 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.325701952 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.325711012 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.325752974 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.325764894 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.325786114 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.325836897 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.325875044 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.325884104 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.325915098 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.325923920 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326062918 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326071978 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326081991 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326128960 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326138020 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326169014 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326205015 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326214075 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326221943 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326236963 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326246023 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326318979 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326327085 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326334953 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326343060 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326359034 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326368093 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326375961 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326385021 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326447964 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326456070 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326463938 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326472044 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326483011 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326492071 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326500893 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.326535940 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326545000 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326608896 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326618910 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326656103 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.326692104 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326700926 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326708078 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326716900 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326733112 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326741934 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326750994 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326760054 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326797009 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326806068 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326832056 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326839924 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.326874971 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.329801083 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.329847097 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.329895020 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.329905033 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.330135107 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.330224991 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.330233097 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.330266953 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.330388069 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.330473900 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.330524921 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.330558062 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.330612898 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.330621004 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.330630064 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.330645084 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.330684900 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.330718040 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.330728054 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.330765009 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.330800056 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.331058025 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.331196070 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.331463099 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.331471920 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.331480026 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.331502914 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.331511974 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.331569910 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.331578970 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.331643105 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.331650972 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.331657887 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.331667900 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.331799030 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.331808090 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.331820965 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.331830025 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.331845999 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.331854105 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.331867933 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.331938982 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.331947088 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.331955910 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.331965923 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.331979036 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.331995010 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.332004070 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.332012892 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.332029104 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.332037926 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.332045078 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.332082987 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.332091093 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.332098961 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.332108974 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.332169056 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.332178116 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.332185030 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.332222939 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.332231998 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.332238913 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.332273006 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.332282066 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.332288980 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.332319975 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.332329035 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.332335949 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.332350969 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.332360983 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.332370043 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.332376957 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.332389116 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.332391977 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.332396984 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.332463026 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.335966110 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.335982084 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336042881 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336050987 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336102009 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336111069 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336117983 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336133003 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336149931 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336159945 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336169004 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336198092 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336206913 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336215973 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336224079 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336240053 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336247921 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336256027 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336265087 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336293936 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336302996 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336309910 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336317062 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336332083 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336339951 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336349010 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336359024 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336420059 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336427927 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336436033 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336451054 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336460114 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336468935 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336488008 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.336505890 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336514950 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336524010 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336543083 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336551905 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336561918 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336572886 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336581945 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336595058 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.336607933 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336616993 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336654902 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336663008 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336672068 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336692095 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336699963 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336709023 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336736917 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336745977 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336783886 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.336792946 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.341470003 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.341478109 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.341526031 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.341535091 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.341569901 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.341578960 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.341588974 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.341604948 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.341690063 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.341698885 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.341706038 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.341715097 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.341732025 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.341741085 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.341756105 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.341763973 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.341814995 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.341824055 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.341836929 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.341871977 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.341881990 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.341906071 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.341914892 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.341926098 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.341969967 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.341978073 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.342010975 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.342020988 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.342027903 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.342036009 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.342058897 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.342068911 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.342102051 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.342154980 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.342164040 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.342171907 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.342189074 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.342197895 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.342231989 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.342241049 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.342281103 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.342293978 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.342348099 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.342392921 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.342442036 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.342506886 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.342515945 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.342557907 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.342566967 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.342573881 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.342591047 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.342600107 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.342653036 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.342662096 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.342670918 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.346827984 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.346837044 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.346890926 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.346899986 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.346908092 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.346915960 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.346925974 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.346935987 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.346952915 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.346961021 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.346988916 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.346997976 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347012997 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347022057 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347032070 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347040892 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347057104 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347064972 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347080946 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347090006 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347131014 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347141027 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347153902 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347162962 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347217083 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347229004 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347238064 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347248077 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347255945 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347273111 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347281933 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347290039 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347369909 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347379923 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347387075 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347394943 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347402096 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347402096 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.347409964 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347419024 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347435951 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347445011 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347455025 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347472906 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347482920 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347491980 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347503901 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347510099 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.347512960 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347523928 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347539902 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347548962 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347552061 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347569942 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.347578049 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352405071 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352413893 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352421999 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352431059 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352509022 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352519035 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352526903 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352535963 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352545023 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352554083 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352569103 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352576971 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352591991 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352601051 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352610111 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352618933 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352629900 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352638960 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352648020 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352657080 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352696896 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352705002 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352713108 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352721930 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352730989 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352740049 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352747917 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352763891 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352772951 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352790117 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352798939 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352813959 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352818012 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352864981 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.352876902 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352886915 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352894068 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352904081 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352919102 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352927923 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352936983 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352946997 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352956057 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352971077 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352987051 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.352989912 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.352997065 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.365987062 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.370781898 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.382971048 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.383111954 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.383112907 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.383218050 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.387897015 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.387908936 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.387936115 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.387945890 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.387994051 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.388003111 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.388070107 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.388078928 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.388093948 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.388102055 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.388117075 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.388127089 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.388164043 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.388211012 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.388266087 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.412858963 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.417808056 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.418004990 CET	49730	6677	192.168.2.4	4.251.123.83
Oct 31, 2024 12:07:02.422846079 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:02.422925949 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:06.168561935 CET	6677	49730	4.251.123.83	192.168.2.4
Oct 31, 2024 12:07:06.182425976 CET	49730	6677	192.168.2.4	4.251.123.83

Target ID:	0
Start time:	07:06:55
Start date:	31/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x390000
File size:	271'360 bytes
MD5 hash:	500904922500A6B286EBC7B6AA791E24
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: MALWARE_Win_zgRAT, Description: Detects zgRAT, Source: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:06:56
Start date:	31/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:06:56
Start date:	31/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x6a0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.1757650129.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000002.00000002.1756178312.0000000000B02000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.1756178312.0000000000B02000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.1757650129.0000000002AA6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	13.2%
Dynamic/Decrypted Code Coverage:	1.5%
Signature Coverage:	4.3%
Total number of Nodes:	1899
Total number of Limit Nodes:	8

Executed Functions

Function 6CF03950 Relevance: 67.1, APIs: 24, Strings: 12, Instructions: 4057nativememorythreadCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 6CF04D8D
CreateProcessW.KERNELBASE ref: 6CF05106
NtGetContextThread.NTDLL ref: 6CF0525C
NtAllocateVirtualMemory.NTDLL ref: 6CF0542E
NtAllocateVirtualMemory.NTDLL ref: 6CF05526
NtWriteVirtualMemory.NTDLL ref: 6CF05577
NtWriteVirtualMemory.NTDLL ref: 6CF058D1
NtWriteVirtualMemory.NTDLL ref: 6CF05BC8
NtReadVirtualMemory.NTDLL ref: 6CF0662D
NtWriteVirtualMemory.NTDLL ref: 6CF06777
NtWriteVirtualMemory.NTDLL ref: 6CF06AEB
NtCreateThreadEx.NTDLL ref: 6CF06DF5
CloseHandle.KERNEL32 ref: 6CF07286
CloseHandle.KERNEL32 ref: 6CF0729A
VirtualAlloc.KERNEL32 ref: 6CF07442
NtAllocateVirtualMemory.NTDLL ref: 6CF075B4
NtWriteVirtualMemory.NTDLL ref: 6CF07668
NtCreateThreadEx.NTDLL ref: 6CF07952
NtSetContextThread.NTDLL ref: 6CF079E6
NtResumeThread.NTDLL ref: 6CF07A04

Strings

)@\}, xrefs: 6CF06682
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 6CF04FF4, 6CF074ED
ntdll.dll, xrefs: 6CF04A00
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe, xrefs: 6CF05084
)@\}, xrefs: 6CF07820
uL<, xrefs: 6CF054AD
hqNknylUZCBDNGCDZ2RkZFettORkJGRBs4JDYyVk5KSUVbLH50HDKOZkpIEBKOZkpLLDJWTkpJxpnKC20CQgtvRpoRWyx6Eyw2MlZOSknFRVs8bog7QjweQDdEctD6SGo0, xrefs: 6CF0414E, 6CF0686E, 6CF07866
D, xrefs: 6CF0749C
kernel32.dll, xrefs: 6CF049EC
7=t, xrefs: 6CF05B22
o~c, xrefs: 6CF060E9
@, xrefs: 6CF075AC

Memory Dump Source

Source File: 00000000.00000002.1683690736.000000006CF01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF00000, based on PE: true

Associated: 00000000.00000002.1683674380.000000006CF00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683728835.000000006CF14000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF69000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CFA7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1684045603.000000006CFD2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf00000_file.jbxd

Yara matches

Similarity

API ID: Virtual$Memory$Write$Thread$AllocateCreate$AllocCloseContextHandle$ProcessReadResume
String ID: 7=t$)@\}$)@\}$@$C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe$D$hqNknylUZCBDNGCDZ2RkZFettORkJGRBs4JDYyVk5KSUVbLH50HDKOZkpIEBKOZkpLLDJWTkpJxpnKC20CQgtvRpoRWyx6Eyw2MlZOSknFRVs8bog7QjweQDdEctD6SGo0$kernel32.dll$ntdll.dll$o~c$uL<
API String ID: 2838827027-2109832365
Opcode ID: 95ff1c05e9c7f756c59facf96d3d025535dc8cd2a1a0622112a8ad49bc82d44f
Instruction ID: e6f5b924c09248dba1b9f4e9ab175b09b984836cb32894c52de22bde4cbe8e53
Opcode Fuzzy Hash: 95ff1c05e9c7f756c59facf96d3d025535dc8cd2a1a0622112a8ad49bc82d44f
Instruction Fuzzy Hash: 2A73E076B04654CFCB18CE2CC9E57CA7BF2AB8A315F108199E409EB760D6359E89DF40

Function 6CF01210 Relevance: 45.1, APIs: 18, Strings: 7, Instructions: 1311
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 6CF018E4
K32GetModuleInformation.KERNEL32 ref: 6CF01A4C
GetModuleFileNameA.KERNEL32 ref: 6CF01A7C
CreateFileA.KERNELBASE ref: 6CF01AC0
CreateFileMappingA.KERNEL32 ref: 6CF01BB6
MapViewOfFile.KERNELBASE ref: 6CF01FBD
VirtualProtect.KERNELBASE ref: 6CF0221B
VirtualProtect.KERNELBASE ref: 6CF022C6
CloseHandle.KERNELBASE ref: 6CF02423
CloseHandle.KERNEL32 ref: 6CF02434
CloseHandle.KERNEL32 ref: 6CF024AC
GetCurrentProcess.KERNEL32 ref: 6CF02536
CreateFileMappingA.KERNEL32 ref: 6CF02593
CloseHandle.KERNEL32 ref: 6CF025DF

Strings

n^<j, xrefs: 6CF02676
B>j, xrefs: 6CF01B68
@, xrefs: 6CF0220F
B>j, xrefs: 6CF01C26
.text, xrefs: 6CF0218C
n^<j, xrefs: 6CF0248D
0x:, xrefs: 6CF01AF1

Memory Dump Source

Source File: 00000000.00000002.1683690736.000000006CF01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF00000, based on PE: true

Associated: 00000000.00000002.1683674380.000000006CF00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683728835.000000006CF14000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF69000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CFA7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1684045603.000000006CFD2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf00000_file.jbxd

Yara matches

Similarity

API ID: FileHandle$Close$CreateModule$MappingProtectVirtual$CurrentInformationNameProcessView
String ID: .text$0x:$@$B>j$B>j$n^<j$n^<j
API String ID: 1334470580-1042743706
Opcode ID: 44943460dedd2ae7c49eb2fb90fef77c64762d29f461de15c19c80b545039ebe
Instruction ID: ce26b82a9cdc39210c837e059a7a10a755700033c06a29e8d97c58ae7d81b78a
Opcode Fuzzy Hash: 44943460dedd2ae7c49eb2fb90fef77c64762d29f461de15c19c80b545039ebe
Instruction Fuzzy Hash: 47B2EB76B042158FCB04CF7CC8A93DEBBF1AB46714F108699E409DB792D6369988EF41

Function 6CF03250 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 346
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,?), ref: 6CF033EF

Strings

NtQueryInformationProcess, xrefs: 6CF033F7
s!4, xrefs: 6CF0363A
ntdll.dll, xrefs: 6CF033E3

Memory Dump Source

Source File: 00000000.00000002.1683690736.000000006CF01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF00000, based on PE: true

Associated: 00000000.00000002.1683674380.000000006CF00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683728835.000000006CF14000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF69000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CFA7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1684045603.000000006CFD2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf00000_file.jbxd

Yara matches

Similarity

API ID: HandleModule
String ID: NtQueryInformationProcess$ntdll.dll$s!4
API String ID: 4139908857-1094640038
Opcode ID: c6ff037493a0dee1b9194b2de5dda0fc66b50168cf6cf261069d924ffeac59b4
Instruction ID: 1d1453e6037b3e5b4898827a639da626f966c61a69d141f3f244e3d31c49f65b
Opcode Fuzzy Hash: c6ff037493a0dee1b9194b2de5dda0fc66b50168cf6cf261069d924ffeac59b4
Instruction Fuzzy Hash: 02C1DF76B14245CFCB04CEBCD9E5BDEBBF1AB46728F218119E810EBB50C735A9499B01

Function 027008AC Relevance: 2.8, Strings: 2, Instructions: 295
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 02701195
Te^q, xrefs: 02701055

