Edit tour

Windows Analysis Report
46VHQmFDxC.exe

Overview

General Information

Sample name:	46VHQmFDxC.exe renamed because original name is a hash value
Original sample name:	2b5ceb18f10606859253493d936ae2815b3fed26.exe
Analysis ID:	1582809
MD5:	ac39e7b10284fe04e5bdb8b588681cb4
SHA1:	2b5ceb18f10606859253493d936ae2815b3fed26
SHA256:	fc7da967f86d24024700aa2a488ae2ce18c038260d9e2d5067261c9bedbcfaf0
Tags:	exeRedLineStealeruser-NDA0E
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected RedLine Stealer

.NET source code contains very large array initializations

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Installs new ROOT certificates

Machine Learning detection for dropped file

Machine Learning detection for sample

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Detected potential crypto function

Drops PE files

Drops certificate files (DER)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

46VHQmFDxC.exe (PID: 7908 cmdline: "C:\Users\user\Desktop\46VHQmFDxC.exe" MD5: AC39E7B10284FE04E5BDB8B588681CB4)

conhost.exe (PID: 7916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MSBuild.exe (PID: 8004 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": "185.38.142.167:6302", "Authorization Header": "19b166de386548abffc45a63fbb79ca0"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
46VHQmFDxC.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
46VHQmFDxC.exe	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x77543:$gen01: ChromeGetRoamingName 0x77568:$gen02: ChromeGetLocalName 0x775ab:$gen03: get_UserDomainName 0x7b442:$gen04: get_encrypted_key 0x7a1c1:$gen05: browserPaths 0x7a497:$gen06: GetBrowsers 0x79d89:$gen07: get_InstalledInputLanguages 0x7624c:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x55890:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x7b886:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x7b924:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x7bf8a:$spe9: wallet 0x7426a:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x74794:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x74841:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x74218:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x74241:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x74412:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x74665:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x74954:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmp	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x24ccb:$gen01: ChromeGetRoamingName 0x24cf0:$gen02: ChromeGetLocalName 0x24d33:$gen03: get_UserDomainName 0x28bca:$gen04: get_encrypted_key 0x27949:$gen05: browserPaths 0x27c1f:$gen06: GetBrowsers 0x27511:$gen07: get_InstalledInputLanguages 0x239d4:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x3018:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x2900e:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x290ac:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x29712:$spe9: wallet 0x219f2:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x21f1c:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x21fc9:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x219a0:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x219c9:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x21b9a:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x21ded:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x220dc:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
00000003.00000002.2618697590.00000000006F2000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000000.1371143077.0000000000212000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: 46VHQmFDxC.exe PID: 7908	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 8004	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.46VHQmFDxC.exe.264678.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.0.46VHQmFDxC.exe.264678.1.raw.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x24ccb:$gen01: ChromeGetRoamingName 0x24cf0:$gen02: ChromeGetLocalName 0x24d33:$gen03: get_UserDomainName 0x28bca:$gen04: get_encrypted_key 0x27949:$gen05: browserPaths 0x27c1f:$gen06: GetBrowsers 0x27511:$gen07: get_InstalledInputLanguages 0x239d4:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x3018:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x2900e:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x290ac:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x29712:$spe9: wallet 0x219f2:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x21f1c:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x21fc9:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x219a0:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x219c9:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x21b9a:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x21ded:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x220dc:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
0.2.46VHQmFDxC.exe.6d502000.2.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.46VHQmFDxC.exe.6d502000.2.raw.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x24ccb:$gen01: ChromeGetRoamingName 0x24cf0:$gen02: ChromeGetLocalName 0x24d33:$gen03: get_UserDomainName 0x28bca:$gen04: get_encrypted_key 0x27949:$gen05: browserPaths 0x27c1f:$gen06: GetBrowsers 0x27511:$gen07: get_InstalledInputLanguages 0x239d4:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x3018:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x2900e:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x290ac:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x29712:$spe9: wallet 0x219f2:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x21f1c:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x21fc9:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x219a0:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x219c9:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x21b9a:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x21ded:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x220dc:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
0.0.46VHQmFDxC.exe.264678.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.0.46VHQmFDxC.exe.264678.1.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x22ecb:$gen01: ChromeGetRoamingName 0x22ef0:$gen02: ChromeGetLocalName 0x22f33:$gen03: get_UserDomainName 0x26dca:$gen04: get_encrypted_key 0x25b49:$gen05: browserPaths 0x25e1f:$gen06: GetBrowsers 0x25711:$gen07: get_InstalledInputLanguages 0x21bd4:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x1218:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x2720e:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x272ac:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x27912:$spe9: wallet 0x1fbf2:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x2011c:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x201c9:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x1fba0:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x1fbc9:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x1fd9a:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x1ffed:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x202dc:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
0.2.46VHQmFDxC.exe.6d502000.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.46VHQmFDxC.exe.6d502000.2.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x22ecb:$gen01: ChromeGetRoamingName 0x22ef0:$gen02: ChromeGetLocalName 0x22f33:$gen03: get_UserDomainName 0x26dca:$gen04: get_encrypted_key 0x25b49:$gen05: browserPaths 0x25e1f:$gen06: GetBrowsers 0x25711:$gen07: get_InstalledInputLanguages 0x21bd4:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x1218:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x2720e:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x272ac:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x27912:$spe9: wallet 0x1fbf2:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x2011c:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x201c9:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x1fba0:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x1fbc9:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x1fd9a:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x1ffed:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x202dc:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
3.2.MSBuild.exe.6f0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
3.2.MSBuild.exe.6f0000.0.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x24ccb:$gen01: ChromeGetRoamingName 0x24cf0:$gen02: ChromeGetLocalName 0x24d33:$gen03: get_UserDomainName 0x28bca:$gen04: get_encrypted_key 0x27949:$gen05: browserPaths 0x27c1f:$gen06: GetBrowsers 0x27511:$gen07: get_InstalledInputLanguages 0x239d4:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x3018:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x2900e:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x290ac:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x29712:$spe9: wallet 0x219f2:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x21f1c:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x21fc9:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x219a0:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x219c9:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x21b9a:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x21ded:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x220dc:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
0.0.46VHQmFDxC.exe.210000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.0.46VHQmFDxC.exe.210000.0.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x77543:$gen01: ChromeGetRoamingName 0x77568:$gen02: ChromeGetLocalName 0x775ab:$gen03: get_UserDomainName 0x7b442:$gen04: get_encrypted_key 0x7a1c1:$gen05: browserPaths 0x7a497:$gen06: GetBrowsers 0x79d89:$gen07: get_InstalledInputLanguages 0x7624c:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x55890:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x7b886:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x7b924:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x7bf8a:$spe9: wallet 0x7426a:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x74794:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x74841:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x74218:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x74241:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x74412:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x74665:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x74954:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
0.2.46VHQmFDxC.exe.6d4b0000.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.46VHQmFDxC.exe.6d4b0000.1.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x752cb:$gen01: ChromeGetRoamingName 0x752f0:$gen02: ChromeGetLocalName 0x75333:$gen03: get_UserDomainName 0x791ca:$gen04: get_encrypted_key 0x77f49:$gen05: browserPaths 0x7821f:$gen06: GetBrowsers 0x77b11:$gen07: get_InstalledInputLanguages 0x73fd4:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x53618:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x7960e:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x796ac:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x79d12:$spe9: wallet 0x71ff2:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x7251c:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x725c9:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x71fa0:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x71fc9:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x7219a:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x723ed:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x726dc:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
Click to see the 9 entries

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 46VHQmFDxC.exe

Malware Configuration Extractor: RedLine {"C2 url": "185.38.142.167:6302", "Authorization Header": "19b166de386548abffc45a63fbb79ca0"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\gdi32.dll

ReversingLabs: Detection: 73%

Multi AV Scanner detection for submitted file

Source: 46VHQmFDxC.exe	Virustotal: Detection: 45%			Perma Link
Source: 46VHQmFDxC.exe	ReversingLabs: Detection: 78%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\gdi32.dll

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 46VHQmFDxC.exe

Joe Sandbox ML: detected

Source: 46VHQmFDxC.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 46VHQmFDxC.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Windows\System.ServiceModel.pdbpdbdel.pdb source: MSBuild.exe, 00000003.00000002.2620789735.00000000055FB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb8_c source: MSBuild.exe, 00000003.00000002.2619393794.0000000000F08000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ServiceModel.pdb693405117-2476756634-1003_Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Servererver32d source: MSBuild.exe, 00000003.00000002.2620789735.0000000005550000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.ServiceModel.pdb0tDj source: MSBuild.exe, 00000003.00000002.2620789735.00000000055AD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ServiceModel.pdb source: MSBuild.exe, 00000003.00000002.2620789735.0000000005600000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb source: MSBuild.exe, 00000003.00000002.2619393794.0000000000F08000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.ServiceModel.pdba source: MSBuild.exe, 00000003.00000002.2620789735.00000000055AD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.ServiceModel.pdbb source: MSBuild.exe, 00000003.00000002.2620789735.0000000005550000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\46VHQmFDxC.exe

Code function: 0_2_6D4F4420 FindFirstFileExW,

0_2_6D4F4420

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 185.38.142.167:6302

Source: global traffic

TCP traffic: 192.168.2.10:49702 -> 185.38.142.167:6302

Source: global traffic

TCP traffic: 192.168.2.10:58226 -> 162.159.36.2:53

Source: Joe Sandbox View

ASN Name: NETSOLUTIONSNL NETSOLUTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45

Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9q
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10LR
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Responsex
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11LR
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Responsex
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12LR
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Responsex
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13LR
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Responsex
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14LR
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Responsex
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15LR
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Responsex
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16LR
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Responsex
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17LR
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Responsex
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18LR
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Responsex
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19LR
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Responsex
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1LR
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Responsex
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20LR
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Responsex
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21LR
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Responsex
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22LR
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Responsex
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23LR
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Responsex
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24LR
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Responsex
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2LR
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Responsex
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3LR
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Responsex
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4LR
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Responsex
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5LR
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Responsex
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6LR
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Responsex
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7LR
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Responsex
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8LR
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Responsex
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9LR
Source: MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Responsex
Source: 46VHQmFDxC.exe	String found in binary or memory: https://api.ip.sb/ip

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp7327.tmp			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp7338.tmp			Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 46VHQmFDxC.exe, type: SAMPLE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.0.46VHQmFDxC.exe.264678.1.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.2.46VHQmFDxC.exe.6d502000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.0.46VHQmFDxC.exe.264678.1.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.2.46VHQmFDxC.exe.6d502000.2.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 3.2.MSBuild.exe.6f0000.0.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.0.46VHQmFDxC.exe.210000.0.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.2.46VHQmFDxC.exe.6d4b0000.1.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io