Memory Dump Source

Source File: 00000000.00000002.1678731648.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2700000_file.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: d76d287e1c91526bc86b23b4787ad0cc1799e821f4bdb84b4300c8caefda9572
Instruction ID: 162690f9dbd91ba28e98dbf3af57cf40d91344c740ceb0d5ef10f2a5d25f934f
Opcode Fuzzy Hash: d76d287e1c91526bc86b23b4787ad0cc1799e821f4bdb84b4300c8caefda9572
Instruction Fuzzy Hash: 38B10830A04285CFC709CB74C4D9A9AFBF2BF8B354F15849AD045AB2B6C734A94DDB51

Function 02703B8D Relevance: 1.5, Strings: 1, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 027041FE

Memory Dump Source

Source File: 00000000.00000002.1678731648.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2700000_file.jbxd

Similarity

API ID:
String ID: $^q
API String ID: 0-388095546
Opcode ID: 3393a71e2a9f2f5f51e054f8a5a423b0df22f3542826901f53b7db99d39ff761
Instruction ID: 9129afa5e546ca6be781066b8c2758162b99686cd8f996402f49c9abdce31541
Opcode Fuzzy Hash: 3393a71e2a9f2f5f51e054f8a5a423b0df22f3542826901f53b7db99d39ff761
Instruction Fuzzy Hash: 59813A31B04244DFC7199B3588F475A7BF3AFEA244B14849AC251FB2E9DA30DC4E8751

Function 0270245C Relevance: 1.4, Strings: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

cM%, xrefs: 027024F8

Memory Dump Source

Source File: 00000000.00000002.1678731648.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2700000_file.jbxd

Similarity

API ID:
String ID: cM%
API String ID: 0-1864208640
Opcode ID: bf3e2f84ab07ab75d7ad4b2193c030c48f22c7ee000bc2ed7b767d1081e4ca22
Instruction ID: 20a925c68058398d46529e923fbedac4f6fe526a6ccb45080c82623d0ecf091c
Opcode Fuzzy Hash: bf3e2f84ab07ab75d7ad4b2193c030c48f22c7ee000bc2ed7b767d1081e4ca22
Instruction Fuzzy Hash: 6C71B233618211CFC305CF64C5D8429F7E5BB4A3007A29996D902EF6E2CB34ED99CB96

Function 02705C98 Relevance: 1.4, Strings: 1, Instructions: 153
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 02705CC6

Memory Dump Source

Source File: 00000000.00000002.1678731648.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2700000_file.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 5259748a9ee6c38e52e446e04c7925c7b42970d10081f10afe18cba038a24649
Instruction ID: 930b4d200060f9d2a44024dbffd57f870a0c96e8e9a77e2fc70131729cd8dad1
Opcode Fuzzy Hash: 5259748a9ee6c38e52e446e04c7925c7b42970d10081f10afe18cba038a24649
Instruction Fuzzy Hash: 1451D335B24215CFCB44CB68D9D9A9EBBF1BB88710B614866E402EB3A1CB35DD04CF81

Function 02704167 Relevance: 1.4, Strings: 1, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 027041FE

Memory Dump Source

Source File: 00000000.00000002.1678731648.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2700000_file.jbxd

Similarity

API ID:
String ID: $^q
API String ID: 0-388095546
Opcode ID: a58dc6bad1c67f9213ca49c3812cd3ce1519a53fbec8613569c4d084fdcf5461
Instruction ID: a1525dc67a3ca8bde0b4ec45cb9e4f59f8bb2a9f6ccd079e8d6ce8307521f58f
Opcode Fuzzy Hash: a58dc6bad1c67f9213ca49c3812cd3ce1519a53fbec8613569c4d084fdcf5461
Instruction Fuzzy Hash: 09411631B443458FC754DB7988A4B6B7AF7ABC9200B14886AD106EB3E5DE34DC098792

Function 02705908 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1678731648.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2700000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1c6f2eb5ad3aa9a8ad51fbd9b5ad793ed0e936255e1d68967d7a186988b8278
Instruction ID: 1dace1294b7d0fa3434204b6fc18fd215a7f8145afe6fe93f6fc40c5181aa2ef
Opcode Fuzzy Hash: c1c6f2eb5ad3aa9a8ad51fbd9b5ad793ed0e936255e1d68967d7a186988b8278
Instruction Fuzzy Hash: DD410431F64206CB87049B7999C512EBBE6BB8926079184379406FB2E0DB34CD4ECF92

Function 027058F9 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1678731648.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2700000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c473523b6f21c4a767ee6ac3b35ed9dcd28940ff65fd2a475476d65ef3d5e421
Instruction ID: 50248c96365d8ebfc1d799268ab84acdcc1946ce35bb0a24d4a08d572dabd367
Opcode Fuzzy Hash: c473523b6f21c4a767ee6ac3b35ed9dcd28940ff65fd2a475476d65ef3d5e421
Instruction Fuzzy Hash: BB41F231E28206CBC7449B7599D516ABBF5BB8A260792442B8406FB2E0DB34CD4ECF52

Function 027058E1 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1678731648.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2700000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97672cd403cc894026b3d299cb0a1353dbf6b7f274f0de05520a673b0ce0b372
Instruction ID: 6dff0c2372a0a6393d201a4090a33b53243511b40ba1d24f32e94baef653f29c
Opcode Fuzzy Hash: 97672cd403cc894026b3d299cb0a1353dbf6b7f274f0de05520a673b0ce0b372
Instruction Fuzzy Hash: 31413831F28206CBC7089B75D9D513ABBF5BB8A26079254278442FB2E0DB24CD4ECF42

Function 02701464 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1678731648.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2700000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1a3a88fbad692c34ec30262be6d16c7fa0626ec92e7631354b47b10806ec2d7
Instruction ID: 43e924c4b1418a01f918f3abdfde759253bdc614f35ed6db4f33bc2a7ae8e44c
Opcode Fuzzy Hash: b1a3a88fbad692c34ec30262be6d16c7fa0626ec92e7631354b47b10806ec2d7
Instruction Fuzzy Hash: 29310631B08215CFC704CAA5D9D127EBBE6ABC8300B558567F44AEB2A1D634CE15CB50

Function 6CF08298 Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6CF082DF
___scrt_uninitialize_crt.LIBCMT ref: 6CF082F9

Memory Dump Source

Source File: 00000000.00000002.1683690736.000000006CF01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF00000, based on PE: true

Associated: 00000000.00000002.1683674380.000000006CF00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683728835.000000006CF14000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF69000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CFA7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1684045603.000000006CFD2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf00000_file.jbxd

Yara matches

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: a23a8b3ba139f5ff24682dd03cbe4d6d0bb56a3bace0041928a63ba19e8aa692
Instruction ID: 96346bbb5ad38200ab0f8984aecd7e038a801b9677b0db727ca30421bf75b585
Opcode Fuzzy Hash: a23a8b3ba139f5ff24682dd03cbe4d6d0bb56a3bace0041928a63ba19e8aa692
Instruction Fuzzy Hash: B441A272F05624EFDB218F69C850B9E7B75EF81FA9F21811BE81567B40C7708905ABA0

Function 6CF08348 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 6CF08385
dllmain_crt_dispatch.LIBCMT ref: 6CF0839C
dllmain_raw.LIBCMT ref: 6CF083E4
dllmain_crt_dispatch.LIBCMT ref: 6CF083F7
dllmain_raw.LIBCMT ref: 6CF0840A

Memory Dump Source

Source File: 00000000.00000002.1683690736.000000006CF01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF00000, based on PE: true

Associated: 00000000.00000002.1683674380.000000006CF00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683728835.000000006CF14000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF69000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CFA7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1684045603.000000006CFD2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf00000_file.jbxd

Yara matches

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 966b261325569abd9401bc0c7dfe32806b553b8d39193f441af943d41af43d3e
Instruction ID: d690e8c25ab11b54cc87c6aa809df0b96a39950c8bebabef416ca8f09e8ff633
Opcode Fuzzy Hash: 966b261325569abd9401bc0c7dfe32806b553b8d39193f441af943d41af43d3e
Instruction Fuzzy Hash: 00217F72F01625EBDB218F55CD50AAF3B69EB81E98B11811BF81567B10C3308D01ABA0

Function 6CF08191 Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6CF081DE

Part of subcall function 6CF0865B: InitializeSListHead.KERNEL32(6CFD1430,6CF081E8,6CF19450,00000010,6CF08179,?,?,?,6CF083A1,?,00000001,?,?,00000001,?,6CF19498), ref: 6CF08660

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6CF08248

Memory Dump Source

Source File: 00000000.00000002.1683690736.000000006CF01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF00000, based on PE: true

Associated: 00000000.00000002.1683674380.000000006CF00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683728835.000000006CF14000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF69000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CFA7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1684045603.000000006CFD2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf00000_file.jbxd

Yara matches

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: 8f7eea875d67ccb7ca5991508bad4fbe5bce549ff70ef00e55b85f2402b10479
Instruction ID: 9b25dc17a1c2b8684a49564e4efe0616c6d650fb2c08785a1a9ac77a79c0ae0e
Opcode Fuzzy Hash: 8f7eea875d67ccb7ca5991508bad4fbe5bce549ff70ef00e55b85f2402b10479
Instruction Fuzzy Hash: 4A21D131B49A41AADF11ABB494207DD3B709B53F7DF120417C88127EC2CB624448F666

Function 6CF0E7DC Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 6CF0E828
GetFileType.KERNELBASE(00000000), ref: 6CF0E83A

Memory Dump Source

Source File: 00000000.00000002.1683690736.000000006CF01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF00000, based on PE: true

Associated: 00000000.00000002.1683674380.000000006CF00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683728835.000000006CF14000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF69000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CFA7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1684045603.000000006CFD2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf00000_file.jbxd

Yara matches

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: d8b26688d68915b06a9729c0634f2033f673aad7a6b348196f98c2f9ee9c472e
Instruction ID: 3e286214ed3dc2517750f1f011b2ef8ec0822e9113d556e09a2b6d74d0e75603
Opcode Fuzzy Hash: d8b26688d68915b06a9729c0634f2033f673aad7a6b348196f98c2f9ee9c472e
Instruction Fuzzy Hash: 6F118172B047514AC7304E3E8CA87127AE4BB97A78B340B5ED0F686DF1D630E485A6D5

Function 0270537C Relevance: 1.6, APIs: 1, Instructions: 56
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(00000000), ref: 02706230

Memory Dump Source

Source File: 00000000.00000002.1678731648.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2700000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 735a634169b3197ee9cb8874de1765f89ce8ea61a7d36e47568cd76491ab835b
Instruction ID: 38905b8bdee7e5b243787d0cf270971880f24bdbc20348e5f192031d7031ec99
Opcode Fuzzy Hash: 735a634169b3197ee9cb8874de1765f89ce8ea61a7d36e47568cd76491ab835b
Instruction Fuzzy Hash: 1D2133B1D00659DBCB10CF9AC584A9EFBF8FB48320F10812AE818B7344C374A954CFA4

Function 027061B9 Relevance: 1.6, APIs: 1, Instructions: 56
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(00000000), ref: 02706230

Memory Dump Source

Source File: 00000000.00000002.1678731648.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2700000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 36615e19ecbcecc383bd89d7f7c06fdebf6451ab8e3b8a8d7a29a4938913aa46
Instruction ID: d0d9fc7ebc45ef879dd2946b29ff82545e6073f0754a916686fa3b132d504f02
Opcode Fuzzy Hash: 36615e19ecbcecc383bd89d7f7c06fdebf6451ab8e3b8a8d7a29a4938913aa46
Instruction Fuzzy Hash: 902124B5D00659CFCB10CFAAD584A9EFBF4FB48320F14826AD819B7254C374A944CFA5

Function 02705364 Relevance: 1.3, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000,?,?,?,?,00000000,?,00000000,?,027059F7), ref: 027065AF

Memory Dump Source

Source File: 00000000.00000002.1678731648.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2700000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: dae378dd9cd63d8aa043a1a88f7aa61605685f5e130867658516b1cc0e336f79
Instruction ID: 5e56bce1f382e40723eef8b90f4d257938dd9eaef2af074bcf5a7150f7f3654a
Opcode Fuzzy Hash: dae378dd9cd63d8aa043a1a88f7aa61605685f5e130867658516b1cc0e336f79
Instruction Fuzzy Hash: F41158B1800359CFCB20DF9AC4847DEBBF4EB48320F208469D658A7354D778A944CFA4

Function 02706549 Relevance: 1.3, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000,?,?,?,?,00000000,?,00000000,?,027059F7), ref: 027065AF

Memory Dump Source

Source File: 00000000.00000002.1678731648.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2700000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: b3ea271bbcc4cf847a2df4565c2da8dc52e1ea8479fa358952815d91cec67de4
Instruction ID: 05bd25f98b619638ce2cd0260593e5ee1d9d854599b7c5191a1f8db852d714c5
Opcode Fuzzy Hash: b3ea271bbcc4cf847a2df4565c2da8dc52e1ea8479fa358952815d91cec67de4
Instruction Fuzzy Hash: 471163B6900259CFDB10CF99C1847DEFBF0EF48324F25846AC558A7295C778A944CFA4

Non-executed Functions

Function 6CF0897A Relevance: 6.1, APIs: 4, Instructions: 70COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,00000000), ref: 6CF08986
IsDebuggerPresent.KERNEL32 ref: 6CF08A52
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6CF08A6B
UnhandledExceptionFilter.KERNEL32(?), ref: 6CF08A75

Memory Dump Source

Source File: 00000000.00000002.1683690736.000000006CF01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF00000, based on PE: true

Associated: 00000000.00000002.1683674380.000000006CF00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683728835.000000006CF14000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF69000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CFA7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1684045603.000000006CFD2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf00000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 04d2f0014bea10fff87d25d8b39f4fbcae080bd3283530f041c6940612734378
Instruction ID: 0b6aef02f217a5a1d82b4b4b695671aaa270a84fe08439bf575ea0485966d7b9
Opcode Fuzzy Hash: 04d2f0014bea10fff87d25d8b39f4fbcae080bd3283530f041c6940612734378
Instruction Fuzzy Hash: 5C3125B5E01318DBDF61DFA5D8497CDBBB8AF08704F1041AAE40CAB640EB709A84DF55

Function 6CF02690 Relevance: 4.6, Strings: 3, Instructions: 828COMMON

Download Yara Rule

Strings

H{ri, xrefs: 6CF03213
H{ri, xrefs: 6CF02E4D
6(r, xrefs: 6CF02D0D

Memory Dump Source

Source File: 00000000.00000002.1683690736.000000006CF01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF00000, based on PE: true

Associated: 00000000.00000002.1683674380.000000006CF00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683728835.000000006CF14000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF69000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CFA7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1684045603.000000006CFD2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf00000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 6(r$H{ri$H{ri
API String ID: 0-4259995277
Opcode ID: 38c287d779489e53af8452fe314d2d80cf626801caf536d6a255c6e4f1f89f9f
Instruction ID: 0719aaa987a850bf7b62d33ec4504aa73a19d42be72fa6d0978429c0ea4b6855
Opcode Fuzzy Hash: 38c287d779489e53af8452fe314d2d80cf626801caf536d6a255c6e4f1f89f9f
Instruction Fuzzy Hash: C552F237B453058FCB04CEBCC6A47DE7BF2AB46724F20951AD814EB7A8D2369949DB10

Function 6CF0C937 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 6CF0CA2F
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 6CF0CA39
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 6CF0CA46

Memory Dump Source

Source File: 00000000.00000002.1683690736.000000006CF01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF00000, based on PE: true

Associated: 00000000.00000002.1683674380.000000006CF00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683728835.000000006CF14000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF69000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CFA7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1684045603.000000006CFD2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf00000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 7aa826e095b657acb88b698f64f8b3f964b95554c85a1c3f0d27ab6f7beb1224
Instruction ID: 0ab447142239436fc80f4c3e735a3e86dac0118bb0e607f076243ec672cabfb1
Opcode Fuzzy Hash: 7aa826e095b657acb88b698f64f8b3f964b95554c85a1c3f0d27ab6f7beb1224
Instruction Fuzzy Hash: A231E574A11218ABCF21DF25D8897CCBBB8BF08714F5042DAE41CA7250EB709F859F55

Function 6CF07A40 Relevance: 3.0, Strings: 2, Instructions: 485COMMONLIBRARYCODE

Download Yara Rule

Strings

NuRE, xrefs: 6CF07CE7
NuRE, xrefs: 6CF080FE

Memory Dump Source

Source File: 00000000.00000002.1683690736.000000006CF01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF00000, based on PE: true

Associated: 00000000.00000002.1683674380.000000006CF00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683728835.000000006CF14000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF69000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CFA7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1684045603.000000006CFD2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf00000_file.jbxd

Yara matches

Similarity

API ID:
String ID: NuRE$NuRE
API String ID: 0-1824372278
Opcode ID: 355cba62beeda8138c1756e8d9f1fa872ba3202e217889d991a433356c8e6cfc
Instruction ID: 5937478ace55f0653c3e952680dc491f46a8c5ad8fc57e7c7d1c263866fe11e0
Opcode Fuzzy Hash: 355cba62beeda8138c1756e8d9f1fa872ba3202e217889d991a433356c8e6cfc
Instruction Fuzzy Hash: 19F11372B45205CFCF04CEBCE4A47DE7FF2AB4A724F20A11BE411EBB94C62999459B50

Function 6CF13595 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,6CF13590,?,?,00000008,?,?,6CF13193,00000000), ref: 6CF137C2

Memory Dump Source

Source File: 00000000.00000002.1683690736.000000006CF01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF00000, based on PE: true

Associated: 00000000.00000002.1683674380.000000006CF00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683728835.000000006CF14000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF69000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CFA7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1684045603.000000006CFD2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf00000_file.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: ae3c1b484a009dbc7600e39fd2876c8a577e58948346f8dfcb88ccc3a5129062
Instruction ID: b832bb75160d6113d4e816d92bc0160cf028945260c4db227f5a5a96aa5d7fda
Opcode Fuzzy Hash: ae3c1b484a009dbc7600e39fd2876c8a577e58948346f8dfcb88ccc3a5129062
Instruction Fuzzy Hash: 84B14A72618608DFD705CF28C486B557BE0FF45368F25869CE8A9CFAA1C335E999CB40

Function 6CF08B38 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6CF08B4E

Memory Dump Source

Source File: 00000000.00000002.1683690736.000000006CF01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF00000, based on PE: true

Associated: 00000000.00000002.1683674380.000000006CF00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683728835.000000006CF14000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF69000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CFA7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1684045603.000000006CFD2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf00000_file.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 6eaecf96dda365cda942448cd05f7cf170e70b9c69da5c77c33919f62f2cc31f
Instruction ID: 8fcb648e3d2f70dc755e767924224e9d2b54d8b79c1ab26a312f31c89139c340
Opcode Fuzzy Hash: 6eaecf96dda365cda942448cd05f7cf170e70b9c69da5c77c33919f62f2cc31f
Instruction Fuzzy Hash: ED5179B1F222458BEB05CF64C8957AEBBF0FB4A718F24826AC411EB645D774E940CF90

Function 02703820 Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

z9, xrefs: 027038AF

Memory Dump Source

Source File: 00000000.00000002.1678731648.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2700000_file.jbxd

Similarity

API ID:
String ID: z9
API String ID: 0-90298862
Opcode ID: 25be93cb7537ad3e1a23a9f8c946d5ad2cabfdfa1a3f62999f6f2686b539376a
Instruction ID: 3f415cc127219a62df39f692084df9884be431adad59a0825009eb006546ab22
Opcode Fuzzy Hash: 25be93cb7537ad3e1a23a9f8c946d5ad2cabfdfa1a3f62999f6f2686b539376a
Instruction Fuzzy Hash: 7141B535F2425ACFCB40CB59C9C656EFBF5AB88204B1581ABE505EB3D1C234D905CBA5

Function 02703830 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

z9, xrefs: 027038AF

Memory Dump Source

Source File: 00000000.00000002.1678731648.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2700000_file.jbxd

Similarity

API ID:
String ID: z9
API String ID: 0-90298862
Opcode ID: 1380e296f27a7bbbd864d2cc6af202da468b5dc03a716b2ccef2f3ead24f8513
Instruction ID: 4d436939a0a6fdcc8507c89987eb2037dbe248d0d865d6bd0dc65c2133cc729e
Opcode Fuzzy Hash: 1380e296f27a7bbbd864d2cc6af202da468b5dc03a716b2ccef2f3ead24f8513
Instruction Fuzzy Hash: 6841A035F2025ACB8B44CE59C9C696EFBF5BB88600B1581ABE509FB391C234DD05CBA5

Function 02702D00 Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

w Gr, xrefs: 02702D9F

Memory Dump Source

Source File: 00000000.00000002.1678731648.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2700000_file.jbxd

Similarity

API ID:
String ID: w Gr
API String ID: 0-4006791179
Opcode ID: 920e64d591e4c76226246a01bb96d2aadfc8efaeab61b721d0058836d9e0f300
Instruction ID: 3604d747ada5dcbc12d54e96ae68e5566ce4c3ea13454f3b082fc464290d6051
Opcode Fuzzy Hash: 920e64d591e4c76226246a01bb96d2aadfc8efaeab61b721d0058836d9e0f300
Instruction Fuzzy Hash: E241D532604706CFC754CB6AD8C9A6AB7F6FF85310B00C82AD46ADBA65D234ED48CF41

Function 6CF0E70B Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 6CF0E70B

Memory Dump Source

Source File: 00000000.00000002.1683690736.000000006CF01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF00000, based on PE: true

Associated: 00000000.00000002.1683674380.000000006CF00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683728835.000000006CF14000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF69000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CFA7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1684045603.000000006CFD2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf00000_file.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 276445313ba5e9fb5b3f88b4137e6ab2f3666fdd7153ae4fe751c136120992ee
Instruction ID: dede987cd5ce631b6f99cc8b3b74c62d5b79c7d22727dbfe0e92a9e7d7ae9275
Opcode Fuzzy Hash: 276445313ba5e9fb5b3f88b4137e6ab2f3666fdd7153ae4fe751c136120992ee
Instruction Fuzzy Hash: A7A01130B202028B8B888E32820A30C3BFABAA32A0302C028A000C2200EB208080AF00

Function 02704B48 Relevance: .4, Instructions: 425COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1678731648.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2700000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa5f6deb17974c19bab1d0799858b93363f200b3d0f96928c19113ddfa8c2691
Instruction ID: fe7cfadc255df512e68d9609fe2fe0243dbe47aa05444f958d20d053c98c7b0f
Opcode Fuzzy Hash: fa5f6deb17974c19bab1d0799858b93363f200b3d0f96928c19113ddfa8c2691
Instruction Fuzzy Hash: E3F1A170B14115CBCB08CF69C5E5A6FFBE6AFC9204B14856AE116EB3A5C770ED49CB80

Function 6CF03750 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1683690736.000000006CF01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF00000, based on PE: true

Associated: 00000000.00000002.1683674380.000000006CF00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683728835.000000006CF14000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF69000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CFA7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1684045603.000000006CFD2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf00000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cfb3b7495a84274a64a25da1ddd9ecbc248c61e551b46d1c0c38cfe4fe9910e
Instruction ID: a96317ae8505730de4ce7435ba61a6482a30ebf308841d943f5f0f559c5fe8c9
Opcode Fuzzy Hash: 1cfb3b7495a84274a64a25da1ddd9ecbc248c61e551b46d1c0c38cfe4fe9910e
Instruction Fuzzy Hash: 22518FB6B141069FCB04CEBCC995AEFBBF2AB46330F248316A924E77D4D235D6058A44

Function 6CF0A3CA Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 6CF0A4E9
___TypeMatch.LIBVCRUNTIME ref: 6CF0A5F7
_UnwindNestedFrames.LIBCMT ref: 6CF0A749
CallUnexpected.LIBVCRUNTIME ref: 6CF0A764

Strings

csm, xrefs: 6CF0A520
csm, xrefs: 6CF0A407
csm, xrefs: 6CF0A474

Memory Dump Source

Source File: 00000000.00000002.1683690736.000000006CF01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF00000, based on PE: true

Associated: 00000000.00000002.1683674380.000000006CF00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683728835.000000006CF14000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF69000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CFA7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1684045603.000000006CFD2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf00000_file.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: d1b23a8a309e533de8f745e82cec9f7797b432f5c574a03ef7a876071106aa31
Instruction ID: 76beab775faeeeea818b67b8474881e55ed04f1effb3f075281da19f4758bede
Opcode Fuzzy Hash: d1b23a8a309e533de8f745e82cec9f7797b432f5c574a03ef7a876071106aa31
Instruction Fuzzy Hash: C8B19A75A00209DFCF15CFA4C8A09DEB7F4BF04B18F14865AE8116BA11E731DA65EF91

Function 6CF09470 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6CF094A7
___except_validate_context_record.LIBVCRUNTIME ref: 6CF094AF
_ValidateLocalCookies.LIBCMT ref: 6CF09538
__IsNonwritableInCurrentImage.LIBCMT ref: 6CF09563
_ValidateLocalCookies.LIBCMT ref: 6CF095B8

Strings

csm, xrefs: 6CF0954D

Memory Dump Source

Source File: 00000000.00000002.1683690736.000000006CF01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF00000, based on PE: true

Associated: 00000000.00000002.1683674380.000000006CF00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683728835.000000006CF14000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF69000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CFA7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1684045603.000000006CFD2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf00000_file.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: fdaf5b5815deb890f2d1b9a25d01a0c5a851ba19435a01411b923c19ff2ac303
Instruction ID: 936ffc4970d9021f948ca4e8278d9584c592f12349c0467816a15a3c8613e3a9
Opcode Fuzzy Hash: fdaf5b5815deb890f2d1b9a25d01a0c5a851ba19435a01411b923c19ff2ac303
Instruction Fuzzy Hash: B3418334B011489BCF00CF6AC890AAEBBF5AF4571CF148159E814ABB91EB31EB55DF90

Function 6CF0E33A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,6CF0E449,00000000,6CF0BC50,00000000,00000000,00000001,?,6CF0E5C2,00000022,FlsSetValue,6CF15688,6CF15690,00000000), ref: 6CF0E3FB

Strings

api-ms-, xrefs: 6CF0E391
ext-ms-, xrefs: 6CF0E3A5

Memory Dump Source

Source File: 00000000.00000002.1683690736.000000006CF01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF00000, based on PE: true