.NET source code contains very large array initializations

Source: 46VHQmFDxC.exe, GetWin.cs

Large array initialization: GetWindowsOS: array initializer size 650752

Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4C69B0 WindowsHandle,GetConsoleWindow,ShowWindow,VirtualAlloc,CreateProcessW,NtGetContextThread,NtAllocateVirtualMemory,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtWriteVirtualMemory,NtWriteVirtualMemory,NtReadVirtualMemory,NtWriteVirtualMemory,NtWriteVirtualMemory,NtCreateThreadEx,NtSetContextThread,NtResumeThread,CloseHandle,CloseHandle,VirtualAlloc,NtGetContextThread,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtReadVirtualMemory,NtWriteVirtualMemory,NtSetContextThread,NtResumeThread,VirtualAlloc,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtWriteVirtualMemory,NtReadVirtualMemory,NtWriteVirtualMemory,NtSetContextThread,NtResumeThread,		0_2_6D4C69B0
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4C55B0 GetModuleHandleW,NtQueryInformationProcess,GetModuleHandleW,		0_2_6D4C55B0

Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4C69B0	0_2_6D4C69B0
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4C55B0	0_2_6D4C55B0
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4BEA10	0_2_6D4BEA10
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4E3D40	0_2_6D4E3D40
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4E0560	0_2_6D4E0560
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4DC170	0_2_6D4DC170
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4EC570	0_2_6D4EC570
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4D8910	0_2_6D4D8910
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4EED10	0_2_6D4EED10
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4E9510	0_2_6D4E9510
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4D8520	0_2_6D4D8520
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4E21C0	0_2_6D4E21C0
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4D5DD0	0_2_6D4D5DD0
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4D0DE0	0_2_6D4D0DE0
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4ED9F0	0_2_6D4ED9F0
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4DB990	0_2_6D4DB990
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4D8DB0	0_2_6D4D8DB0
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4D15B0	0_2_6D4D15B0
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4E01B0	0_2_6D4E01B0
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4DE440	0_2_6D4DE440
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4D4840	0_2_6D4D4840
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4E7840	0_2_6D4E7840
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4E0850	0_2_6D4E0850
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4ED460	0_2_6D4ED460
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4D3C10	0_2_6D4D3C10
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4EC020	0_2_6D4EC020
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4D50C0	0_2_6D4D50C0
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4DF0C0	0_2_6D4DF0C0
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4D40A0	0_2_6D4D40A0
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4D78A0	0_2_6D4D78A0
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4C64B0	0_2_6D4C64B0
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4C2B60	0_2_6D4C2B60
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4DD770	0_2_6D4DD770
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4DEB70	0_2_6D4DEB70
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4EE370	0_2_6D4EE370
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4ECF00	0_2_6D4ECF00
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4DA730	0_2_6D4DA730
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4E7BE0	0_2_6D4E7BE0
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4E5BE0	0_2_6D4E5BE0
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4E8FF0	0_2_6D4E8FF0
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4CFF80	0_2_6D4CFF80
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4E2790	0_2_6D4E2790
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4CEFA0	0_2_6D4CEFA0
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4E6FA0	0_2_6D4E6FA0
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4D2BB0	0_2_6D4D2BB0
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4DFA40	0_2_6D4DFA40
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4DA240	0_2_6D4DA240
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4E1260	0_2_6D4E1260
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4D3670	0_2_6D4D3670
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4D7E70	0_2_6D4D7E70
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4BE610	0_2_6D4BE610
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4DDAC0	0_2_6D4DDAC0
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4E1EC0	0_2_6D4E1EC0
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4E56E0	0_2_6D4E56E0
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4D92F0	0_2_6D4D92F0
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4DF2F0	0_2_6D4DF2F0
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4D9AF0	0_2_6D4D9AF0
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4D1280	0_2_6D4D1280
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4D9690	0_2_6D4D9690
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4D32A0	0_2_6D4D32A0
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4D56B0	0_2_6D4D56B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_02BFDC74	3_2_02BFDC74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_065767D8	3_2_065767D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0657A3D8	3_2_0657A3D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_06573F50	3_2_06573F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_06576FF8	3_2_06576FF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_06576FE8	3_2_06576FE8

Source: 46VHQmFDxC.exe, 00000000.00000000.1371248344.00000000002B4000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameYvonneXeniaKaitlyn.exePXhT vs 46VHQmFDxC.exe
Source: 46VHQmFDxC.exe, 00000000.00000000.1371143077.0000000000298000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSkimping.exe8 vs 46VHQmFDxC.exe
Source: 46VHQmFDxC.exe, 00000000.00000002.1377084031.000000000075E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 46VHQmFDxC.exe
Source: 46VHQmFDxC.exe, 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilenameSkimping.exe8 vs 46VHQmFDxC.exe
Source: 46VHQmFDxC.exe	Binary or memory string: OriginalFilenameSkimping.exe8 vs 46VHQmFDxC.exe
Source: 46VHQmFDxC.exe	Binary or memory string: OriginalFilenameYvonneXeniaKaitlyn.exePXhT vs 46VHQmFDxC.exe

Source: 46VHQmFDxC.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 46VHQmFDxC.exe, type: SAMPLE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.0.46VHQmFDxC.exe.264678.1.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.2.46VHQmFDxC.exe.6d502000.2.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.0.46VHQmFDxC.exe.264678.1.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.2.46VHQmFDxC.exe.6d502000.2.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 3.2.MSBuild.exe.6f0000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.0.46VHQmFDxC.exe.210000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.2.46VHQmFDxC.exe.6d4b0000.1.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e

Source: classification engine

Classification label: mal100.troj.evad.winEXE@4/6@0/1

Source: C:\Users\user\Desktop\46VHQmFDxC.exe

File created: C:\Users\user\AppData\Roaming\gdi32.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7916:120:WilError_03

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Local\Temp\Tmp7327.tmp

Jump to behavior

Source: 46VHQmFDxC.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 46VHQmFDxC.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\46VHQmFDxC.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 46VHQmFDxC.exe	Virustotal: Detection: 45%
Source: 46VHQmFDxC.exe	ReversingLabs: Detection: 78%

Source: unknown	Process created: C:\Users\user\Desktop\46VHQmFDxC.exe "C:\Users\user\Desktop\46VHQmFDxC.exe"
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: esdsip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32

Jump to behavior

Source: Google Chrome.lnk.3.dr

LNK file: ..\..\..\Program Files\Google\Chrome\Application\chrome.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 46VHQmFDxC.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 46VHQmFDxC.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Windows\System.ServiceModel.pdbpdbdel.pdb source: MSBuild.exe, 00000003.00000002.2620789735.00000000055FB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb8_c source: MSBuild.exe, 00000003.00000002.2619393794.0000000000F08000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ServiceModel.pdb693405117-2476756634-1003_Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Servererver32d source: MSBuild.exe, 00000003.00000002.2620789735.0000000005550000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.ServiceModel.pdb0tDj source: MSBuild.exe, 00000003.00000002.2620789735.00000000055AD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ServiceModel.pdb source: MSBuild.exe, 00000003.00000002.2620789735.0000000005600000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb source: MSBuild.exe, 00000003.00000002.2619393794.0000000000F08000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.ServiceModel.pdba source: MSBuild.exe, 00000003.00000002.2620789735.00000000055AD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.ServiceModel.pdbb source: MSBuild.exe, 00000003.00000002.2620789735.0000000005550000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_02BFCD08 push ebp; retn 0002h		3_2_02BFCD09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0657ECF2 push eax; ret		3_2_0657ED01

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Jump to behavior

Source: C:\Users\user\Desktop\46VHQmFDxC.exe

File created: C:\Users\user\AppData\Roaming\gdi32.dll

Jump to dropped file

Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Memory allocated: AF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Memory allocated: 2560000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Memory allocated: 4560000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 1230000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2C60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 1230000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\46VHQmFDxC.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\46VHQmFDxC.exe TID: 7992

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\46VHQmFDxC.exe

Code function: 0_2_6D4F4420 FindFirstFileExW,

0_2_6D4F4420

Source: C:\Users\user\Desktop\46VHQmFDxC.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: MSBuild.exe, 00000003.00000002.2620789735.0000000005550000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\46VHQmFDxC.exe

Code function: 0_2_6D4F0152 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6D4F0152

Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4F2D22 mov eax, dword ptr fs:[00000030h]		0_2_6D4F2D22
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4F3F61 mov eax, dword ptr fs:[00000030h]		0_2_6D4F3F61

Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4F0152 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6D4F0152
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4EFC27 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6D4EFC27
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Code function: 0_2_6D4F263C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6D4F263C

Source: C:\Users\user\Desktop\46VHQmFDxC.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\46VHQmFDxC.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 6F0000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\46VHQmFDxC.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 6F0000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 6F0000	Jump to behavior
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 6F2000	Jump to behavior
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 722000	Jump to behavior
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 740000	Jump to behavior
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 6F2000	Jump to behavior
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 722000	Jump to behavior
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 740000	Jump to behavior
Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: A87008	Jump to behavior

Source: C:\Users\user\Desktop\46VHQmFDxC.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

Jump to behavior

Source: C:\Users\user\Desktop\46VHQmFDxC.exe

Code function: 0_2_6D4F0318 cpuid

0_2_6D4F0318

Source: C:\Users\user\Desktop\46VHQmFDxC.exe	Queries volume information: C:\Users\user\Desktop\46VHQmFDxC.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\46VHQmFDxC.exe

Code function: 0_2_6D4EFD9B GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6D4EFD9B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: 46VHQmFDxC.exe, type: SAMPLE
Source: Yara match	File source: 0.0.46VHQmFDxC.exe.264678.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.46VHQmFDxC.exe.6d502000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.46VHQmFDxC.exe.264678.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.46VHQmFDxC.exe.6d502000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.6f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.46VHQmFDxC.exe.210000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.46VHQmFDxC.exe.6d4b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2618697590.00000000006F2000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1371143077.0000000000212000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 46VHQmFDxC.exe PID: 7908, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 8004, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: 46VHQmFDxC.exe, type: SAMPLE
Source: Yara match	File source: 0.0.46VHQmFDxC.exe.264678.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.46VHQmFDxC.exe.6d502000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.46VHQmFDxC.exe.264678.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.46VHQmFDxC.exe.6d502000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.6f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.46VHQmFDxC.exe.210000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.46VHQmFDxC.exe.6d4b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2618697590.00000000006F2000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1371143077.0000000000212000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 46VHQmFDxC.exe PID: 7908, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 8004, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	111 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	311 Process Injection	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	23 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Install Root Certificate	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
46VHQmFDxC.exe	46%	Virustotal		Browse
46VHQmFDxC.exe	78%	ReversingLabs	ByteCode-MSIL.Trojan.Jalapeno
46VHQmFDxC.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\gdi32.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\gdi32.dll	74%	ReversingLabs	Win32.Trojan.LummaC