Associated: 00000000.00000002.1683674380.000000006CF00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683728835.000000006CF14000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF69000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CFA7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1684045603.000000006CFD2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf00000_file.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 4fceb045b114311e6ea3895dfd54ee384c05e54623c5462effcba0eb4cb0bbe7
Instruction ID: 101a10d722124e4de8a1a99fb1724dee70913b6762b095da36ca05f631aeb427
Opcode Fuzzy Hash: 4fceb045b114311e6ea3895dfd54ee384c05e54623c5462effcba0eb4cb0bbe7
Instruction Fuzzy Hash: 3B21EB36F05211ABDB119B668C51B4B3FB9DB42B68B360224E991A7B80D730E900D6D0

Function 6CF09A1C Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6CF09651,6CF08750,6CF08169,?,6CF083A1,?,00000001,?,?,00000001,?,6CF19498,0000000C,6CF0849A), ref: 6CF09A2A
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6CF09A38
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6CF09A51
SetLastError.KERNEL32(00000000,6CF083A1,?,00000001,?,?,00000001,?,6CF19498,0000000C,6CF0849A,?,00000001,?), ref: 6CF09AA3

Memory Dump Source

Source File: 00000000.00000002.1683690736.000000006CF01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF00000, based on PE: true

Associated: 00000000.00000002.1683674380.000000006CF00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683728835.000000006CF14000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF69000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CFA7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1684045603.000000006CFD2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf00000_file.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: b3dc0795e2633667ec09071b07a53b9c0410e13269a352c69417754c5fca15d2
Instruction ID: 03eacf4364a084b796fc523166faa8256d859e3ed0bb6fb697b9e12888051a5d
Opcode Fuzzy Hash: b3dc0795e2633667ec09071b07a53b9c0410e13269a352c69417754c5fca15d2
Instruction Fuzzy Hash: E9012832B2D31A6EAA583677AC6268B37E4DB03F3C7210329F520819D0FF9149457680

Function 6CF0D56E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\file.exe, xrefs: 6CF0D58A

Memory Dump Source

Source File: 00000000.00000002.1683690736.000000006CF01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF00000, based on PE: true

Associated: 00000000.00000002.1683674380.000000006CF00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683728835.000000006CF14000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF69000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CFA7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1684045603.000000006CFD2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf00000_file.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\file.exe
API String ID: 0-1957095476
Opcode ID: b74de6b61fbc95879a9defea282f23ab5ae37cd7df5b658ad6ca90fbe9d9ebff
Instruction ID: 5e12ab5f140234508119005997ce0ed052c579105d96281c3ab535bc3ad5c73e
Opcode Fuzzy Hash: b74de6b61fbc95879a9defea282f23ab5ae37cd7df5b658ad6ca90fbe9d9ebff
Instruction Fuzzy Hash: 9C21A171704605AFCB00AF76C9609AB77BDEF45B6CB054619F918D7A40E730E844ABA0

Function 6CF0B57E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,F83B1210,00000000,?,00000000,6CF13E92,000000FF,?,6CF0B518,?,?,6CF0B4EC,?), ref: 6CF0B5B3
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6CF0B5C5
FreeLibrary.KERNEL32(00000000,?,00000000,6CF13E92,000000FF,?,6CF0B518,?,?,6CF0B4EC,?), ref: 6CF0B5E7

Strings

CorExitProcess, xrefs: 6CF0B5BD
mscoree.dll, xrefs: 6CF0B5AC

Memory Dump Source

Source File: 00000000.00000002.1683690736.000000006CF01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF00000, based on PE: true

Associated: 00000000.00000002.1683674380.000000006CF00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683728835.000000006CF14000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF69000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CFA7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1684045603.000000006CFD2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf00000_file.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 6ceab43f38912770c6af0fce7aa7d98f087777cc1419b081cd58f850bd217540
Instruction ID: 7f1381d27dce725b175789b33f73d2f07ed27a1ceb18cfab4293f1e39248eefd
Opcode Fuzzy Hash: 6ceab43f38912770c6af0fce7aa7d98f087777cc1419b081cd58f850bd217540
Instruction Fuzzy Hash: A701A231A14659EFDF018F50CC0ABAEBBB9FB45B18F014A25E821A2E80DB759900CB90

Function 6CF0FFF8 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 6CF1007D
__alloca_probe_16.LIBCMT ref: 6CF10146
__freea.LIBCMT ref: 6CF101AD

Part of subcall function 6CF0F19A: HeapAlloc.KERNEL32(00000000,6CF0DAE7,6CF0EEB4,?,6CF0DAE7,00000220,?,?,6CF0EEB4), ref: 6CF0F1CC

__freea.LIBCMT ref: 6CF101C0
__freea.LIBCMT ref: 6CF101CD

Memory Dump Source

Source File: 00000000.00000002.1683690736.000000006CF01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF00000, based on PE: true

Associated: 00000000.00000002.1683674380.000000006CF00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683728835.000000006CF14000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF69000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CFA7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1684045603.000000006CFD2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf00000_file.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 76e078582097d9fac8e94b241b762f0b0274ab22d57a802990204a8ac4a85e8a
Instruction ID: 9e889e2a573f34e85ec717522008831c82a6c386a5863d8d718ccf67d6eaf2eb
Opcode Fuzzy Hash: 76e078582097d9fac8e94b241b762f0b0274ab22d57a802990204a8ac4a85e8a
Instruction Fuzzy Hash: D651E672605286BFEB014F64CC40EBB3BB9DF45728F260528FD15E6E40E7B9DC2496A0

Function 6CF09FF2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,6CF09FA3,00000000,?,00000001,?,?,?,6CF0A092,00000001,FlsFree,6CF14D60,FlsFree), ref: 6CF09FFF
GetLastError.KERNEL32(?,6CF09FA3,00000000,?,00000001,?,?,?,6CF0A092,00000001,FlsFree,6CF14D60,FlsFree,00000000,?,6CF09AF1), ref: 6CF0A009
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 6CF0A031

Strings

api-ms-, xrefs: 6CF0A016

Memory Dump Source

Source File: 00000000.00000002.1683690736.000000006CF01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF00000, based on PE: true

Associated: 00000000.00000002.1683674380.000000006CF00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683728835.000000006CF14000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF69000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CFA7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1684045603.000000006CFD2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf00000_file.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 920945012c73b77440f90c3b3f4dccaee9031395d57adecc47b9dc517265cff7
Instruction ID: deb2c05ed5c527aa2a8279cd1567e57dda30c6f16efbb5d4fbdce3367eb301c7
Opcode Fuzzy Hash: 920945012c73b77440f90c3b3f4dccaee9031395d57adecc47b9dc517265cff7
Instruction Fuzzy Hash: 4EE04F31B54208BBEF101F62DE16B493EBD9B41F8CF120430FA0DE8C91E7A29510A585

Function 6CF10705 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(F83B1210,00000000,00000000,?), ref: 6CF10768

Part of subcall function 6CF0E13C: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6CF101A3,?,00000000,-00000008), ref: 6CF0E19D

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6CF109BA
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6CF10A00
GetLastError.KERNEL32 ref: 6CF10AA3

Memory Dump Source

Source File: 00000000.00000002.1683690736.000000006CF01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF00000, based on PE: true

Associated: 00000000.00000002.1683674380.000000006CF00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683728835.000000006CF14000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF69000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CFA7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1684045603.000000006CFD2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf00000_file.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: f1d3968801181f2a79af461d3063352c577c147575c188c6dbc8b7fbb2867e1b
Instruction ID: 78e676ab11912eee2543a4f9f52ab9217dd35dc41f86ad6572c71db12b2f94cc
Opcode Fuzzy Hash: f1d3968801181f2a79af461d3063352c577c147575c188c6dbc8b7fbb2867e1b
Instruction Fuzzy Hash: CCD17875E08288DFCB04CFA8C880ADDBBF4EF49314F24856AE465EBB41D670A956CB50

Function 6CF0A173 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6CF0A23A
___AdjustPointer.LIBCMT ref: 6CF0A25D
___AdjustPointer.LIBCMT ref: 6CF0A2F9

Memory Dump Source

Source File: 00000000.00000002.1683690736.000000006CF01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF00000, based on PE: true

Associated: 00000000.00000002.1683674380.000000006CF00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683728835.000000006CF14000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF69000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CFA7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1684045603.000000006CFD2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf00000_file.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 5e6d88c2697f2a09f84c19f5453bfddd9a589195b05734cb9782df5c1d8c4297
Instruction ID: 8fe64e26c1f053f7795a373dfa8064a9935501d9a1999ff9e6c498da5821a962
Opcode Fuzzy Hash: 5e6d88c2697f2a09f84c19f5453bfddd9a589195b05734cb9782df5c1d8c4297
Instruction Fuzzy Hash: 1151E2727066029FEB198F50D860BAAB3F5FF41B18F20453DEC1547A91E732E980EB90

Function 6CF0CD88 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 6CF0E13C: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6CF101A3,?,00000000,-00000008), ref: 6CF0E19D

GetLastError.KERNEL32 ref: 6CF0CDEC
__dosmaperr.LIBCMT ref: 6CF0CDF3
GetLastError.KERNEL32(?,?,?,?), ref: 6CF0CE2D
__dosmaperr.LIBCMT ref: 6CF0CE34

Memory Dump Source

Source File: 00000000.00000002.1683690736.000000006CF01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF00000, based on PE: true

Associated: 00000000.00000002.1683674380.000000006CF00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683728835.000000006CF14000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF69000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CFA7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1684045603.000000006CFD2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf00000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: f44b0c6541d5ae78111dad413c62fef685585b329059db4600cdf72a9e8f9f18
Instruction ID: cdd80a9b593190fdf23406825e6b928544a4b2120c709b45415d75c3ea6596db
Opcode Fuzzy Hash: f44b0c6541d5ae78111dad413c62fef685585b329059db4600cdf72a9e8f9f18
Instruction Fuzzy Hash: B321C571704216AFDB00AF6AC8A099BB7BDFF45B687148529F91597A40D730EC40B7B2

Function 6CF0E1DF Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6CF0E1E7

Part of subcall function 6CF0E13C: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6CF101A3,?,00000000,-00000008), ref: 6CF0E19D

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6CF0E21F
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6CF0E23F

Memory Dump Source

Source File: 00000000.00000002.1683690736.000000006CF01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF00000, based on PE: true

Associated: 00000000.00000002.1683674380.000000006CF00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683728835.000000006CF14000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF69000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CFA7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1684045603.000000006CFD2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf00000_file.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: b9be225750468ec39885ced8febd0e72e4e68176fb3800421782292242b911ca
Instruction ID: f01391b573d0f215e0803637d560ae3c461ad57133d3ba9c07d9424dd167396f
Opcode Fuzzy Hash: b9be225750468ec39885ced8febd0e72e4e68176fb3800421782292242b911ca
Instruction Fuzzy Hash: 3E1108B2F051157F6A1527758CA9DAF7E6CDF96AAC7060524F440A2600EB20CD08A1F1

Function 6CF12086 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,6CF11839,00000000,00000001,00000000,?,?,6CF10AF7,?,00000000,00000000), ref: 6CF1209D
GetLastError.KERNEL32(?,6CF11839,00000000,00000001,00000000,?,?,6CF10AF7,?,00000000,00000000,?,?,?,6CF1109A,00000000), ref: 6CF120A9

Part of subcall function 6CF1206F: CloseHandle.KERNEL32(FFFFFFFE,6CF120B9,?,6CF11839,00000000,00000001,00000000,?,?,6CF10AF7,?,00000000,00000000,?,?), ref: 6CF1207F

___initconout.LIBCMT ref: 6CF120B9

Part of subcall function 6CF12031: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6CF12060,6CF11826,?,?,6CF10AF7,?,00000000,00000000,?), ref: 6CF12044

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,6CF11839,00000000,00000001,00000000,?,?,6CF10AF7,?,00000000,00000000,?), ref: 6CF120CE

Memory Dump Source

Source File: 00000000.00000002.1683690736.000000006CF01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF00000, based on PE: true

Associated: 00000000.00000002.1683674380.000000006CF00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683728835.000000006CF14000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF69000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CFA7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1684045603.000000006CFD2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf00000_file.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: a596310f4718463027b1274faec7421988c682c28e405f655f6ee2639bd8f608
Instruction ID: bf2be371bff60d9518dc5caf331fa46bb31bf9e6b428d6d259fefbccad54585d
Opcode Fuzzy Hash: a596310f4718463027b1274faec7421988c682c28e405f655f6ee2639bd8f608
Instruction Fuzzy Hash: 4AF01236914158BFCF521FE2CC0CA893F76FB4A3B4B054110FA1895914C6338860DB90

Function 6CF0A76F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 6CF0A794

Strings

MOC, xrefs: 6CF0A7A6
RCC, xrefs: 6CF0A7AE

Memory Dump Source

Source File: 00000000.00000002.1683690736.000000006CF01000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF00000, based on PE: true

Associated: 00000000.00000002.1683674380.000000006CF00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683728835.000000006CF14000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF1B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CF69000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1683751341.000000006CFA7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1684045603.000000006CFD2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf00000_file.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: fa1fc903f2b1dafd2558d39448dbd3fbfc6d08220fd3e57dffe11b266d898ad3
Instruction ID: f425cd70821f22b7736849fb97ce4c56c91e49788d1c4a6c69ffe3c36b2d88e7
Opcode Fuzzy Hash: fa1fc903f2b1dafd2558d39448dbd3fbfc6d08220fd3e57dffe11b266d898ad3
Instruction Fuzzy Hash: 2A415971A00209AFCF06CF94CC90AEEBBF5FF48708F248199EA14A7610D7359A52EB50

Analysis Process: MSBuild.exePID: 6324, Parent PID: 7032COMMON

Execution Graph

Execution Coverage:	16.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0.8%
Total number of Nodes:	355
Total number of Limit Nodes:	26

Executed Functions

Function 06FDE740 Relevance: 1.6, APIs: 1, Instructions: 59libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(?,?,?,?), ref: 06FDE7BD

Memory Dump Source

Source File: 00000002.00000002.1774043787.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fd0000_MSBuild.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 12ba6e6efbc659ef21aa346408487da55264bc6b130b68ee7fad1a9dd4b3ced0
Instruction ID: 1a9c063d8728cf5a324d6b079910fe28b87d2a564ae87b2597dc27b631cc64cc
Opcode Fuzzy Hash: 12ba6e6efbc659ef21aa346408487da55264bc6b130b68ee7fad1a9dd4b3ced0
Instruction Fuzzy Hash: 9A21E2B1D003589FCB10DFAAC884ADEFBF5FF48320F14842AE959A7250C775A944CBA5

Function 06EE3FF1 Relevance: .6, Instructions: 642COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 410e440bf6dc3a2809ecd14ef26aae57f4037667cfd0ad0198f1c32bfa594971
Instruction ID: 63189515785496efd7183856ae6a82798f87f181bdd7563bf1cfc4b1d11f61b3
Opcode Fuzzy Hash: 410e440bf6dc3a2809ecd14ef26aae57f4037667cfd0ad0198f1c32bfa594971
Instruction Fuzzy Hash: B5426A70A01341CFC795DF68C594AAEBBF2AF89304F149469E546DB3A5DB30EC85CBA0

Function 06EE3890 Relevance: .5, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e305f8ab8cb94d42920c703987746f65260c71284ce27625a38009437899ffb7
Instruction ID: 30561cc14a752a7b566b513c5b2ba3fe47e94b07e2f04748d546171589136449
Opcode Fuzzy Hash: e305f8ab8cb94d42920c703987746f65260c71284ce27625a38009437899ffb7
Instruction Fuzzy Hash: 62124C74A003058FC745DF69C584AAABBF2FF89314B19D499E449DB366CB30ED85CBA0

Function 06EE1BD8 Relevance: .4, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408c63482987bd60a6a699f42374389db9c835c578f043570aa17def11c842cc
Instruction ID: 86ffb7f241c060967540a4ceba59b0491420b874dcb18b2490f2316281ea7d11
Opcode Fuzzy Hash: 408c63482987bd60a6a699f42374389db9c835c578f043570aa17def11c842cc
Instruction Fuzzy Hash: 2E027A34A00704CFDBA5CFA9C584AAABBF2FF88304F149569E456DB761DB34E981CB40

Function 073C949C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 117
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,?,?,?,?,00000001,00000004), ref: 073C95B3

Strings

4L^q, xrefs: 073C955B

Memory Dump Source

Source File: 00000002.00000002.1775279190.00000000073C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_73c0000_MSBuild.jbxd

Similarity

API ID: CreateFile
String ID: 4L^q
API String ID: 823142352-616035646
Opcode ID: 6355b8581493ca7f3e6d1ae71a9a65fe031449a8b6ccdc9f6c6d8034c9e3db29
Instruction ID: 94ddc221e709c0876e4aae00fd7e736deb0115ea67eb5e6fc201cb3b0c4d1597
Opcode Fuzzy Hash: 6355b8581493ca7f3e6d1ae71a9a65fe031449a8b6ccdc9f6c6d8034c9e3db29
Instruction Fuzzy Hash: 284134B0D102599FEB10CFA9C844B9EBFF5FF08310F15802AE859AB251DB75A855CF81

Function 073C94A8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 110
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,?,?,?,?,00000001,00000004), ref: 073C95B3

Strings

4L^q, xrefs: 073C955B

Memory Dump Source

Source File: 00000002.00000002.1775279190.00000000073C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_73c0000_MSBuild.jbxd

Similarity

API ID: CreateFile
String ID: 4L^q
API String ID: 823142352-616035646
Opcode ID: 765bbacd933b2748bc7a2ba101d6f07803590baa2562ce849cfa1b755c260b41
Instruction ID: f0dd1526825fbdc94e87cbdae8b0ca199c5a4ffb9dfbdb56393da159fc49c6ab
Opcode Fuzzy Hash: 765bbacd933b2748bc7a2ba101d6f07803590baa2562ce849cfa1b755c260b41
Instruction Fuzzy Hash: B64144B0D10259DFEB10CFA9C844B9EBFF5BF48314F158029E819AB290CB79A845CF81

Function 06EE89A0 Relevance: 3.4, Instructions: 3443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7aa4c1865d69b98fc7612df905b7aa830e2b64b04d0c912b965633fbb45f365f
Instruction ID: 74c90da6d4b953128ecca35b272a26b7d332263789dcae0e24696b4f60bf09d6
Opcode Fuzzy Hash: 7aa4c1865d69b98fc7612df905b7aa830e2b64b04d0c912b965633fbb45f365f
Instruction Fuzzy Hash: BF635C70E402189FEB659F64CC95B9EBA73EB88700F104099E60A7B3D1CF725E849F65

Function 06EE6EC0 Relevance: 2.6, Strings: 2, Instructions: 116COMMON

Download Yara Rule

Strings

(bq, xrefs: 06EE6FBB
(bq, xrefs: 06EE6F8F

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID: (bq$(bq
API String ID: 0-4224401849
Opcode ID: 92080cb444f7e49f085117bb31c5cdd1a6b7a3e232920a4878a0c2b044b5f29f
Instruction ID: 4f5f7c66f3691dd6280bfb01b35eca3fc9c814e78dd4aab91578812a224e76a5
Opcode Fuzzy Hash: 92080cb444f7e49f085117bb31c5cdd1a6b7a3e232920a4878a0c2b044b5f29f
Instruction Fuzzy Hash: 1841BE30A007058FDB54DF29D81566EBBF2EF88255B20856ED006E77A1DF359D06CBE0

Function 00DDC5D9 Relevance: 1.7, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00DDC83E

Memory Dump Source

Source File: 00000002.00000002.1756961392.0000000000DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_dd0000_MSBuild.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 83f0f480cfe0db9f4458e77637bec1ddb691f11c6d1f796c9cc7c5e112c91352
Instruction ID: 12da65a3c7d36fc08d92423e3cb71ba26dd30e84bf8b81f819b784fdad11be84
Opcode Fuzzy Hash: 83f0f480cfe0db9f4458e77637bec1ddb691f11c6d1f796c9cc7c5e112c91352
Instruction Fuzzy Hash: D18133B0A10B068FD724DF29D541B5ABBF5FF48304F149A2AD08A97B50DB74E846CBA0

Function 06EE5698 Relevance: 1.6, Strings: 1, Instructions: 360COMMON

Download Yara Rule

Strings

Hb_q, xrefs: 06EE56FB

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID: Hb_q
API String ID: 0-781627569
Opcode ID: 41824c7d6e8c2bdccfc3ec7ea7eb9cb076f7edf20cfe2171e9f65eea0b3b6759
Instruction ID: 2ed775da6ef7869936a40f7fb1ef80ce787bd51ac449ba457012ebc848a56fcf
Opcode Fuzzy Hash: 41824c7d6e8c2bdccfc3ec7ea7eb9cb076f7edf20cfe2171e9f65eea0b3b6759
Instruction Fuzzy Hash: 7AE17074A00205DFCB45CF68D5849AEBBF2FF48314F1585A9E4099B362DB31ED85CBA0

Function 00DD5F7D Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00DD6039

Memory Dump Source

Source File: 00000002.00000002.1756961392.0000000000DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_dd0000_MSBuild.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b2cc14a81e7ebe497cff3a82f414346d9b5351de60b411f450eb257e5d0018f3
Instruction ID: c29a5398815d991170151afce1e32bd4808dac647c1776ac248f0a7d066d1bd7
Opcode Fuzzy Hash: b2cc14a81e7ebe497cff3a82f414346d9b5351de60b411f450eb257e5d0018f3
Instruction Fuzzy Hash: 6141C3B0C00619DFDB24CFA9C884BDEBBF5BF49304F24806AD408AB255DB766945CF91

Function 00DD48A0 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00DD6039

Memory Dump Source

Source File: 00000002.00000002.1756961392.0000000000DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_dd0000_MSBuild.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 87aafb0a0346aad65cd25f5e75e27ddcf9c716b995c721f999bde920141a45c4
Instruction ID: 048446bc7c6225aa423a7b3239f5e3bc2029ea9accb8ccf10436b74ff29d4c0c
Opcode Fuzzy Hash: 87aafb0a0346aad65cd25f5e75e27ddcf9c716b995c721f999bde920141a45c4
Instruction Fuzzy Hash: 5141D4B0C0071DCFDB24DFA9C84479EBBB5BF49304F2480AAD408AB255DB75A945CF90

Function 073CBA25 Relevance: 1.6, APIs: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,?,?,?), ref: 073CBAD9

Memory Dump Source

Source File: 00000002.00000002.1775279190.00000000073C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_73c0000_MSBuild.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: bdbd2be609ce1f61c51f5702d24f9c6311733c5c087519658d15b60771f90915
Instruction ID: c8215fd0cb8a9704a3bfec794c6984eeb57f8d4398fa1912d10d9dd05980cfdc
Opcode Fuzzy Hash: bdbd2be609ce1f61c51f5702d24f9c6311733c5c087519658d15b60771f90915
Instruction Fuzzy Hash: 443144B1D002599FDB14CFA9C581ADEFBF5EF48310F24802AE849AB254DB749D45CF94

Function 073CBA30 Relevance: 1.6, APIs: 1, Instructions: 82fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,?,?,?), ref: 073CBAD9

Memory Dump Source

Source File: 00000002.00000002.1775279190.00000000073C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_73c0000_MSBuild.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 75e2eb4dd2af6bfd1501e30ae5cbbf709e640250abb44bf3ad497150bfa65b99
Instruction ID: c15895dcd4f8bc49873c979c6283d1003eb48845d2f726917d77d0bc69aa7eae
Opcode Fuzzy Hash: 75e2eb4dd2af6bfd1501e30ae5cbbf709e640250abb44bf3ad497150bfa65b99
Instruction Fuzzy Hash: C63113B0D002599FDB14CFA9C581ADEFBF5AF48310F24802AE449AB254DB759945CF94

Function 06EF158C Relevance: 1.6, APIs: 1, Instructions: 79comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 06EF1620

Memory Dump Source

Source File: 00000002.00000002.1773757668.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ef0000_MSBuild.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: af97f90af43f1699a785ec9fc67b0c8a4b47855c0fe5aa845fa94820cc58122e
Instruction ID: 723ae72a7ae463fc2155733345815513f2306cc1c980cc85ac1fc0c6e1f4d4de
Opcode Fuzzy Hash: af97f90af43f1699a785ec9fc67b0c8a4b47855c0fe5aa845fa94820cc58122e
Instruction Fuzzy Hash: 6631F2B0D11348DFDB10CF99C984BCEBBF5AF48304F248059E504AB294DB75A945CFA5

Function 06EF1598 Relevance: 1.6, APIs: 1, Instructions: 71comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 06EF1620

Memory Dump Source

Source File: 00000002.00000002.1773757668.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ef0000_MSBuild.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: df394cc7db50146754050755b80b1b523993724446193bed0adf228a7a2d557f
Instruction ID: ca737f1d33f5d2cb0c0fc9eddef87d593e3929a7d34c4f199f23198425d247e8
Opcode Fuzzy Hash: df394cc7db50146754050755b80b1b523993724446193bed0adf228a7a2d557f
Instruction Fuzzy Hash: 483100B0E11348DFDB10CF99C984BCDBBF5AF48304F248059E504AB290DB75A945CFA5

Function 00DDD370 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00DDEE96,?,?,?,?,?), ref: 00DDEF57

Memory Dump Source

Source File: 00000002.00000002.1756961392.0000000000DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_dd0000_MSBuild.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4370b70d7b347563c24645a93bb3e64a35891d29d50eef2750c2dfa33dc1e083
Instruction ID: 2cbc1f0da10f499da00fafe60180d7957d5e71afb8872bd788456667ef901334
Opcode Fuzzy Hash: 4370b70d7b347563c24645a93bb3e64a35891d29d50eef2750c2dfa33dc1e083
Instruction Fuzzy Hash: 2F21E5B59003589FDB10DFAAD584ADEBBF9EB48310F14841AE958A7310D375A940CFA4

Function 00DDEEC8 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00DDEE96,?,?,?,?,?), ref: 00DDEF57

Memory Dump Source

Source File: 00000002.00000002.1756961392.0000000000DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_dd0000_MSBuild.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0212f59a20e8f73438184414b66871bc1286b958c16a36cf7dfdba0ab4d2f57d
Instruction ID: 5741d6a4f7d56688e67fd1044dbe0d39bb41bca8b7fafe873434fc0fb6b9e50f
Opcode Fuzzy Hash: 0212f59a20e8f73438184414b66871bc1286b958c16a36cf7dfdba0ab4d2f57d
Instruction Fuzzy Hash: F721E3B5900258DFDB10DFAAD984ADEBBF8FB48310F14841AE918A7350D379A940CFA4