Source	Detection	Scanner	Label	Link
185.38.142.167:6302	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.43	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
185.38.142.167:6302	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://tempuri.org/Entity/Id24LR	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id22LR	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id20LR	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id15Responsex	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id18Responsex	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/soap/envelope/	MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/	MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id9	MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id19LR	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id17LR	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id22Responsex	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id15LR	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id9LR	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id10Responsex	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id19Responsex	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id13LR	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id7LR	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id11LR	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id1LR	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id5LR	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id3LR	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id6Responsex	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id7Responsex	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id1Responsex	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id21Responsex	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9q	MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.ip.sb/ip	46VHQmFDxC.exe	false	high
http://tempuri.org/Entity/Id23Responsex	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id23LR	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id21LR	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id5Responsex	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id14Responsex	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id2Responsex	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id11Responsex	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id20Responsex	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id8Responsex	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id18LR	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id13Responsex	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id16Responsex	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id16LR	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id8LR	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id14LR	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id6LR	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/	MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id12LR	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id9Responsex	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/08/addressing	MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id10LR	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id3Responsex	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id4LR	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id24Responsex	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id2LR	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm	MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage	MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id12Responsex	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id17Responsex	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence	MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/soap/actor/next	MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id4Responsex	MSBuild.exe, 00000003.00000002.2619903405.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002D98000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2619903405.0000000002E40000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.38.142.167	unknown	Portugal		47674	NETSOLUTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582809
Start date and time:	2024-12-31 15:01:17 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	46VHQmFDxC.exe renamed because original name is a hash value
Original Sample Name:	2b5ceb18f10606859253493d936ae2815b3fed26.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@4/6@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 78 Number of non-executed functions: 85
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 217.20.57.43, 40.69.42.241, 13.85.23.206
Excluded domains from analysis (whitelisted): fe3.delivery.mp.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, 4.8.2.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.0.2.0.c.0.0.3.0.1.3.0.6.2.ip6.arpa, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.38.142.167	ds1bfe33xg.exe	Get hash	malicious	RedLine	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	vEtDFkAZjO.exe	Get hash	malicious	RL STEALER, StormKitty	Browse	199.232.214.172
	GYede3Gwn0.lnk	Get hash	malicious	Unknown	Browse	199.232.210.172
	Qu3ped8inH.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	DIS_37745672.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	199.232.214.172
	https://gogl.to/3HGT	Get hash	malicious	CAPTCHA Scam ClickFix, DcRat, KeyLogger, StormKitty, VenomRAT	Browse	199.232.214.172
	222.msi	Get hash	malicious	XRed	Browse	199.232.214.172
	universityform.xlsm	Get hash	malicious	Unknown	Browse	199.232.210.172
	universityform.xlsm	Get hash	malicious	Unknown	Browse	199.232.210.172
	Payment-Order #24560274 for 8,380 USD.exe	Get hash	malicious	AsyncRAT, PureLog Stealer, zgRAT	Browse	199.232.214.172
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	Payment-Order #24560274 for 8,380 USD.exe	Get hash	malicious	AsyncRAT, PureLog Stealer, zgRAT	Browse	217.20.57.35
	PersonnelPolicies.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	217.20.57.37
	EiO4tqZ3o4.exe	Get hash	malicious	AsyncRAT	Browse	217.20.58.100
	wce.exe	Get hash	malicious	Unknown	Browse	217.20.58.98
	nXNMsYXFFc.exe	Get hash	malicious	Unknown	Browse	217.20.58.100
	5RaYXoKFn9.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	217.20.58.98
	msgde.exe	Get hash	malicious	Quasar	Browse	217.20.58.99
	atw3.dll	Get hash	malicious	Gozi, Ursnif	Browse	217.20.58.100
	WRD1792.docx.doc	Get hash	malicious	Dynamer	Browse	217.20.58.99
	GtEVo1eO2p.exe	Get hash	malicious	LummaC	Browse	217.20.58.98

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NETSOLUTIONSNL	ds1bfe33xg.exe	Get hash	malicious	RedLine	Browse	185.38.142.167
	PRESUPUEST.exe	Get hash	malicious	AsyncRAT	Browse	185.38.142.240
	Aviso de transferencia.exe	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	185.38.142.240
	rUAE_LPO.com.exe	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	185.38.142.240
	A9BripDhRY.lnk	Get hash	malicious	Unknown	Browse	185.38.142.128
	93.123.85.253-bot.armv4l-2024-08-28T17_49_11.elf	Get hash	malicious	Unknown	Browse	188.93.233.79
	a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36_dump.exe	Get hash	malicious	RedLine	Browse	185.38.142.10
	b3u71vBG0u.exe	Get hash	malicious	RedLine	Browse	185.38.142.10
	2MbHBiqXH2.rtf	Get hash	malicious	RedLine	Browse	185.38.142.10
	YPSvIjQCzd.exe	Get hash	malicious	RedLine	Browse	185.38.142.10

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Thu Oct 5 09:31:46 2023, atime=Mon Oct 2 20:46:56 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	3.469830814055419
Encrypted:	false
SSDEEP:	48:8S3bd6TWk1RYrnvPdAKRkdAGdAKRFdAKRX:8Swix
MD5:	0499B0B9E1F8554008490A39DDA10056
SHA1:	C8A73CE4CB72DDFE3BA47654EDFA0BB6E79940D1
SHA-256:	B8754B790747F829BA898083D1288874530D23CF262C9444728E3C41ABB8AFB5
SHA-512:	BC80F2F3D31F2D0D47D6C1A502833070EAB0E1AF32ECCE397C2F3D4F4595AF447E9DE67D464EAE7139C95539255FB28D154C316BD6E7A7CF381D0678808415D1
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ......,......=$w...>'..y... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....EW$O..PROGRA~1..t......O.IEW.S....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VEW.L....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.L..Chrome..>......CW.VEW.L....M......................k..C.h.r.o.m.e.....`.1.....EW.L..APPLIC~1..H......CW.VEW.L...........................k..A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.BW. .chrome.exe..F......CW.VEW.S.............................c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.!.-.-.p.r.o.x.y.-.s.e.r.v.e.r

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\46VHQmFDxC.exe.log

Download File

Process:	C:\Users\user\Desktop\46VHQmFDxC.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Local\Temp\Tmp7327.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\Tmp7338.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	7.6290521879457565
Encrypted:	false
SSDEEP:	48:S7SjQDUJK4jtywGuwh20kS5YH5Ux7DVWdjviSt5jtnJdii:ASUDR4EnubtqJghiStlt71
MD5:	6D347163BA96FE2A36CAD1F4C50F351B
SHA1:	A34B54CFF0D192CE28656783F87589D88DB0DDC2
SHA-256:	63B8F5F0645E9644341ACA46DE51DC6BE9AE133A56A5024D4432C1E3A056BAB7
SHA-512:	253B784462D44D22760A62930C5811064C7EDFB96E2679F7FA78551C1FEB8873B3716E9E497E66D06BEA80657BDFDDE5EB465B04139D44907A32C99681341319
Malicious:	false
Preview:	........'...............P...............{41744BE4-11C5-494C-A213-BA0CE944938E}.....................RSA1..................v..XU~l2_.......vj....b.... ..&...X.Y...=q...).....`.1.0..~......5DL. ..S>.......<..y...?YOA.... eb.QD..B..<.!..'J..+.'...4fu.z./....]@.y.b...o...).j'......0}B.j..R..-..2.....'=...@....s....;. .v=..;...\$...G....2S....al.ZQ.Q...w...aXzW.....................z..O......9.ao...H.O.$........,...C.r.y.p.t.o.A.P.I. .P.r.i.v.a.t.e. .K.e.y....f...... ....}.:.."...7.+.n..#_%#...T............... ....ga.b2.G=G[ 4.....D.h..P.0...k2P.....~..{..I...XY(.$.....~.z..$....p.3M..g?.......W......T...(%...\|Xd..x5.4..$....S.y.\|CTd...F.A.cF..ON...e...6]...:.[mkd.QA.{I..d.h._.2...9W7.V0.90h.xF....D(]Z...B.MV..Ql.a.'.{.f..'..p._...=.{........l"f>z..3.D..(Y..8.T.+.....C....$}(....m-R..!.[.>..E.2.$...D.~.}....Z;=+..{e....B].{...?..X...C.d4..3xz.....x........},... &....v..M.k...1.....K....T.........,d2...9......P.m........'.pB..k.s..S"...$jKUV......

C:\Users\user\AppData\Roaming\gdi32.dll

Download File

Process:	C:\Users\user\Desktop\46VHQmFDxC.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	650752
Entropy (8bit):	6.405343386990597
Encrypted:	false
SSDEEP:	12288:EBSfaEqTMF80CoIvYRC+9Kn/5AI37gy1K4:I4av48cIroKn/5AA7x1K4
MD5:	07CE16EB6B4643175AC5ACC3A15CC02A
SHA1:	51834D46A39105F65D3972E0B79C75A5B1A1CBD2
SHA-256:	174AA2135CBB50558FF4E54A4BA11A4B828559DFD0C31FB0463A364FC532BB9D
SHA-512:	E117FCE03F171EFA94128CA821A2DE0504F72B565E7F15DE8FCD54FBC2477B1AC817C966FEF4EDF39EA02A9CA30E3BFF8FD51EF96A326729662CF96C7EF38BED
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........b.....................A..................{w....................................................Rich...........................PE..L....png...........!.........\............................................... ............@.............................\|...\|...P...............................p..l...................................@...............T............................text............................... ..`.rdata..Re.......f..................@..@.data........ ......................@....reloc..p.......,..................@..B................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.393390788461558
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	46VHQmFDxC.exe
File size:	662'528 bytes
MD5:	ac39e7b10284fe04e5bdb8b588681cb4
SHA1:	2b5ceb18f10606859253493d936ae2815b3fed26
SHA256:	fc7da967f86d24024700aa2a488ae2ce18c038260d9e2d5067261c9bedbcfaf0
SHA512:	0fbff528fe6962f4695be585e8a666af8d4576d75cf37d20e95658e7b1d81bebc0e308b7c4032be139768b077b08e19ed9d474d04a87c0609bac04258ccde809
SSDEEP:	12288:tHQNnEONUb9/6VQBDthHcUzsMyl2zkoF:tqnEldUUfyl2z
TLSH:	75E4085F13BEE608F05A02709995F1765DF1EEA6E403C9F107D42C6B38A5A20EBDCD62
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....png..............0.............n@... ...@....@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x40406e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x676E700D [Fri Dec 27 09:14:53 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
jnl 00007F67188212E2h
cmp cl, dl