Function 06FDE738 Relevance: 1.6, APIs: 1, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(?,?,?,?), ref: 06FDE7BD

Memory Dump Source

Source File: 00000002.00000002.1774043787.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fd0000_MSBuild.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 69ba39424a093eec043d2d590108013de6b99a026125afc053a64d455795851d
Instruction ID: 338440708338aeae9a122ca5fb29ce281aa7690bd545d1fde9465732ab664502
Opcode Fuzzy Hash: 69ba39424a093eec043d2d590108013de6b99a026125afc053a64d455795851d
Instruction Fuzzy Hash: 652139B1D002589FCB10DFA9C884ADEFBF5FF48310F10842AE459A7210C7759544CFA0

Function 06FB8DA9 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000), ref: 06FB8E16

Memory Dump Source

Source File: 00000002.00000002.1773926591.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fb0000_MSBuild.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4d64a792e77167832d5e8c198a1614be7c0a5ca555532a0050de05cad72ebdb2
Instruction ID: 4e79d2f894d00c967e9587c7a5fef0c567fbfd07232e5912dc85c00d5194bf61
Opcode Fuzzy Hash: 4d64a792e77167832d5e8c198a1614be7c0a5ca555532a0050de05cad72ebdb2
Instruction Fuzzy Hash: 971123B2D003498FDB10DFAAC444ADEFBF9EF88320F10842AD469A7210C375A545CFA5

Function 06FB8DB0 Relevance: 1.6, APIs: 1, Instructions: 50libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000), ref: 06FB8E16

Memory Dump Source

Source File: 00000002.00000002.1773926591.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fb0000_MSBuild.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 0aa508cb598e65bbfa62ca6c95b1b4b42f4b699d65cedf3cb03180bdadb9c262
Instruction ID: fd1dc8278b8a4b460a71f590177cbe3fdbe793e32056c1e15dd84174226785c2
Opcode Fuzzy Hash: 0aa508cb598e65bbfa62ca6c95b1b4b42f4b699d65cedf3cb03180bdadb9c262
Instruction Fuzzy Hash: 3511F3B5D002598BDB10DF9AC444ADEFBF9EF88310F14842AD429A7610C375A545CFA5

Function 06FFC074 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06FFCAB5

Memory Dump Source

Source File: 00000002.00000002.1774147918.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ff0000_MSBuild.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: a62f5e9feefc11d08499e26fc7db43c82d5377d39cae596dc928a71f9050a4eb
Instruction ID: 7749066b264fe9b16edda96feda0a2045c5662ed4c385f60119d6cced1dfab5b
Opcode Fuzzy Hash: a62f5e9feefc11d08499e26fc7db43c82d5377d39cae596dc928a71f9050a4eb
Instruction Fuzzy Hash: F31106B5900358DFDB10DF99D844BDFBBF8EB48310F108459E555A7610C375A944CFA1

Function 00DDC7D8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00DDC83E

Memory Dump Source

Source File: 00000002.00000002.1756961392.0000000000DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_dd0000_MSBuild.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 64322bb1c669c39d99349eebc22fa3f07d024ad553cae539bc74638220519598
Instruction ID: 0e576935c6d3d21e42cb402dfb5f9f30573a0e4dabb46287c3cec71595463e81
Opcode Fuzzy Hash: 64322bb1c669c39d99349eebc22fa3f07d024ad553cae539bc74638220519598
Instruction Fuzzy Hash: A2110FB5D002498FDB10CF9AC444ADEFBF8AB88324F14842AD819A7710C379A545CFA1

Function 06FFCA53 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06FFCAB5

Memory Dump Source

Source File: 00000002.00000002.1774147918.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ff0000_MSBuild.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 60ceb135acdf268195fae14a4d607cc5254a2dbe23150408c1e7963a15dbf3a8
Instruction ID: bdc3c5671a24a35301a868c27d68005d565d7fb219c44d334842a69573433b97
Opcode Fuzzy Hash: 60ceb135acdf268195fae14a4d607cc5254a2dbe23150408c1e7963a15dbf3a8
Instruction Fuzzy Hash: 591110B5900259CFDB10CF99C888BDEBBF8EB48310F10841AE559A3610C379A584CFA0

Function 06EF0548 Relevance: 1.5, APIs: 1, Instructions: 44comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32 ref: 06EF05A5

Memory Dump Source

Source File: 00000002.00000002.1773757668.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ef0000_MSBuild.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 86eb20e0d7e3f7ba994cab8a7a36c56a28314462929ef6312fe5024e9546bb17
Instruction ID: aa8f7f7aa1d462753cc33a0e71c764885bd9b845602b39a559a7b8786da71b22
Opcode Fuzzy Hash: 86eb20e0d7e3f7ba994cab8a7a36c56a28314462929ef6312fe5024e9546bb17
Instruction Fuzzy Hash: CC1130B0900349CFDB20CFA9D889BCEBBF4EB48324F20845AD559A7650C3B9A540CFA4

Function 06EF0550 Relevance: 1.5, APIs: 1, Instructions: 43comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32 ref: 06EF05A5

Memory Dump Source

Source File: 00000002.00000002.1773757668.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ef0000_MSBuild.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 23111b7a7f29f7c5d08a4240bb0bdcc3cc022866f8a1d9223f0fd7d3d782783c
Instruction ID: d53ce9a1283d1643577361941f80db62ee8f0b76159e35ab3065a07a5a68f729
Opcode Fuzzy Hash: 23111b7a7f29f7c5d08a4240bb0bdcc3cc022866f8a1d9223f0fd7d3d782783c
Instruction Fuzzy Hash: 2A1123B1910348CFDB20DF9AC848BCEFBF8EB48324F208419D558A7610C379A544CFA5

Function 06EE3E48 Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

@, xrefs: 06EE3FB2

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: ede06426c3392697fe85452cdfc83daaf5af56577c989b0f5d37b50fc6b4ef3b
Instruction ID: 07e8e7b308832d7645cd3bdb8c496ad818b71a569c56ef18813f15e05e6fe9de
Opcode Fuzzy Hash: ede06426c3392697fe85452cdfc83daaf5af56577c989b0f5d37b50fc6b4ef3b
Instruction Fuzzy Hash: 3C517B71E002199FDB55CFA8C884AEEBBF1FF48314F24806AE915AB251D734DE54CBA0

Function 06EE6659 Relevance: 1.4, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06EE66E4

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 4e0ff889973b20f216b2592516df766c50adab73f8330379e94af0f016572ff8
Instruction ID: eec9d1cff21d138cb995e06e2973f387d278b47a9e73580517be5ec579ae06da
Opcode Fuzzy Hash: 4e0ff889973b20f216b2592516df766c50adab73f8330379e94af0f016572ff8
Instruction Fuzzy Hash: 2951C3B5A00345DFC745DF28C58099ABBF2FF88314B1589A9D459CB366DB30ED89CBA0

Function 06EE3E37 Relevance: 1.3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

@, xrefs: 06EE3E7A

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 617f26ebcf8ec7bf1ec61acd47b96a03679553b44303f96a1bfb8fc23b826663
Instruction ID: bcea093077ce309d72f4a9628954aef449b6d213d3b6a6a99b285e91d5311d47
Opcode Fuzzy Hash: 617f26ebcf8ec7bf1ec61acd47b96a03679553b44303f96a1bfb8fc23b826663
Instruction Fuzzy Hash: 8521BF72A012199FCB15CFA5C984AEFBFB5FF48314B14816AF544DB221E734DA45CBA0

Function 06EE31D8 Relevance: .5, Instructions: 460COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a98961a7fdb288c86d2a9d83c37262e3b226bab9054d7bc8345493404848aaaa
Instruction ID: 7927d844ebe4a4f23ad27946e1015485337219665f2f0ccd611d8507fd519001
Opcode Fuzzy Hash: a98961a7fdb288c86d2a9d83c37262e3b226bab9054d7bc8345493404848aaaa
Instruction Fuzzy Hash: 5D123574A00705CFCB65CF69D98496AFBF2FF48304B159A69D4468B761DB30EC86CB90

Function 06EE4D10 Relevance: .4, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49b0a62a9030eb82dcaeba5e10457c585aac1e9ebf60e332210577d1eb81def3
Instruction ID: 9b9b5beea37c8195a0421314ea95b8c8a981ad5995a74d824c83ed21fe64d01c
Opcode Fuzzy Hash: 49b0a62a9030eb82dcaeba5e10457c585aac1e9ebf60e332210577d1eb81def3
Instruction Fuzzy Hash: B3121870A01318DFCB55DF64D844A9DBBF2BF49309F1090A9E80AAB265DB31DD85CF51

Function 06EE0040 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87c749d60571553d2463a2a443c1bac8bc706794e297a12a11a3dbe5daa8e717
Instruction ID: 8f7d6c036774426769819ffba080c192eadc3d99489cdc49ee21bf41f4177213
Opcode Fuzzy Hash: 87c749d60571553d2463a2a443c1bac8bc706794e297a12a11a3dbe5daa8e717
Instruction Fuzzy Hash: 4D81D430B05325DFDBE50E6488447BEBAA6EB88B48F046819FC468B245DBB0CC91C7E1

Function 06EE85FA Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d11ef72840232c6424ddc8c3b9284c4e81e84581f2ab9ea7f680ad14d7470f52
Instruction ID: cc8e1bf941c5b2bef5729fb95cdcfcd1b8545fc64c5cd7cd9d3950daecf96466
Opcode Fuzzy Hash: d11ef72840232c6424ddc8c3b9284c4e81e84581f2ab9ea7f680ad14d7470f52
Instruction Fuzzy Hash: 16810430E02301AFDB45DF65D848ADFBBB7EF8A340F14816AE84697256D7318A45CBE0

Function 06EE0E28 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89f100234cae6fee5c6cc1119e4538792b157a3e8f52bdfd686697c31a86173c
Instruction ID: 757ec005f140bdecd3f237df319a1c9b97edad2d81eb52f6d1d498bd3e99a5c8
Opcode Fuzzy Hash: 89f100234cae6fee5c6cc1119e4538792b157a3e8f52bdfd686697c31a86173c
Instruction Fuzzy Hash: E581AD35A002099FCB41DFA9D8849EEFBF6FF89314F14816AE505EB211D730A955CBA0

Function 06EECA88 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6b949ac7e3d63484127b177218cc6bdd769a7bc5665aae90a2fc9acf2bb8173
Instruction ID: 82987df35be9436ea853975acc3b2f2b6ab11c58e9b7438cd58309624c30c7b4
Opcode Fuzzy Hash: e6b949ac7e3d63484127b177218cc6bdd769a7bc5665aae90a2fc9acf2bb8173
Instruction Fuzzy Hash: 8A51B071A003459FCB51CF68C890EAABBF2FF45324F258595E966DB3A6C730E944CB60

Function 06EE1BC8 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 196c4776013d33649ff9bcc9a4372266e1010fc306ebe74d6c324d49904b85ab
Instruction ID: fc60f6fd1bc775ca8859ff33e155f242b871dd1eac0711389e5a3f249db3439e
Opcode Fuzzy Hash: 196c4776013d33649ff9bcc9a4372266e1010fc306ebe74d6c324d49904b85ab
Instruction Fuzzy Hash: D651DF74E007489FDB65CFA9C884A9EFBF2BF48300F058569E44AAB761D770A985CF40

Function 06EE2E20 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b42392c7e7755d43e98a8aeea2026bfa430397fea009003c68cf3ac70b9b5c6f
Instruction ID: 8342c07591ddc13fb357ab87ba6d1326ad8024991a06ddb73dd4631a29ea7aae
Opcode Fuzzy Hash: b42392c7e7755d43e98a8aeea2026bfa430397fea009003c68cf3ac70b9b5c6f
Instruction Fuzzy Hash: 21418F30A14B408FE7B18E35C58476677E9BF44318F14A95DD58383AA2C778FAC8C761

Function 06EEDC30 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64bbadb0f2badd309ecee3fb16120bff9fc99b89b7aa9512909676db23391863
Instruction ID: 67c24bde812324ca86fefd24b08bd222982b2a16f02c7fa7ab393befe4af5128
Opcode Fuzzy Hash: 64bbadb0f2badd309ecee3fb16120bff9fc99b89b7aa9512909676db23391863
Instruction Fuzzy Hash: 01410434700600CFC758CF29C988A2ABBFAFF88214B1556A9E5468B772CB71EC81CF50

Function 06EEEB90 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b50cfa6215d1ba39584841debd6c9d95993b2ef9763f087974d89599b2402147
Instruction ID: 1426eb4696a4dd7d0e438485d9450551bc871faf38cd0020c7fe974bd2825c18
Opcode Fuzzy Hash: b50cfa6215d1ba39584841debd6c9d95993b2ef9763f087974d89599b2402147
Instruction Fuzzy Hash: 0B417B71F003198FCB98EF69D85446EBBB7EF88210B0455A9D906DB3A5EB309D41CBA1