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x401c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa4000	0x65c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa0e78	0xa1000	8dd1bcd2bb11c07badb53ca12f4a718c	False	0.3851386597437888	data	6.402565462771295	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa4000	0x65c	0x800	62c1e5e1d4003b9e342aac1547aaf411	False	0.3525390625	data	3.6062262772921683	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa6000	0xc	0x200	5dbda4a38bd7d993b0957a10cb682415	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xa4090	0x3cc	data			0.42489711934156377
RT_MANIFEST	0xa446c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 31, 2024 15:02:17.527473927 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:17.601995945 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:17.605024099 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:17.605528116 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:17.605541945 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:17.605638027 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:17.608050108 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:17.608110905 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:17.612875938 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:17.628099918 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:17.628113985 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:17.628204107 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:17.630876064 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:17.630944967 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:17.635710955 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:17.707417965 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:17.707442045 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:17.707524061 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:17.710364103 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:17.710530043 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:17.715363979 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:17.719059944 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:17.721729994 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:17.732026100 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:17.732053041 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:17.732156038 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:17.734780073 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:17.734780073 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:17.739634037 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:17.810964108 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:17.810980082 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:17.811072111 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:17.814060926 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:17.814156055 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:17.819447041 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:17.822925091 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:17.825503111 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:17.835062027 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:17.835078001 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:17.835175991 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:17.837635040 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:17.837726116 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:17.842521906 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:17.913427114 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:17.913444042 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:17.913567066 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:17.916321993 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:17.916419983 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:17.921314001 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:17.927450895 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:17.930195093 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:17.936232090 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:17.936248064 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:17.936319113 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:17.938668966 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:17.939749002 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:17.944546938 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.018810034 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.018831968 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.018927097 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.022450924 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.023304939 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.028099060 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.035116911 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.037564039 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.042653084 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.042665958 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.042721987 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.044935942 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.045655966 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.050406933 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.126141071 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.126158953 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.126220942 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.128998995 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.129092932 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.134356976 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.140986919 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.143708944 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.146425962 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.146441936 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.146501064 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.148654938 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.148725033 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.153496027 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.198564053 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.229711056 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.229727983 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.229800940 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.232604980 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.232793093 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.237622023 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.237766027 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.244535923 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.247345924 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.249456882 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.249473095 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.249535084 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.252238989 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.252269983 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.257173061 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.333580017 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.333597898 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.333682060 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.348169088 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.351562023 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.351583004 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.351660013 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.359285116 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.365835905 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.366390944 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.367110968 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.370129108 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.370688915 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.372097015 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.418481112 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.463284016 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.465882063 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.465893984 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.465981960 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.467778921 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.467793941 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.467852116 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.556833982 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.589112043 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.593975067 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.617089033 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.618120909 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.619168043 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.621912003 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.622920990 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.623931885 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.632571936 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.637382030 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.687638998 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.687654018 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.687760115 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.715194941 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.718295097 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.718332052 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.718374968 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.718400002 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.720074892 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.728418112 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.731657982 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.733241081 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.738143921 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.741173029 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.786530018 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.809298038 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.827570915 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.827689886 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.832542896 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.832564116 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.832627058 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.866563082 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.867295980 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.871402979 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.872102976 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.889322996 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.889764071 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.894243956 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.894536018 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.918406963 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.967542887 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.967557907 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.967752934 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.975570917 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.981170893 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:18.985968113 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.997661114 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.997675896 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:18.997745991 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.070651054 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.071257114 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.075139999 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.076096058 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.077043056 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.088601112 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.088656902 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.146014929 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.146645069 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.151503086 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.171030045 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.173870087 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.173885107 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.173966885 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.218885899 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.248188972 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.248210907 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.248308897 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.398112059 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.398591042 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.404872894 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.406414032 CET	49674	443	192.168.2.10	173.222.162.55
Dec 31, 2024 15:02:19.407773018 CET	49675	443	192.168.2.10	173.222.162.55
Dec 31, 2024 15:02:19.409945965 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.417640924 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.419032097 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.422513008 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.466558933 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.507194042 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.518982887 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.523941040 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.536129951 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.555938959 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.555954933 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.556056976 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.559103966 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.567631006 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.572516918 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.576220036 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.598063946 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.621179104 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.647511005 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.662906885 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.669116974 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.669141054 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.669208050 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.671338081 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.672219992 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.677644014 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.717187881 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.720254898 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.758774042 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.761717081 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.767194033 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.769264936 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.771931887 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.771948099 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.772022009 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.773989916 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.774100065 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.778815985 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.822506905 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.857927084 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.861867905 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.862781048 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.862864971 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.864779949 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.866674900 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.869700909 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.874330997 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.874345064 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.874411106 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.878639936 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.879722118 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.884778976 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.953668118 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.956521988 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.974468946 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.977284908 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.978688955 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.978704929 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:19.978759050 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.980758905 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.982367992 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:19.985671043 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.030514956 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.052297115 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.056170940 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.061021090 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.069602013 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.071866035 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.082815886 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.082830906 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.082914114 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.085083961 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.085201979 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.090032101 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.152101040 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.154619932 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.167656898 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.169847965 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.180850983 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.182826042 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.186206102 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.186220884 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.186317921 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.188796043 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.188929081 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.193603992 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.234498978 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.269608021 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.272526026 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.277406931 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.282367945 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.284745932 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.288054943 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.288069963 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.288140059 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.290461063 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.290461063 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.295275927 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.338557959 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.368419886 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.371200085 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.376065969 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.378972054 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.380902052 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.386271954 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.388242006 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.391113043 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.391139984 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.391242981 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.391242981 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.393362999 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.393523932 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.398168087 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.445871115 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.481221914 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.483998060 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.488981962 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.490125895 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.492311001 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.512626886 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.512643099 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.512721062 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.515003920 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.515027046 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.519768953 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.588171005 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.590717077 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.611799002 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.614588976 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.619831085 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.622345924 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.631407022 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.631419897 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.631529093 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.633915901 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.633960009 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.638747931 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.710315943 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.713546991 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.722218037 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.724980116 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.729681015 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.731872082 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.732887030 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.732902050 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.732985020 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.735215902 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.735403061 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.740035057 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.782507896 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.820683956 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.823791981 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.823864937 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.824126005 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.826020002 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.828613997 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.830820084 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.830997944 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.833080053 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.835839987 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.835854053 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.835916042 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.835928917 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.837975025 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.838077068 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.842729092 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.890480042 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.927678108 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.930771112 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.932225943 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.932240009 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.932313919 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.934557915 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.934711933 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.935550928 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.939218998 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.939233065 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.939424992 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.939485073 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:20.941689014 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.941807985 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:20.946647882 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.030143023 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.033937931 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.035140038 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.035156012 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.035294056 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.037640095 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.037749052 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.042298079 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.042323112 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.042448044 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.042498112 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.044956923 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.045032978 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.049843073 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.143707991 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.143742085 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.144264936 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.147423029 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.148257017 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.148278952 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.148327112 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.148341894 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.152391911 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.154086113 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.154674053 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.157198906 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.159486055 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.246912003 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.248688936 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.248769045 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.252193928 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.252255917 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.255753994 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.255773067 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.255857944 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.255857944 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.257045031 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.259980917 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.260318995 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.265155077 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.339000940 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.342536926 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.351280928 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.351301908 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.351357937 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.354739904 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.354887009 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.359673977 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.361933947 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.361953974 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.361999035 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.364425898 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.364806890 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.369519949 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.464185953 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.464205027 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.464215994 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.464245081 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.467987061 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.468044043 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.468380928 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.472862005 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.480814934 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.480842113 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.480885983 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.484492064 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.484566927 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.489607096 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.500123024 CET	49677	443	192.168.2.10	20.42.65.85
Dec 31, 2024 15:02:21.577038050 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.577064991 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.577163935 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.580332994 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.580568075 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.580643892 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.582863092 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.585541010 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.585608959 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.585623026 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.585670948 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.585686922 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.588057995 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.588202000 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.592875957 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.638526917 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.680425882 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.682600021 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.682612896 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.682665110 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.685380936 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.685811996 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.686722994 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.689862967 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.689877033 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.689945936 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.690198898 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.690601110 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.691478968 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.692349911 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.693111897 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.697171926 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.697976112 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.783730030 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.786633968 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.786633968 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.786648035 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.786695957 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.790775061 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.791410923 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.792330980 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.793776035 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.793787956 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.793842077 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.797142982 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.798180103 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.799504042 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.804357052 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.885270119 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.888984919 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.893620968 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.893646002 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.893676043 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.893716097 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.896739006 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.896832943 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.898914099 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.898929119 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.898979902 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.901402950 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.901679039 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.901818991 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.906577110 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.989867926 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.992968082 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.997191906 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.997262955 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.997467995 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:21.997518063 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.999738932 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:21.999758959 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.004884958 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.006252050 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.006267071 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.006314039 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.017649889 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.018342972 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.023150921 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.095942974 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.098757029 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.098782063 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.098835945 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.111287117 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.112498045 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.116853952 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.117306948 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.126365900 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.126380920 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.126426935 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.130209923 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.130970955 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.135772943 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.212661028 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.215636015 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.215653896 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.215822935 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.216461897 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.218252897 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.218369007 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.223061085 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.231122017 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.231141090 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.231208086 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.234457016 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.235101938 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.240118027 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.317441940 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.317459106 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.317539930 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.320692062 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.321088076 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.322029114 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.324147940 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.325922966 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.336029053 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.336047888 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.336240053 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.339154959 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.339292049 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.344115019 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.420347929 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.424093008 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.426012039 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.426035881 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.426079035 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.426147938 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.428714991 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.429109097 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.433558941 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.447177887 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.447200060 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.447283030 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.450248003 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.450464010 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.463516951 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.524550915 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.527674913 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.530539036 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.530560970 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.530608892 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.530608892 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.533034086 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.535706043 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.537837982 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.562402964 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.562417030 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.562489033 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.565500975 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.565598965 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.570369959 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.628858089 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.631577969 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.634141922 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.634160042 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.634228945 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.636754990 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.636842012 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.641550064 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.667339087 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.667355061 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.667474031 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.732855082 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.737507105 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.737540007 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.737658024 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.843956947 CET	49671	443	192.168.2.10	204.79.197.203
Dec 31, 2024 15:02:22.925205946 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.926424026 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.926795006 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.927138090 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.927278996 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:22.931328058 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:22.932044983 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:23.023598909 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:23.026842117 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:23.026854992 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:23.026952982 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:23.027229071 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:23.027287006 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:23.027309895 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:23.029277086 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:23.033679008 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:23.035006046 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:23.035085917 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:23.036256075 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:23.038480997 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:23.039854050 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:23.082523108 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:23.127927065 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:23.132091045 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:23.132105112 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:23.132165909 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:23.138649940 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:23.138663054 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:23.138674021 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:23.138696909 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:23.138756037 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:23.140311003 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:23.140321970 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:23.140336990 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:23.140348911 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:23.140383959 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:23.140422106 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:23.218853951 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:23.221513987 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:23.225483894 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:23.226329088 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:23.245158911 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:23.248358011 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:23.250078917 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:23.254101038 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:23.280745983 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:23.289084911 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:23.320975065 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:23.332299948 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:23.350183964 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:23.350271940 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:23.350342989 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:23.354201078 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:23.361253023 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:23.361272097 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:23.361388922 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:23.366667032 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:23.369901896 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:23.374820948 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:23.428232908 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:23.431643009 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:23.463768005 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:23.463788986 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:23.463953972 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:23.467995882 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:23.469096899 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:23.514506102 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:23.515758038 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:23.527381897 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:23.553549051 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:23.553613901 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:23.644164085 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:02:23.703278065 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:02:28.221113920 CET	49702	6302	192.168.2.10	185.38.142.167
Dec 31, 2024 15:02:28.225989103 CET	6302	49702	185.38.142.167	192.168.2.10
Dec 31, 2024 15:02:28.226078987 CET	49702	6302	192.168.2.10	185.38.142.167
Dec 31, 2024 15:02:28.243810892 CET	49702	6302	192.168.2.10	185.38.142.167
Dec 31, 2024 15:02:28.248603106 CET	6302	49702	185.38.142.167	192.168.2.10
Dec 31, 2024 15:02:29.015783072 CET	49674	443	192.168.2.10	173.222.162.55
Dec 31, 2024 15:02:29.015810013 CET	49675	443	192.168.2.10	173.222.162.55
Dec 31, 2024 15:02:31.109671116 CET	49677	443	192.168.2.10	20.42.65.85
Dec 31, 2024 15:02:49.602500916 CET	6302	49702	185.38.142.167	192.168.2.10
Dec 31, 2024 15:02:49.602586985 CET	49702	6302	192.168.2.10	185.38.142.167
Dec 31, 2024 15:02:49.628359079 CET	49702	6302	192.168.2.10	185.38.142.167
Dec 31, 2024 15:02:54.644763947 CET	49706	6302	192.168.2.10	185.38.142.167
Dec 31, 2024 15:02:54.649636030 CET	6302	49706	185.38.142.167	192.168.2.10
Dec 31, 2024 15:02:54.649719954 CET	49706	6302	192.168.2.10	185.38.142.167
Dec 31, 2024 15:02:54.650017977 CET	49706	6302	192.168.2.10	185.38.142.167
Dec 31, 2024 15:02:54.654824018 CET	6302	49706	185.38.142.167	192.168.2.10
Dec 31, 2024 15:03:07.258022070 CET	58226	53	192.168.2.10	162.159.36.2
Dec 31, 2024 15:03:07.262831926 CET	53	58226	162.159.36.2	192.168.2.10
Dec 31, 2024 15:03:07.262967110 CET	58226	53	192.168.2.10	162.159.36.2
Dec 31, 2024 15:03:07.263108015 CET	58226	53	192.168.2.10	162.159.36.2
Dec 31, 2024 15:03:07.267847061 CET	53	58226	162.159.36.2	192.168.2.10
Dec 31, 2024 15:03:07.715683937 CET	53	58226	162.159.36.2	192.168.2.10
Dec 31, 2024 15:03:07.716490030 CET	58226	53	192.168.2.10	162.159.36.2
Dec 31, 2024 15:03:07.721445084 CET	53	58226	162.159.36.2	192.168.2.10
Dec 31, 2024 15:03:07.721515894 CET	58226	53	192.168.2.10	162.159.36.2
Dec 31, 2024 15:03:16.062514067 CET	6302	49706	185.38.142.167	192.168.2.10
Dec 31, 2024 15:03:16.062661886 CET	49706	6302	192.168.2.10	185.38.142.167
Dec 31, 2024 15:03:16.063055992 CET	49706	6302	192.168.2.10	185.38.142.167
Dec 31, 2024 15:03:21.080064058 CET	58229	6302	192.168.2.10	185.38.142.167
Dec 31, 2024 15:03:21.084995031 CET	6302	58229	185.38.142.167	192.168.2.10
Dec 31, 2024 15:03:21.085120916 CET	58229	6302	192.168.2.10	185.38.142.167
Dec 31, 2024 15:03:21.085494995 CET	58229	6302	192.168.2.10	185.38.142.167
Dec 31, 2024 15:03:21.090274096 CET	6302	58229	185.38.142.167	192.168.2.10
Dec 31, 2024 15:03:42.479213953 CET	6302	58229	185.38.142.167	192.168.2.10
Dec 31, 2024 15:03:42.479352951 CET	58229	6302	192.168.2.10	185.38.142.167
Dec 31, 2024 15:03:42.479696989 CET	58229	6302	192.168.2.10	185.38.142.167
Dec 31, 2024 15:03:47.486526012 CET	58230	6302	192.168.2.10	185.38.142.167
Dec 31, 2024 15:03:47.491309881 CET	6302	58230	185.38.142.167	192.168.2.10
Dec 31, 2024 15:03:47.491529942 CET	58230	6302	192.168.2.10	185.38.142.167
Dec 31, 2024 15:03:47.491648912 CET	58230	6302	192.168.2.10	185.38.142.167
Dec 31, 2024 15:03:47.496407986 CET	6302	58230	185.38.142.167	192.168.2.10
Dec 31, 2024 15:03:53.569931984 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:03:53.570214987 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:03:53.570302010 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:03:53.570791006 CET	49701	443	192.168.2.10	13.107.246.45
Dec 31, 2024 15:03:53.578632116 CET	443	49701	13.107.246.45	192.168.2.10
Dec 31, 2024 15:04:08.854748964 CET	6302	58230	185.38.142.167	192.168.2.10
Dec 31, 2024 15:04:08.854921103 CET	58230	6302	192.168.2.10	185.38.142.167
Dec 31, 2024 15:04:08.855304003 CET	58230	6302	192.168.2.10	185.38.142.167
Dec 31, 2024 15:04:13.862313032 CET	58231	6302	192.168.2.10	185.38.142.167
Dec 31, 2024 15:04:13.867153883 CET	6302	58231	185.38.142.167	192.168.2.10
Dec 31, 2024 15:04:13.870332003 CET	58231	6302	192.168.2.10	185.38.142.167
Dec 31, 2024 15:04:13.870609999 CET	58231	6302	192.168.2.10	185.38.142.167
Dec 31, 2024 15:04:13.875387907 CET	6302	58231	185.38.142.167	192.168.2.10

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 31, 2024 15:03:07.257273912 CET	53	55970	162.159.36.2	192.168.2.10
Dec 31, 2024 15:03:07.728368998 CET	53	55451	1.1.1.1	192.168.2.10

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 31, 2024 15:02:40.999761105 CET	1.1.1.1	192.168.2.10	0x8ff5	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 15:02:40.999761105 CET	1.1.1.1	192.168.2.10	0x8ff5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.43	A (IP address)	IN (0x0001)	false
Dec 31, 2024 15:02:40.999761105 CET	1.1.1.1	192.168.2.10	0x8ff5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.19	A (IP address)	IN (0x0001)	false
Dec 31, 2024 15:02:40.999761105 CET	1.1.1.1	192.168.2.10	0x8ff5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.21	A (IP address)	IN (0x0001)	false
Dec 31, 2024 15:02:40.999761105 CET	1.1.1.1	192.168.2.10	0x8ff5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.22	A (IP address)	IN (0x0001)	false
Dec 31, 2024 15:02:40.999761105 CET	1.1.1.1	192.168.2.10	0x8ff5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.42	A (IP address)	IN (0x0001)	false
Dec 31, 2024 15:02:40.999761105 CET	1.1.1.1	192.168.2.10	0x8ff5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.23	A (IP address)	IN (0x0001)	false
Dec 31, 2024 15:02:40.999761105 CET	1.1.1.1	192.168.2.10	0x8ff5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.24	A (IP address)	IN (0x0001)	false
Dec 31, 2024 15:02:40.999761105 CET	1.1.1.1	192.168.2.10	0x8ff5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.38	A (IP address)	IN (0x0001)	false
Dec 31, 2024 15:02:54.227797031 CET	1.1.1.1	192.168.2.10	0x3551	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 31, 2024 15:02:54.227797031 CET	1.1.1.1	192.168.2.10	0x3551	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	09:02:21
Start date:	31/12/2024
Path:	C:\Users\user\Desktop\46VHQmFDxC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\46VHQmFDxC.exe"
Imagebase:	0x210000
File size:	662'528 bytes
MD5 hash:	AC39E7B10284FE04E5BDB8B588681CB4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: infostealer_win_redline_strings, Description: Finds Redline samples based on characteristic strings, Source: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmp, Author: Sekoia.io Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000000.1371143077.0000000000212000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:02:21
Start date:	31/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	09:02:22
Start date:	31/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x890000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000003.00000002.2618697590.00000000006F2000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	12.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.7%
Total number of Nodes:	1474
Total number of Limit Nodes:	13

Executed Functions

Function 6D4C69B0 Relevance: 113.7, APIs: 34, Strings: 26, Instructions: 8741nativethreadmemoryCOMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNELBASE(?,?,?,?,?), ref: 6D4C8DEE
ShowWindow.USER32 ref: 6D4C8E04
VirtualAlloc.KERNELBASE ref: 6D4C92D2
CreateProcessW.KERNELBASE ref: 6D4C9AA2
NtGetContextThread.NTDLL ref: 6D4C9B56
NtAllocateVirtualMemory.NTDLL ref: 6D4C9D4B
NtAllocateVirtualMemory.NTDLL ref: 6D4C9F7F
NtWriteVirtualMemory.NTDLL ref: 6D4CA139
NtWriteVirtualMemory.NTDLL ref: 6D4CA740
NtWriteVirtualMemory.NTDLL ref: 6D4CAC04
NtReadVirtualMemory.NTDLL ref: 6D4CBD0D
NtWriteVirtualMemory.NTDLL ref: 6D4CBE8A
NtWriteVirtualMemory.NTDLL ref: 6D4CC79B
NtCreateThreadEx.NTDLL ref: 6D4CCF88
NtSetContextThread.NTDLL ref: 6D4CD2DB
NtResumeThread.NTDLL ref: 6D4CD2F9
CloseHandle.KERNEL32 ref: 6D4CD53C
CloseHandle.KERNEL32 ref: 6D4CD550
VirtualAlloc.KERNEL32 ref: 6D4CD67D
NtGetContextThread.NTDLL ref: 6D4CD6F6
NtAllocateVirtualMemory.NTDLL ref: 6D4CD767
NtWriteVirtualMemory.NTDLL ref: 6D4CDA16
NtWriteVirtualMemory.NTDLL ref: 6D4CE279
NtSetContextThread.NTDLL ref: 6D4CE4C5
NtResumeThread.NTDLL ref: 6D4CE4E3
VirtualAlloc.KERNEL32 ref: 6D4CE69A
NtAllocateVirtualMemory.NTDLL ref: 6D4CE746
NtWriteVirtualMemory.NTDLL ref: 6D4CE854
NtWriteVirtualMemory.NTDLL ref: 6D4CECCF
NtReadVirtualMemory.NTDLL ref: 6D4CEE00
NtWriteVirtualMemory.NTDLL ref: 6D4CEE8E
NtSetContextThread.NTDLL ref: 6D4CEF59
NtResumeThread.NTDLL ref: 6D4CEF77

Strings

7HXQ, xrefs: 6D4CA47C
'`a, xrefs: 6D4CA600
fZ>, xrefs: 6D4C91FE
NFdu, xrefs: 6D4C95FA
'`a, xrefs: 6D4CA59E
-VMN, xrefs: 6D4C999F
NFdu, xrefs: 6D4C9643
'K1, xrefs: 6D4CB072
j0, xrefs: 6D4CE9B6
54, xrefs: 6D4CBB7A
D, xrefs: 6D4C9402
ur, xrefs: 6D4CADCB
T[~., xrefs: 6D4CA398
kernel32.dll, xrefs: 6D4C8E0A
54, xrefs: 6D4CBBFE
^L, xrefs: 6D4CBE13
g^/V, xrefs: 6D4C9CAB
4:q&, xrefs: 6D4C9AAA
@, xrefs: 6D4CE73E
d7V+, xrefs: 6D4CD47D
T[~., xrefs: 6D4CA409
j0, xrefs: 6D4CB933
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 6D4C98E8
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe, xrefs: 6D4C9919
4Ou\, xrefs: 6D4C98A6
ntdll.dll, xrefs: 6D4C8E1E