Function 06EE88CA Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b11cd03b30e9fbff11363dcad4dd580ebf7684bd7cb1cc67b87fee9747d7b8d
Instruction ID: 51580c55ead0c05e3a45ec165b08e0a9894cec2c2eb98ea94e84e6c72fc7683d
Opcode Fuzzy Hash: 1b11cd03b30e9fbff11363dcad4dd580ebf7684bd7cb1cc67b87fee9747d7b8d
Instruction Fuzzy Hash: 9C41A035A012619FCB05CF28E58886EBFF2FF443257068096E44A87362CB34DD01CBA1

Function 06EEDDE8 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 370bbed5ab4f7f5c7c03b5b22d03581f12e3e8534c60148eb87e75958d13f814
Instruction ID: 911e70ccf8968589d653adb7b3dcfb49d8c71d56d04a5cb1b4bceaebd1c88e67
Opcode Fuzzy Hash: 370bbed5ab4f7f5c7c03b5b22d03581f12e3e8534c60148eb87e75958d13f814
Instruction Fuzzy Hash: 1A313A75F007168FCB68DF68DC849AEB7B6FF88214B1404A9D925EB361D730E941CBA0

Function 06EE11E8 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 041df134775606a181aa7946b9dd187cf86d6c97183348a96f2ada0dd3435223
Instruction ID: 231c6c609a9eb9aa8895381de1e7721b4925f70d461dbb3b57bded469464dfb2
Opcode Fuzzy Hash: 041df134775606a181aa7946b9dd187cf86d6c97183348a96f2ada0dd3435223
Instruction Fuzzy Hash: DB21AB30B002159FDB409FA9E8086FEBBA7FB8A341F008429F902D7381DB759C018BA1

Function 06EEEB82 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6b18b779f07b70b791667f6da3fd869c293abe6aec2a5e809469387b781965e
Instruction ID: f30903273768b09a6bb4beb5a149cfb9997a09fc5371ca7f83edd65b19621a4b
Opcode Fuzzy Hash: b6b18b779f07b70b791667f6da3fd869c293abe6aec2a5e809469387b781965e
Instruction Fuzzy Hash: 87217C31F003159FCB98DF69D9549AEBBBBFF88200B0455A9D9068B2A5DB309D40CBA1

Function 00D6D210 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1756690679.0000000000D6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d6d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aa62fc43238f3ce756563733b1841ee693be909bf20aa1406fb6c9b6cf350ec
Instruction ID: a8367c9652833cde625cfd64f271dae86e728111c129a31aae995a7d79095818
Opcode Fuzzy Hash: 4aa62fc43238f3ce756563733b1841ee693be909bf20aa1406fb6c9b6cf350ec
Instruction Fuzzy Hash: CF212171A04200DFCB05DF04E9D4B2ABF66FB98310F24C569E9090A25AC336D816CBB1

Function 06EE31C9 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82c13089f70256cd0da045f2d23d1ab613f53d419aaefeab49265b123bf99344
Instruction ID: f6800ccbad777df2b61a17a0cf1efc1394d0607b46af412d28ce276bde6c8464
Opcode Fuzzy Hash: 82c13089f70256cd0da045f2d23d1ab613f53d419aaefeab49265b123bf99344
Instruction Fuzzy Hash: B1217931A017009FC769CF69C944D56BBF6BF89314B0AC5AAE54ACB762CB34ED44CB90

Function 06EEE932 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b50457e4b2d2d05693da5d6c1c6d1f1c99ba85b66877c425a07bbcc41110933
Instruction ID: 468e005737c51957caf3e8c3423d2e252a1eaab6d0e5fcae71732258947aa43a
Opcode Fuzzy Hash: 8b50457e4b2d2d05693da5d6c1c6d1f1c99ba85b66877c425a07bbcc41110933
Instruction Fuzzy Hash: 6A214C3090A315DFEBD96BB4A4095B97BB7AB4121130535E6F20396A81DB724D00C7A3

Function 00D7D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1756733103.0000000000D7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d7d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 081adc72137cec5f7916660067bbb231f3cd26a9082a832100d8be171409a9ee
Instruction ID: 56203368ea0473104d3c94760e698ca405fb329a28998851b324bd97a3c62ae3
Opcode Fuzzy Hash: 081adc72137cec5f7916660067bbb231f3cd26a9082a832100d8be171409a9ee
Instruction Fuzzy Hash: A021FF75604200DFCB14DF24D984B26BBB6EF88314F24C56DE84E4B296D33AD847CA71

Function 06EE11D9 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2224c3f74f704c66a64e3fad4dbe59a89b890ec50c4063afeb8cc1ff5931256
Instruction ID: 1dc69209ec6d3981aca925c981d98b58eca4286728839a6eb8ae334b73b9a108
Opcode Fuzzy Hash: c2224c3f74f704c66a64e3fad4dbe59a89b890ec50c4063afeb8cc1ff5931256
Instruction Fuzzy Hash: 7F21CF35B002559FCB409FA9D844AFEBBB6FF8A340B048429F952D7381DB399914CBB0

Function 06EED550 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee78506de5ae022d437bf0e65d3214042c0cf7ca428aebff5d87593ed8fc45e7
Instruction ID: 996a59fefce95a9bd6c4757639b019135d6f5a60ec30520a2dfc22a8382dec40
Opcode Fuzzy Hash: ee78506de5ae022d437bf0e65d3214042c0cf7ca428aebff5d87593ed8fc45e7
Instruction Fuzzy Hash: CA216071E01216DFCB14CF65D68496ABBF2FF89314B148169D809AB325D731ED45CF90

Function 06EED541 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 677ae2862ccfb2d1ab7d61052eca168536a08071c8126a9483dfe6b76589f2ba
Instruction ID: 7c50e07b8f2d73a0c7b0982eee867c0feef5830fa5700c54608f0dc868ef255d
Opcode Fuzzy Hash: 677ae2862ccfb2d1ab7d61052eca168536a08071c8126a9483dfe6b76589f2ba
Instruction Fuzzy Hash: 39218B74A00216DFCB14CF68CA8496ABBF2FF88318B108169E809AB325C731ED45CFD0

Function 06EE387C Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99f2119577e5d03657c613aa495722182b7ceb79742a811fc7044fda19cb6d9c
Instruction ID: aadd5ea1689039fafc1e49b38e2ff9bca2172ef8a327f6a435bf56e4bbc463eb
Opcode Fuzzy Hash: 99f2119577e5d03657c613aa495722182b7ceb79742a811fc7044fda19cb6d9c
Instruction Fuzzy Hash: 92119A34E057059FC7A0CB69C604BAAFBE5FF40318F4491AAD849CB652E734E904CBA1

Function 06EE0006 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49e5fb29e3f3e1acdaff7331e6523eb0a9c1467afda2fda6d9c56b289634e9e8
Instruction ID: 26d15e2c536103f859cc2dbd1466f6793c5e0066d5e8262743c75e6f96d819be
Opcode Fuzzy Hash: 49e5fb29e3f3e1acdaff7331e6523eb0a9c1467afda2fda6d9c56b289634e9e8
Instruction Fuzzy Hash: 1D11E03194E3D1AFE3939A205C105A67FBA9E432A434D04DBE484CB163E2694E68D3B1

Function 06EEE7A8 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa1733cd3a4faccc0abfe889c4077915ebdadbef9236ff5a687492cf942804fe
Instruction ID: 682b67d4ea906b8bc543ff6cb5ca15138a98e64b14e795675781b1297f44f5c9
Opcode Fuzzy Hash: aa1733cd3a4faccc0abfe889c4077915ebdadbef9236ff5a687492cf942804fe
Instruction Fuzzy Hash: 4C11CE31F003149FD7E4AAAD994096AF6CBEBC8250B058A2AD51A8F758DE70EC4983D5

Function 06EEDB78 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47b437c0e61114469130b20c74e0ca6d732782ee0198febc0c0941098677dd0c
Instruction ID: 51f136dbc35f09b125c3ec8abfc5c0ed36cdaf79c353f0be4ebf8408a6da2102
Opcode Fuzzy Hash: 47b437c0e61114469130b20c74e0ca6d732782ee0198febc0c0941098677dd0c
Instruction Fuzzy Hash: 40110830B083598FCBA95F389D1012A7FEA9F8528471414A6D54ACF392DE35CD41CBE1

Function 00D7D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1756733103.0000000000D7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d7d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ee4d31e2bc85eab346fbf3eaa793b278f0df2564cc00b28ba072a908988a134
Instruction ID: 268f4b3e82eacaa02429424ac1a371da7bb332cc84f9fa87ec42cabc722aff08
Opcode Fuzzy Hash: 4ee4d31e2bc85eab346fbf3eaa793b278f0df2564cc00b28ba072a908988a134
Instruction Fuzzy Hash: 7F214F755093808FDB12CF24D994715BF72EF46214F28C5EAD8498B6A7D33A980ACB62

Function 06EEE798 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfc81d4a00ed1ba8296be5638b4cc8a4cd57f0f5c0c155d3b60d1166292fe46e
Instruction ID: c4ce2d85ca8287fe93df5f0796775aad6b7e7ae5202b13d7b8055f1c31d7399d
Opcode Fuzzy Hash: cfc81d4a00ed1ba8296be5638b4cc8a4cd57f0f5c0c155d3b60d1166292fe46e
Instruction Fuzzy Hash: 9F11E131B053105FDBA19BAD99408ABF796EFC4310B04862AE51A8F359DA70EC49C3E5

Function 06EE3861 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3b10089f7f61688a5dd24633d9608e5a4048ebea3e08372a33b28e526832552
Instruction ID: a287616000a1cc6b0b165163b7b2ca2955dd377a42dbbe0acc221f7e1c36e801
Opcode Fuzzy Hash: c3b10089f7f61688a5dd24633d9608e5a4048ebea3e08372a33b28e526832552
Instruction Fuzzy Hash: 1D11B135E007018FC7A0CB28C5047A9FBF1BF40318F48A1AAD849DB292D339E945CF81

Function 06EE65B9 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9087a5a1b5f913e98bc7b3f46dabca0e350ab5a7e396046ec57b8185558a8e0
Instruction ID: e4b89cc5f80abda0249e1fc6730c4ec96f523f3d6f9fe526d7cd72c20dc561ef
Opcode Fuzzy Hash: d9087a5a1b5f913e98bc7b3f46dabca0e350ab5a7e396046ec57b8185558a8e0
Instruction Fuzzy Hash: 5E1193356012409FC704CF28D844D9EBFB2FF89324B15819AE549CB362CB31ED06CBA0

Function 06EE7AC8 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0aaa6ccede45128779a75ecc6bf6edb4e8b0fadfc4638eef8cb4dc6b96eaae0d
Instruction ID: e276fecea892e8855fbb15404c3428aab36c553cc62542e055bec5f4ee046d27
Opcode Fuzzy Hash: 0aaa6ccede45128779a75ecc6bf6edb4e8b0fadfc4638eef8cb4dc6b96eaae0d
Instruction Fuzzy Hash: 75113D75B04258CFCB44DFB8D4545AE7BF2EF89300B1144AAE206DB3A1DE319D09CBA1

Function 06EEE940 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e330cbc58c9a794b4bfad146263ff731ce0aa63991244b3732d71bfc723b03a
Instruction ID: 04367227378552bda0c601dc256d3fd666b6b276fe18c9f1290d666e23a6e739
Opcode Fuzzy Hash: 3e330cbc58c9a794b4bfad146263ff731ce0aa63991244b3732d71bfc723b03a
Instruction Fuzzy Hash: 5E11F130909215CFEBD96BB5A00D67C7BF7AB4131234175A6F20796A80EF728D008BA3

Function 00D6D20B Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1756690679.0000000000D6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d6d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4a9c2a4520ad29cc5014b186a1537c42efb92585eeaa8902cc1b22a323ac8e1
Instruction ID: 0d76ebeef4e239fc068db7e49da43a280178cff2d24ea882e216cc397cf102c9
Opcode Fuzzy Hash: d4a9c2a4520ad29cc5014b186a1537c42efb92585eeaa8902cc1b22a323ac8e1
Instruction Fuzzy Hash: 6A21D676504240DFCB06CF54D9C4B16BF72FB98314F28C5A9DD050B656C336D856CBA1

Function 06EE4AA9 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1773f9ca59aa9b0be57e8ed15656df4822a32f2af3dd3c99ee5d93d42bdd3a0
Instruction ID: 015b7531cfbaebb52f3e0b191f8ff85b661201bf7b17112c0127f3648819322b
Opcode Fuzzy Hash: e1773f9ca59aa9b0be57e8ed15656df4822a32f2af3dd3c99ee5d93d42bdd3a0
Instruction Fuzzy Hash: 3811E375A00215DFCB05DF64D9448AEBFF7FF883107105169E606D73A5EB308945CBA1

Function 06EED619 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd972f988da5b2068d8170a329fd0be477705bb93d751143447c9c3573a9ec48
Instruction ID: b5fbfe03119ef2247284be171db80e3a0564cc6361e9e3b00e13df2f7048a22e
Opcode Fuzzy Hash: cd972f988da5b2068d8170a329fd0be477705bb93d751143447c9c3573a9ec48
Instruction Fuzzy Hash: AF11C671600601DFD710DF29E844E9AFBF6FF88314B048569E40987755CB31ED85CBA0

Function 06EED628 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 256cf7018cfc64a895d61e285cb760a8727b0f26107a6ae7aeace76da638aa2b
Instruction ID: 5b6f06bf446a48e4dd603babfc1ab73fb32c5fd143c2c373b6790073837708a8
Opcode Fuzzy Hash: 256cf7018cfc64a895d61e285cb760a8727b0f26107a6ae7aeace76da638aa2b
Instruction Fuzzy Hash: 3611C2716002019FC7109F29E84495AFBE6FF89324B00856AE44987311CB31ED49CBA0

Function 06EE7668 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1608956be3cb61e8f60a471d7bdc8603d2067a64d9d6916f360450f2e6d0d677
Instruction ID: bc0dfd39ec35242a3fa401a46128bd87336e4d4cfd067e1df63244333953f296
Opcode Fuzzy Hash: 1608956be3cb61e8f60a471d7bdc8603d2067a64d9d6916f360450f2e6d0d677
Instruction Fuzzy Hash: E60126316093744FD7056B7CA46509E7FA9DF8129470544D3E085CB291DE248946C3EA

Function 06EEFC00 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d7a14ee819dad3887491a2198e4dcc808722886a0d626b23df05bad78842f42
Instruction ID: 68d802b59a82bc338204c9105ffb86531b4baf98046d08980a2f828e9472d7ab
Opcode Fuzzy Hash: 8d7a14ee819dad3887491a2198e4dcc808722886a0d626b23df05bad78842f42
Instruction Fuzzy Hash: E001A272B0021D9BCB90DAA9AC44ABFF7EEEBC8250F14403AEA14D3240DB71991587E5

Function 06EE65C8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eb8ab5a88a9a9996b0edd1ee5c5091207ba13e5269f67378b00e7222e11f808
Instruction ID: b2ee437e3c01629d27cd9cc1ac394af4955b404211ec9efaacb8902c03dbf506
Opcode Fuzzy Hash: 7eb8ab5a88a9a9996b0edd1ee5c5091207ba13e5269f67378b00e7222e11f808
Instruction Fuzzy Hash: B71170356002059FC704DF68D884D9EBBF6FF89324B148569E9198B362CB71ED46CBA0

Function 06EE2FA0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98aa68fecab290327f8b39d09da561380f1c439fbf29cb05436a9467966617cf
Instruction ID: fed947f48f3310a90a5da30f82913c24de01be04557fd3984bb58a0f31c41501
Opcode Fuzzy Hash: 98aa68fecab290327f8b39d09da561380f1c439fbf29cb05436a9467966617cf
Instruction Fuzzy Hash: 7E01A43101D7D46FD76287745E567B53FA85F02118B5C21CBE188CB4A3DA0A8696D362

Function 00D6D5D9 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1756690679.0000000000D6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d6d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76c452be61380567203dd1634a86ae06f3be7df5207e40965673a0afc8aab320
Instruction ID: 06452e4b944b206876b9dec084017cc6d532abe437cdee481c7d58dc0060d4aa
Opcode Fuzzy Hash: 76c452be61380567203dd1634a86ae06f3be7df5207e40965673a0afc8aab320
Instruction Fuzzy Hash: 25012B31A08304DBE7108B5ADD84767BFD9DF41324F1CC52AED4D4A296C639DC40CA71

Function 06EE6EB1 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9cc9321a20d8bf18a2f64878cdc11616e40ba6d06e4e2e4d46f1837aee9b4fc
Instruction ID: 2df7909fa60fa5a46c2b3ed782f30e2d9821493b796f06ea1d0ee40d4410680f
Opcode Fuzzy Hash: a9cc9321a20d8bf18a2f64878cdc11616e40ba6d06e4e2e4d46f1837aee9b4fc
Instruction Fuzzy Hash: AC016D31A013058FDB94DF64D9197EEBBF5AF48604F24906AD806E7650DB769D00CBA0

Function 06EE75F8 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5572b1a5c0f71be85bac3e04f4b3418c0481c7ce8f341147baea4e7339f19255
Instruction ID: 83417d9b160752e9a20b3f69bca26d753581a744347c748be45a2776cc91d7ee
Opcode Fuzzy Hash: 5572b1a5c0f71be85bac3e04f4b3418c0481c7ce8f341147baea4e7339f19255
Instruction Fuzzy Hash: EFF0B432B28326CF8F889FADF4044AA77E9EB4452971050ABE00DC7250EE31D981C780

Function 06EE8932 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aea47e224af61b2dead9d18f41ffbb634132b2ac7239b8e93343123d273036b
Instruction ID: 0c2d409dc5d79eac1127107d636b79e2020d767cb3c5bcbb3d1e45bc85515b8f
Opcode Fuzzy Hash: 1aea47e224af61b2dead9d18f41ffbb634132b2ac7239b8e93343123d273036b
Instruction Fuzzy Hash: CEF0F632E01621AFC7118B48C644EA7FB69AF4032470AC587E45D9B312CB31EC0487E2

Function 00D6D5D8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1756690679.0000000000D6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d6d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5e7ab4fd0281c139cddd28987ec9977ce6a16a30f230d91adc4fb7073fe5cbe
Instruction ID: c94e923003eda9b2494662372c75f19d109c01fcdd06c2cb76ffee152162e67f
Opcode Fuzzy Hash: d5e7ab4fd0281c139cddd28987ec9977ce6a16a30f230d91adc4fb7073fe5cbe
Instruction Fuzzy Hash: BFF062715083449EE7108A16D984B62FFA8EF91734F18C55AED0C4A296C27A9C44CA71

Function 06EEEB32 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b8573caef172eca8bd32085599a934e4e96e2a6628e93eeb109a739e422b053
Instruction ID: fb1fd328dfd4ab25906820fa6ae8c371e849aa854241ac524179aec7b7911c35
Opcode Fuzzy Hash: 1b8573caef172eca8bd32085599a934e4e96e2a6628e93eeb109a739e422b053
Instruction Fuzzy Hash: F8E092716553242FC385AB6C9A1089A3FAFBFC921030506D6E64A4F777CF509E4487F6

Function 06EEDB68 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99adb435ee07d5a6b6b16884b490d0f7717680806db7d43b9ddb47882c016fea
Instruction ID: 6d84f9e14181cde6340861747f34e7827af46c3463bdfa51cff99b62db9f370c
Opcode Fuzzy Hash: 99adb435ee07d5a6b6b16884b490d0f7717680806db7d43b9ddb47882c016fea
Instruction Fuzzy Hash: 3AF065357493959FC7159F14DE108A67FED6E4524030512D6E448CB267DA24DE41CBF1

Function 06EE88F0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0695d45463a80b821dea86ea57516ae622e6ed1281e90646f9816c471fc7f012
Instruction ID: 08a218077084fb7cc93bceee638bec0f36d4285f673bd06a6b131e57cae854e0
Opcode Fuzzy Hash: 0695d45463a80b821dea86ea57516ae622e6ed1281e90646f9816c471fc7f012
Instruction Fuzzy Hash: 0EE09236B1E3A14FC7064159399547A6F996ACA02531910ABF449D7343CD558905D3B2

Function 06EE8900 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46963bd457cdea30d9aa4ed096d9de96dba3dab6ba201f32518a5f99407ab7c1
Instruction ID: cd5cdf752a4d54a7703c12c132b8b8414cceca74837d71eedefcc52d8068fffa
Opcode Fuzzy Hash: 46963bd457cdea30d9aa4ed096d9de96dba3dab6ba201f32518a5f99407ab7c1
Instruction Fuzzy Hash: ABD05E36B25234170614154F78C983BBBCEF7CC53A354103BF50EC3300DE958C0642A1

Function 06EE7658 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17a0f5e2ea3222d8cd37191fe0b66ae9e2c6b4cea3238af6dc2dc4a23e659182
Instruction ID: d6939efd297a4e1da7f8fce265e17e59e93a54f1da3752cdd6837c26100c51a7
Opcode Fuzzy Hash: 17a0f5e2ea3222d8cd37191fe0b66ae9e2c6b4cea3238af6dc2dc4a23e659182
Instruction Fuzzy Hash: 51D0A71151B76427431316292C008EEBF5F5D468343950392F235C61E3CE444D4082E6

Function 06EEEB40 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 168bac0a9cc6f6831891509d6f346462b70dda73942ffc209870bc3e7f770ef3
Instruction ID: a0a7ab270d312585e705d854b0c6d0859844f1e215e857037cec84b74b6fb222
Opcode Fuzzy Hash: 168bac0a9cc6f6831891509d6f346462b70dda73942ffc209870bc3e7f770ef3
Instruction Fuzzy Hash: E5E012717402245F86C8BB5CD51085977DAFFC831070106E5D55E5F769CF60EC4587EA

Function 06EEE0F0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcf91b967d4d72d57e9a28dc742d9121f08e020c9d24c59a0c83ff38ad374dfa
Instruction ID: f917643788985a532a4465dba49ffb5789ad3a7865633d5f6a12005488753e03
Opcode Fuzzy Hash: fcf91b967d4d72d57e9a28dc742d9121f08e020c9d24c59a0c83ff38ad374dfa
Instruction Fuzzy Hash: 27E0CD76A042404FC7524F64F4584777FE6AB85124304459FE8E6C7B56C716DC85C791

Function 06EE81B2 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dce85e15d057902c878b65d87d4ddbcb49176f1cf9c6307ea2a1a82eae2e309e
Instruction ID: fff695717dadb3feff729fde10f194daed261edebcadfd47cfbd3aefb4a0bd56
Opcode Fuzzy Hash: dce85e15d057902c878b65d87d4ddbcb49176f1cf9c6307ea2a1a82eae2e309e
Instruction Fuzzy Hash: 4DD0A734740208DFCB84DBDCD5004F97773DB85215B000065E22ACB720DB319D1CCB81

Function 06EE7C04 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91f2fc86e41c844b37a5137a2827df5f674195b8d873b5b9bb99bac13d5e8345
Instruction ID: fb011fcd389d3e4913af1f100c1da2eb7a2cd9d68c65ffd79f1f193386972b07
Opcode Fuzzy Hash: 91f2fc86e41c844b37a5137a2827df5f674195b8d873b5b9bb99bac13d5e8345
Instruction Fuzzy Hash: 99D0C935F40404DF8B84DFADE0404DD7BF2EFC9215B4000A6E20AC7224DB3198558F81

Function 06EE7E6C Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4d8260db931bb86c1036d5f440c9859d4d1c5f2fe9c6572c3888942775dca9c
Instruction ID: 26d065de74ae9340371ae822357e8defc61a8c8237297a86916053260314649e
Opcode Fuzzy Hash: d4d8260db931bb86c1036d5f440c9859d4d1c5f2fe9c6572c3888942775dca9c
Instruction Fuzzy Hash: 0BD01235740010CF8B84DA5CD0004D977A2EFC421574010A6F207C7634CB31DC958BC1

Function 06EE7DCA Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94ea170b6998a92b004a14ef5c330125fdb3773937eef3a8a8912f241bf79766
Instruction ID: 33ca9567e991eb78d1669d59932400535327125d6608336f287858b416406ea0
Opcode Fuzzy Hash: 94ea170b6998a92b004a14ef5c330125fdb3773937eef3a8a8912f241bf79766
Instruction Fuzzy Hash: 6FD0C935750000CF87849A98D40049977A6EB84615B4010E6E206C7264CA2198148781

Function 06EE7D28 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5ccaa2657ac6a8c1e8befacf99e3f4028a74bf638dee84b68e357e4dfae45d8
Instruction ID: 913dadc19b08cb090db26917ba2d1c9e09673983bf89b4d40b3daef6784fa309
Opcode Fuzzy Hash: d5ccaa2657ac6a8c1e8befacf99e3f4028a74bf638dee84b68e357e4dfae45d8
Instruction Fuzzy Hash: BCD01235740410CF8784DB5DD5058DD7BE2EFC421575140A6E20BC7224CF31DD144B81

Function 06EE88D8 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1773695305.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ee0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 016dfbdd7ee1b97d95b9f996ed712c57e5e0987bc34a75c5757ae5cbeba8a2e2
Instruction ID: d55caf6352f4bcdc23eb805ad81c7a84bb64a682f74e8d7ef4ee5802687920f2
Opcode Fuzzy Hash: 016dfbdd7ee1b97d95b9f996ed712c57e5e0987bc34a75c5757ae5cbeba8a2e2
Instruction Fuzzy Hash: C3C09230912380CFCB06CF24D0888007BB2AF4230935940D9E0498F922CB36DCC2CB10

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

C:\Users\user\AppData\Roaming\gdi32.dll

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Windows Analysis Report
file.exe

Function 6CF01210 Relevance: 45.1, APIs: 18, Strings: 7, Instructions: 1311
filememoryCOMMON

Function 6CF03250 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 346
COMMON

Function 027008AC Relevance: 2.8, Strings: 2, Instructions: 295
COMMON

Function 02703B8D Relevance: 1.5, Strings: 1, Instructions: 257
COMMON

Function 0270245C Relevance: 1.4, Strings: 1, Instructions: 197
COMMON

Function 02705C98 Relevance: 1.4, Strings: 1, Instructions: 153
COMMON

Function 02704167 Relevance: 1.4, Strings: 1, Instructions: 141
COMMON

Function 6CF08298 Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Function 6CF08348 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Function 6CF08191 Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Function 6CF0E7DC Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 0270537C Relevance: 1.6, APIs: 1, Instructions: 56
libraryCOMMON

Function 027061B9 Relevance: 1.6, APIs: 1, Instructions: 56
libraryCOMMON