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID: Virtual$Memory$Write$Thread$Context$Allocate$AllocResume$CloseCreateHandleReadWindow$ConsoleProcessShow
String ID: ^L$'`a$'`a$-VMN$4:q&$4Ou\$54$54$7HXQ$@$C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe$D$NFdu$NFdu$T[~.$T[~.$d7V+$fZ>$g^/V$j0$j0$kernel32.dll$ntdll.dll$ur$'K1
API String ID: 683547147-620754675
Opcode ID: 95e697d452a2f06b6ba666e3564973ce48208f6bac69c22b008a24a495713578
Instruction ID: 77dd1580c2e51cbba3f10faf7b089544d5f6aadd864556e7ccc5652bc97aedb4
Opcode Fuzzy Hash: 95e697d452a2f06b6ba666e3564973ce48208f6bac69c22b008a24a495713578
Instruction Fuzzy Hash: 70E3253AA542118FCF15CE3CC9D5BD97BF2BB86311F108598D419DB7A4C63A8D8A8F42

Function 6D4BEA10 Relevance: 72.6, APIs: 27, Strings: 12, Instructions: 4382memoryfileCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6D4BFA6C
K32GetModuleInformation.KERNEL32 ref: 6D4C0117
GetModuleFileNameA.KERNEL32 ref: 6D4C043F
CreateFileA.KERNELBASE ref: 6D4C061E
CreateFileMappingA.KERNEL32 ref: 6D4C06C2
CloseHandle.KERNEL32 ref: 6D4C0AD7
MapViewOfFile.KERNELBASE ref: 6D4C0BB6
VirtualProtect.KERNELBASE ref: 6D4C14CC
VirtualProtect.KERNELBASE ref: 6D4C175C
CloseHandle.KERNELBASE ref: 6D4C1A53
CloseHandle.KERNEL32 ref: 6D4C1B76
CloseHandle.KERNEL32 ref: 6D4C1C8B
GetModuleHandleA.KERNEL32 ref: 6D4C205D
GetModuleFileNameA.KERNEL32 ref: 6D4C21EF
VirtualProtect.KERNEL32 ref: 6D4C253F
VirtualProtect.KERNEL32 ref: 6D4C25F3
CloseHandle.KERNEL32 ref: 6D4C2636
CloseHandle.KERNEL32 ref: 6D4C2654
GetCurrentProcess.KERNEL32 ref: 6D4C2768
K32GetModuleInformation.KERNEL32 ref: 6D4C27E8
GetModuleFileNameA.KERNEL32 ref: 6D4C2851
CloseHandle.KERNEL32 ref: 6D4C28BD
VirtualProtect.KERNEL32 ref: 6D4C2990
CloseHandle.KERNEL32 ref: 6D4C2A4D

Strings

IT\g, xrefs: 6D4C28E7
=T3, xrefs: 6D4C1292
@, xrefs: 6D4C2984
d1A, xrefs: 6D4C0411
t0O, xrefs: 6D4C17AB
(i!, xrefs: 6D4C1B43
XX, xrefs: 6D4C090A
XX, xrefs: 6D4C08B0
6|Q, xrefs: 6D4C1D5F
#(q, xrefs: 6D4C1676
#(q, xrefs: 6D4C16C7
IT\g, xrefs: 6D4C0E66

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID: Handle$Close$FileModule$ProtectVirtual$Name$CreateCurrentInformationProcess$MappingView
String ID: #(q$#(q$(i!$=T3$@$IT\g$IT\g$XX$XX$d1A$t0O$6|Q
API String ID: 753040704-289776380
Opcode ID: 3b417dd48233a1fa76aeb27f6b14d592e609b578cb77a8a1dfcd470281dea0e4
Instruction ID: 1c70e043467033072569d51d14a9aa322f36bf15c8be9f9c429efddc51227bb0
Opcode Fuzzy Hash: 3b417dd48233a1fa76aeb27f6b14d592e609b578cb77a8a1dfcd470281dea0e4
Instruction Fuzzy Hash: A073F03AA542158FCF14CE3CC9D4BDA37F2AB46360F10D669D419DB394DB369D8A8B02

Function 6D4C55B0 Relevance: 16.8, APIs: 3, Strings: 6, Instructions: 1054
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,?), ref: 6D4C5C75

Strings

|4vB, xrefs: 6D4C60CA
NtQueryInformationProcess, xrefs: 6D4C5C7D, 6D4C6443
?;Ap, xrefs: 6D4C5B7F
|4vB, xrefs: 6D4C647F
^(&>, xrefs: 6D4C5DCF
ntdll.dll, xrefs: 6D4C5C69, 6D4C642F

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID: HandleModule
String ID: ?;Ap$NtQueryInformationProcess$^(&>$ntdll.dll$|4vB$|4vB
API String ID: 4139908857-977781304
Opcode ID: 62e2cb42acda80bcfebcb55276af4e3997df8e1e5b7f945cf895e15841ce3a83
Instruction ID: 3cc940f372046211ff5096c0c21ac8cebc711730761052fa5fee4df0902a2fe4
Opcode Fuzzy Hash: 62e2cb42acda80bcfebcb55276af4e3997df8e1e5b7f945cf895e15841ce3a83
Instruction Fuzzy Hash: 4272F03AA642018FCF05CE7CC694BED7BF2AB42364F20C515D415DB7A4D6269D0BCB4A

Function 6D4EFA1E Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6D4EFA65
___scrt_uninitialize_crt.LIBCMT ref: 6D4EFA7F

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: cbf058efe00b5afccd407c909435f2236cf3207e3fc6224fcdd02495c965c5a9
Instruction ID: edb0623504e0f2a1e7459010d1c9426fd908287d932997a2a0042ab4a74ed086
Opcode Fuzzy Hash: cbf058efe00b5afccd407c909435f2236cf3207e3fc6224fcdd02495c965c5a9
Instruction Fuzzy Hash: 7E41D372E0A219BFDB11CF69EC40F6E3A74EBC47E6F12411AEA146B250D7708D428BD0

Function 6D4EFACE Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 6D4EFB0B
dllmain_crt_dispatch.LIBCMT ref: 6D4EFB22
dllmain_raw.LIBCMT ref: 6D4EFB6A
dllmain_crt_dispatch.LIBCMT ref: 6D4EFB7D
dllmain_raw.LIBCMT ref: 6D4EFB90

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 101bb9aec922bbae927d97772472d0f358a28c952bcf7864361293e538e48e00
Instruction ID: 264c7ddede44f0818a7e70fe37fed5e972cde4b2d124f1ccbdb8ab52fbdf481e
Opcode Fuzzy Hash: 101bb9aec922bbae927d97772472d0f358a28c952bcf7864361293e538e48e00
Instruction Fuzzy Hash: AB219172D0621ABFDB11CE55EC50E7F3A68EBC07D6B12415AFA146B250E3308D418BD0

Function 6D4EF917 Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6D4EF964

Part of subcall function 6D4EFE33: InitializeSListHead.KERNEL32(6D54DE50,6D4EF96E,6D5008C0,00000010,6D4EF8FF,?,?,?,6D4EFB27,?,00000001,?,?,00000001,?,6D500908), ref: 6D4EFE38

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6D4EF9CE

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: 1e6b6e787053e30a6b82ee86426827af57306c52922a3eda53c68eafa689a689
Instruction ID: 82cd4c370a4eeb0469fe59de9c1663e292bb1db2be00480a1966388faa614320
Opcode Fuzzy Hash: 1e6b6e787053e30a6b82ee86426827af57306c52922a3eda53c68eafa689a689
Instruction Fuzzy Hash: 6821C63214E246BEDF00EF64B544FAE37615F973AEF61401EDA806B2D2CB621D82C6D5

Function 6D4F401E Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,6D4F3D89,00000001,00000364,FFFFFFFF,000000FF,?,00000001,6D4F4010,6D4F3F4D,?,?,6D4F3439), ref: 6D4F405F

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d258ea86f9a78eaeb899b18e4e0e532ce4c5a20676b60630e7c501b7079e7a0a
Instruction ID: d3723c88ac6613da84d682f8fd953575810bba3f58818188522fe5ef66fb74c8
Opcode Fuzzy Hash: d258ea86f9a78eaeb899b18e4e0e532ce4c5a20676b60630e7c501b7079e7a0a
Instruction Fuzzy Hash: 73F0BB312445355EDB119A55CD04F6B3768EFC67E0B114515E82DE7270CF20DC0385D5

Non-executed Functions

Function 6D4C2B60 Relevance: 12.9, Strings: 8, Instructions: 2893COMMON

Download Yara Rule

Strings

se(&, xrefs: 6D4C4975
S[Aw, xrefs: 6D4C2BD1
Ztb_, xrefs: 6D4C5358
MA, xrefs: 6D4C49F6
UM^M, xrefs: 6D4C47F4
UM^M, xrefs: 6D4C4795
k25, xrefs: 6D4C386D
MA, xrefs: 6D4C4970

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID: S[Aw$UM^M$UM^M$Ztb_$se(&$MA$MA$k25
API String ID: 0-2283769935
Opcode ID: d6060538cf8972e20a2aba7f0d2ac943f4786038ccef2adf098d4454f3928844
Instruction ID: 633735597dbb437f33119badf3d1951f72ad490532e08d73a73808f72dac404a
Opcode Fuzzy Hash: d6060538cf8972e20a2aba7f0d2ac943f4786038ccef2adf098d4454f3928844
Instruction Fuzzy Hash: 1623EF3AA502118FDF15CE3CC994BDD77F2AB47320F10D5599819DB399CA3A8D8A8F12

Function 6D4D15B0 Relevance: 7.8, Strings: 5, Instructions: 1588COMMON

Download Yara Rule

Strings

%n, xrefs: 6D4D29A7
G0wC, xrefs: 6D4D1E42
ymf*, xrefs: 6D4D25DB
%n, xrefs: 6D4D2959
G0wC, xrefs: 6D4D1DDE

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID: %n$%n$G0wC$G0wC$ymf*
API String ID: 0-2180225338
Opcode ID: 6121cf46bf257245de40548289b148f15033d147feb640862c8c11f0af69cc32
Instruction ID: e7806039dec3b8567139cdae3e470929ce9e7c3bd74dd2e458f38d116c56d048
Opcode Fuzzy Hash: 6121cf46bf257245de40548289b148f15033d147feb640862c8c11f0af69cc32
Instruction Fuzzy Hash: 51B20332A541818FCF09CEBCC9E5BDD3BE2FB82325F159519D811DB798CB6A8C4A9701

Function 6D4E5BE0 Relevance: 7.7, Strings: 5, Instructions: 1441COMMON

Download Yara Rule

Strings

St, xrefs: 6D4E67F8
>:"v, xrefs: 6D4E65C1
uut, xrefs: 6D4E66F8
St, xrefs: 6D4E6F48
uut, xrefs: 6D4E6685

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID: >:"v$St$St$uut$uut
API String ID: 0-2352700851
Opcode ID: 87aa6daff17bfb791cf0d57e5f3645923c06573fbb57d990b06807a334349aa5
Instruction ID: b5a9cf4425a7836895ed7766e53e3f75402123dffa1d17b1db55bb950d1181f2
Opcode Fuzzy Hash: 87aa6daff17bfb791cf0d57e5f3645923c06573fbb57d990b06807a334349aa5
Instruction Fuzzy Hash: 56A26772A502019FCF05CF7CC594BDD7BF2AB423A6F218A15E925DB794C2269D0BCB41

Function 6D4E3D40 Relevance: 6.9, Strings: 4, Instructions: 1851COMMON

Download Yara Rule

Strings

<d, xrefs: 6D4E4D79
d)Jd, xrefs: 6D4E519D
3Y/R, xrefs: 6D4E534F
3Y/R, xrefs: 6D4E56A4

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID: 3Y/R$3Y/R$d)Jd$<d
API String ID: 0-3994705701
Opcode ID: 9ffc2be5d62d742dbd3493b125255995320a6be5a221c3d32000f2c46a6ea215
Instruction ID: 2cb57948d88148b3b74e8c6adc6a68a50157746350b12392781f1645ece9fb7d
Opcode Fuzzy Hash: 9ffc2be5d62d742dbd3493b125255995320a6be5a221c3d32000f2c46a6ea215
Instruction Fuzzy Hash: B1D28732A602029FDF09CE7CD5D57ED77F2AB463A2F259515D421CB7A8C62A8D0ACF01

Function 6D4D5DD0 Relevance: 6.8, Strings: 4, Instructions: 1841COMMON

Download Yara Rule

Strings

n_]A, xrefs: 6D4D7358
n_]A, xrefs: 6D4D6567
e?9, xrefs: 6D4D6FDB
pu7(, xrefs: 6D4D6AA8

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID: e?9$n_]A$n_]A$pu7(
API String ID: 0-686607234
Opcode ID: 421933262e56f63dfa916cdeb50b5ea7c35644f270c9d0b1c22485f9eb75c029
Instruction ID: a2e5f74755af47cc626801a0f4ce2f5cd2d86fd67a3bdcf47458f63068e628a2
Opcode Fuzzy Hash: 421933262e56f63dfa916cdeb50b5ea7c35644f270c9d0b1c22485f9eb75c029
Instruction Fuzzy Hash: A9D23532A545028FCF49CE7CC5E5BDD3BF2AB46360F15D519D822DB798C62A8C0ACB42

Function 6D4DA730 Relevance: 6.3, Strings: 4, Instructions: 1337COMMON

Download Yara Rule

Strings

y73, xrefs: 6D4DB5C1
m \, xrefs: 6D4DA789
mx$K, xrefs: 6D4DAEA7
y73, xrefs: 6D4DB573

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID: mx$K$m \$y73$y73
API String ID: 0-885510288
Opcode ID: dba37524b2e64ed27696591871453b14036ca9457fcde1c28ba1ff547fe9bc23
Instruction ID: e9976fe3c2a84d458ff06a7271285839ff8d22d17fd94683d0a33ab55045dd92
Opcode Fuzzy Hash: dba37524b2e64ed27696591871453b14036ca9457fcde1c28ba1ff547fe9bc23
Instruction Fuzzy Hash: 8FA21376A542458FCF05CE7CC9A5BDE7BF2BB46320F108619D865DB794C3369C0A8B11

Function 6D4F0152 Relevance: 6.1, APIs: 4, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 6D4F015E
IsDebuggerPresent.KERNEL32 ref: 6D4F022A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6D4F024A
UnhandledExceptionFilter.KERNEL32(?), ref: 6D4F0254

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: fddf42b44f54aa0002a93dfe8e4dbc09f54a514849d3b01b7f9c4735971db8e0
Instruction ID: 891f0311c9bd654f30db92be1b1c505b6284b8adea134b3d65f49bd049c8b0a9
Opcode Fuzzy Hash: fddf42b44f54aa0002a93dfe8e4dbc09f54a514849d3b01b7f9c4735971db8e0
Instruction Fuzzy Hash: C1312575D0521C9BEF10DFA1D989BCDBBB8FF88304F1040AAE408AB250EB719E858F54

Function 6D4E1260 Relevance: 5.9, Strings: 4, Instructions: 897COMMON

Download Yara Rule

Strings

" (S, xrefs: 6D4E15F8
K3, xrefs: 6D4E1B16
" (S, xrefs: 6D4E1E59
K3, xrefs: 6D4E1AC8

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID: K3$ K3$" (S$" (S
API String ID: 0-1294071290
Opcode ID: 458227704650c7c7c09461148cfb2d83d35d3d8a81c21fbada31f57060679c5a
Instruction ID: 90eb7d0104bc6e70cf7bff0339f57984e91e374e08c46cef097415fb0ac9ef6d
Opcode Fuzzy Hash: 458227704650c7c7c09461148cfb2d83d35d3d8a81c21fbada31f57060679c5a
Instruction Fuzzy Hash: 3D62FE76A90101AFCF09CF7CD590BDD77F2AB463A2F10D215E826EB754C62A8C4A8B54

Function 6D4DC170 Relevance: 5.1, APIs: 3, Instructions: 551COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8d10ea38290d0412693cb8bc17b600b290252435ff1406ac6c09d8140aad40c
Instruction ID: 445483dcbe948afa6953d086d47be4edbb685bde6c9af7e3b9318bd1406b51a6
Opcode Fuzzy Hash: d8d10ea38290d0412693cb8bc17b600b290252435ff1406ac6c09d8140aad40c
Instruction Fuzzy Hash: 00025972A515118FDF09CD7CC4F5BEE37E2BB8A321F259619E521DB394C22A4D0A8B41

Function 6D4CEFA0 Relevance: 4.9, Strings: 3, Instructions: 1133COMMONLIBRARYCODE

Download Yara Rule

Strings

.O)P, xrefs: 6D4CF955
r`fe, xrefs: 6D4CFEAC
r`fe, xrefs: 6D4CFEF2

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID: .O)P$r`fe$r`fe
API String ID: 0-4212609085
Opcode ID: 9429bee8a94292c09fc35ef53a8f85f8b7ab1d660e33eb19c523cfe80cb5ce0c
Instruction ID: 200fdb6e17cc1379c813661371e2b00abe1f8a951a238be2797cd02697581438
Opcode Fuzzy Hash: 9429bee8a94292c09fc35ef53a8f85f8b7ab1d660e33eb19c523cfe80cb5ce0c
Instruction Fuzzy Hash: 1982153AA565018FDF05CE7CD5D1BDD7BF2EB46360F25911AE811EB394C62E8C4A8B02

Function 6D4EED10 Relevance: 4.6, Strings: 3, Instructions: 872COMMON

Download Yara Rule

Strings

vwv&, xrefs: 6D4EF657
[]=/, xrefs: 6D4EF1DB
vwv&, xrefs: 6D4EF6B5

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID: []=/$vwv&$vwv&
API String ID: 0-3587720153
Opcode ID: 6c90fadf3be51541e184865b3bf1c523971f1a7221012835d51c41d132dea14a
Instruction ID: f07baa4774eb01538fd03525f37b939f5712bf7718488a274ff354ce62eebdb0
Opcode Fuzzy Hash: 6c90fadf3be51541e184865b3bf1c523971f1a7221012835d51c41d132dea14a
Instruction Fuzzy Hash: 8D527932AA06119FCF05CE7CD4D5BDE7BF2BB46362F259219D811DB795D32A8C0A8B01

Function 6D4F263C Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 6D4F2734
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 6D4F273E
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 6D4F274B

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 8251d807fdd2223fe39da203c84c081a44044d04d067d328e7e0dcd92c4ff6bc
Instruction ID: ac7ae37d5420dfe6d6baa40767826c1971f9349204a1487b17a68e0f3587926f
Opcode Fuzzy Hash: 8251d807fdd2223fe39da203c84c081a44044d04d067d328e7e0dcd92c4ff6bc
Instruction Fuzzy Hash: CA31B57490121D9BCF21DF65D988B9DBBB4BF48310F6041EAE41CA6260EB709F858F54

Function 6D4F2D22 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,6D4F2D21,?,00000001,?,?), ref: 6D4F2D44
TerminateProcess.KERNEL32(00000000,?,6D4F2D21,?,00000001,?,?), ref: 6D4F2D4B
ExitProcess.KERNEL32 ref: 6D4F2D5D

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 991b289c1c8501b0d90767715041bbc4fa6aad00ffafab9a3646cfb2225ad0a3
Instruction ID: 0666bdaa83da8e6fea7afdb26b6c79829540c268462c8bd1b730b2df7e5221b9
Opcode Fuzzy Hash: 991b289c1c8501b0d90767715041bbc4fa6aad00ffafab9a3646cfb2225ad0a3
Instruction Fuzzy Hash: 68E0B631005289AFCF216F64D989F583B79EBC6241B114418FA29C6631CB75DD93DB91

Function 6D4EC570 Relevance: 4.5, Strings: 3, Instructions: 715COMMON

Download Yara Rule

Strings

xuF, xrefs: 6D4ECE56
eZ-, xrefs: 6D4ECEE2
eZ-, xrefs: 6D4ECC17

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID: eZ-$eZ-$xuF
API String ID: 0-613344219
Opcode ID: ce58f309848696d3b9b11527fc23d1efeee2260bee98a7baf13f13cea92cc44b
Instruction ID: 061a4bdb00ac6c9ee5fbc376a7f0d4eeffcf834bfa0f3446359879a91e0bcd7f
Opcode Fuzzy Hash: ce58f309848696d3b9b11527fc23d1efeee2260bee98a7baf13f13cea92cc44b
Instruction Fuzzy Hash: 85329836A505428FCF09CE7CC5E57DE3BE2BB573A2F219615C421EB784D62A4E0B8B41

Function 6D4D4840 Relevance: 4.4, Strings: 3, Instructions: 643COMMON

Download Yara Rule

Strings

@$5?, xrefs: 6D4D4F62
&Rm, xrefs: 6D4D4DF4
@$5?, xrefs: 6D4D4E53

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID: &Rm$@$5?$@$5?
API String ID: 0-3230142386
Opcode ID: cc38416d855c96e14432ce28c8ac9cf23aebc753475ced2f2231c53e51eb1f44
Instruction ID: ef46da05f6b4a729f68ea6cb41f7142ecb903ecc0143eb7cee69e02677861f80
Opcode Fuzzy Hash: cc38416d855c96e14432ce28c8ac9cf23aebc753475ced2f2231c53e51eb1f44
Instruction Fuzzy Hash: C0226736A142518FDF06CE7CC4E5BEE3BF2EB4B360F219119D915DB399C62A4C0A8B51

Function 6D4DD770 Relevance: 4.0, Strings: 3, Instructions: 245COMMON

Download Yara Rule

Strings

d%#-, xrefs: 6D4DDA2B
lZk, xrefs: 6D4DD98F
lZk, xrefs: 6D4DDAAB

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID: d%#-$lZk$lZk
API String ID: 0-264090677
Opcode ID: 0f89dd887c68166bf1ff5850412ae23b8d6ee4960ea59b8f7e74afea370fc694
Instruction ID: 8d11f95f91a0df692f3e9769256ce3424023c206975f251888089dbf548f5236
Opcode Fuzzy Hash: 0f89dd887c68166bf1ff5850412ae23b8d6ee4960ea59b8f7e74afea370fc694
Instruction Fuzzy Hash: EF919C75E042098FCF45CEACD5A0BDE7BF2BB89320F218156E824A7350D3399D468F50

Function 6D4CFF80 Relevance: 3.6, Strings: 2, Instructions: 1065COMMON

Download Yara Rule

Strings

Kt*/, xrefs: 6D4D05C4
[0#, xrefs: 6D4CFFDB

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID: Kt*/$[0#
API String ID: 0-424502939
Opcode ID: b300197f3bd19985a3e435f38a1ce11ffc4c68aae11c4cfffa4a49aae99b2d4b
Instruction ID: f99212172c9369a1d7b5fd62333254597bfba93c00a259c530ba50790a3b628b
Opcode Fuzzy Hash: b300197f3bd19985a3e435f38a1ce11ffc4c68aae11c4cfffa4a49aae99b2d4b
Instruction Fuzzy Hash: 89723636A542458FCF09CE7CD4A4BDE7BF2AB86320F11D11AE411EB394C63A9C4ACB11

Function 6D4EC020 Relevance: 3.4, APIs: 2, Instructions: 397COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3caa8ee78a9b758703d5e4d14ba94679fe4d9f65369fca14dbf8368d518adeaa
Instruction ID: b3ce21bedd6f87526cb2f85463026570fdc0805017f2220cd75c9718e06a01e0
Opcode Fuzzy Hash: 3caa8ee78a9b758703d5e4d14ba94679fe4d9f65369fca14dbf8368d518adeaa
Instruction Fuzzy Hash: 48D12472A502119FCF04CE7CC895BDE7FF2BB4A3A5F149619C421EB790D32A9C4A8B51

Function 6D4ED9F0 Relevance: 3.2, Strings: 2, Instructions: 702COMMON

Download Yara Rule

Strings

GyV, xrefs: 6D4EDA5A
`t, xrefs: 6D4EDFF0

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID: GyV$`t
API String ID: 0-3857262959
Opcode ID: ba1f47b6bec8e45233e43c91c5856bca7c9eabdc34110fde8305e9e7382327ce
Instruction ID: b8fab51c865d7e33d81bb265f052219cb88d4884fb611b4d78d61407d4017dc4
Opcode Fuzzy Hash: ba1f47b6bec8e45233e43c91c5856bca7c9eabdc34110fde8305e9e7382327ce
Instruction Fuzzy Hash: D8324736A541119FCF05CEBCC5D5BDE7BF2BB863A2F249129D421DB395D32A8C0A8B01

Function 6D4DDAC0 Relevance: 3.2, Strings: 2, Instructions: 674COMMON

Download Yara Rule

Strings

dyZt, xrefs: 6D4DDFC5
u1j, xrefs: 6D4DDAEE

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID: dyZt$u1j
API String ID: 0-4284781672
Opcode ID: ed63cf6becf7d0ee155c264789dd7c2f7d4075b693543a250bbde2cb92880736
Instruction ID: 2ad1b592083ec0117723d51aa9a1cebd5e8bc2843c77c0931fc30835d327094c
Opcode Fuzzy Hash: ed63cf6becf7d0ee155c264789dd7c2f7d4075b693543a250bbde2cb92880736
Instruction Fuzzy Hash: D332C032A542058FCF45CEBCD5A4BDEBBF2BB86314F108629D411EB398D7399D0A8B51

Function 6D4D40A0 Relevance: 3.1, Strings: 2, Instructions: 558COMMON

Download Yara Rule

Strings

G%F6, xrefs: 6D4D45F4
G%F6, xrefs: 6D4D464B

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID: G%F6$G%F6
API String ID: 0-2097783536
Opcode ID: e4d3e763b34765e9aeb270eab7cefedc5f0e5803d00016a4a3c7d2b7ec578b18
Instruction ID: 65b799493184d658a6eefdf2d749b56d98c6bdd27e4d6de7e8d8f5e59ebe28f1
Opcode Fuzzy Hash: e4d3e763b34765e9aeb270eab7cefedc5f0e5803d00016a4a3c7d2b7ec578b18
Instruction Fuzzy Hash: 27021176A502418FCF45CF7CC9E4BDD7BF2AB4A3A4F209119E815E7784C6298C4ACB11

Function 6D4DF2F0 Relevance: 3.0, Strings: 2, Instructions: 534COMMON

Download Yara Rule

Strings

q{r%, xrefs: 6D4DF7C7
q{r%, xrefs: 6D4DF768

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID: q{r%$q{r%
API String ID: 0-890641862
Opcode ID: 021a8853165d8c0e9297fa72ae4cfb6cc1af5a4223456cded627e8befbd66a0d
Instruction ID: 28e2f8d5cf2ba06f746eb2302f5fb3a5439726da8257757e5c8eff55b9c9c1b9
Opcode Fuzzy Hash: 021a8853165d8c0e9297fa72ae4cfb6cc1af5a4223456cded627e8befbd66a0d
Instruction Fuzzy Hash: 34026A72A561818FDF04CEBCE5E1BEE77F2AB46320F258215D821D7794C23A9D4ACB05

Function 6D4D56B0 Relevance: 3.0, Strings: 2, Instructions: 518COMMON

Download Yara Rule

Strings

.n|, xrefs: 6D4D5D70
.n|, xrefs: 6D4D590A

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID: .n|$.n|
API String ID: 0-574793741
Opcode ID: 3b502d1a5abdf0cc6e59aaa3f49e7e0dfe7c327f330bc507047291c0a2a77ff3
Instruction ID: 50ade6f928df009435122c329bf3bcbe3d3ee56c135995ab290afa450cfc9800
Opcode Fuzzy Hash: 3b502d1a5abdf0cc6e59aaa3f49e7e0dfe7c327f330bc507047291c0a2a77ff3
Instruction Fuzzy Hash: E7021176A541528FCF448E7CC4A57EE7BF2EB47321F21D219C421EB794DA2A4C0ACB25

Function 6D4D7E70 Relevance: 3.0, Strings: 2, Instructions: 481COMMON

Download Yara Rule

Strings

}E?, xrefs: 6D4D8433
}E?, xrefs: 6D4D8507

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID: }E?$}E?
API String ID: 0-1074294154
Opcode ID: b4dc9be65af8d093b48da8c9ce8e98f3300702c70bb4413502481eece1991631
Instruction ID: c4ecefbe9e2611bd458cfadf1c8b5ac7fb3fc5dcdd983d6c4460afa0ed08478e
Opcode Fuzzy Hash: b4dc9be65af8d093b48da8c9ce8e98f3300702c70bb4413502481eece1991631
Instruction Fuzzy Hash: 3BF12932A541168FCF04CE7CD5E4BFE37F2AB82360F21A619D425D7794C62A8E4AC745

Function 6D4E7BE0 Relevance: 3.0, Strings: 2, Instructions: 468COMMON

Download Yara Rule

Strings

0!, xrefs: 6D4E7F34
bad array new length, xrefs: 6D4E7FA4, 6D4E8246

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID: 0!$bad array new length
API String ID: 0-4148911383
Opcode ID: c300111f6519d3a928f4dbdea632faa3fe12ec9ec63672df83071be18268ecd3
Instruction ID: 7793c6db6d8d9715d29eaa3de683493894289097b44e6446bd47499c434e03b8
Opcode Fuzzy Hash: c300111f6519d3a928f4dbdea632faa3fe12ec9ec63672df83071be18268ecd3
Instruction Fuzzy Hash: D0F14732A44106AFCF05CE7CD685BEE77F2AB863E2F21D524C411D7755D63A8E0A8B42

Function 6D4D78A0 Relevance: 2.9, Strings: 2, Instructions: 438COMMON

Download Yara Rule

Strings

r|WE, xrefs: 6D4D7C21
r|WE, xrefs: 6D4D7AEF

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID: r|WE$r|WE
API String ID: 0-563362223
Opcode ID: 69c4c1822ec786b3e49f6cbdfabf987b831470fdce6ffd7c588c761f5cb8d250
Instruction ID: b4f0e6a1103bb04445ca371f62114ff0286c36fab15a4741f1981cfb03b4222b
Opcode Fuzzy Hash: 69c4c1822ec786b3e49f6cbdfabf987b831470fdce6ffd7c588c761f5cb8d250
Instruction Fuzzy Hash: E4D15832E585124FDF499D7CC5F97EE37E3AB43360F1196099522DB7D1C22A4D0A8B41

Function 6D4DFA40 Relevance: 2.9, Strings: 2, Instructions: 410COMMON

Download Yara Rule

Strings

?, xrefs: 6D4DFD37
nA, xrefs: 6D4DFECF

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID: ?$nA
API String ID: 0-2164505474
Opcode ID: 0151ee7c4b9f32edc5f41c6a94015c6af0ddf3418304457b0211b7bba4d3bbbf
Instruction ID: 8d256a3ea026cecd3a6f4e78d4c21df8c42113b35ecafec7139735b038f6b3b4
Opcode Fuzzy Hash: 0151ee7c4b9f32edc5f41c6a94015c6af0ddf3418304457b0211b7bba4d3bbbf
Instruction Fuzzy Hash: 45E1F076A152458FCF45CE7CD5A1BDEBBF2BB4A310F11811AD821EB354C2369C068F66

Function 6D4E8FF0 Relevance: 2.9, Strings: 2, Instructions: 374COMMON

Download Yara Rule

Strings

[:$a, xrefs: 6D4E9248
[:$a, xrefs: 6D4E94B4

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID: [:$a$[:$a
API String ID: 0-817206409
Opcode ID: 687c7f186ea7fd9581d6a237be4533ffbb4262cb1be776210bc65efebb2d1056
Instruction ID: fffd078caecc02be45439d19fb35474785aaa064daa5ba081f3ac75b8c42c75c
Opcode Fuzzy Hash: 687c7f186ea7fd9581d6a237be4533ffbb4262cb1be776210bc65efebb2d1056
Instruction Fuzzy Hash: 71C1E176A542059FDF08CF6CC495BDE7BF2AB463A2F109519D810E73D4C33A8D4A8B51

Function 6D4C64B0 Relevance: 2.9, Strings: 2, Instructions: 352COMMON

Download Yara Rule

Strings

-, xrefs: 6D4C696B
-, xrefs: 6D4C67B7

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID: -$-
API String ID: 0-921942269
Opcode ID: f3cbd4f7d2be48088683b0f7cbf8517a3d4487909f5e19866a8aa8ee0717c7ac
Instruction ID: 33dc68c187b4ba4e9dc7e7c8d1a8117a2d6309518a46bbfeb2e96cc3e62022f1
Opcode Fuzzy Hash: f3cbd4f7d2be48088683b0f7cbf8517a3d4487909f5e19866a8aa8ee0717c7ac
Instruction Fuzzy Hash: ECC1E73AA501018FDF05CF7CC9917FD7BF2A746320F24D619D424E77A8C62A9D4A8B86

Function 6D4D8910 Relevance: 2.8, Strings: 2, Instructions: 344COMMON

Download Yara Rule

Strings

F/U, xrefs: 6D4D8D91
F/U, xrefs: 6D4D8CA8

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID: F/U$F/U
API String ID: 0-3161636902
Opcode ID: db54f46b38aa79cc9c45b2df07cadf622acf40d575e9d968274250eb43c86def
Instruction ID: 354cd200d393880ea1c0f262ba37e1ee900c443bddcaa8541639c6444b6f9810
Opcode Fuzzy Hash: db54f46b38aa79cc9c45b2df07cadf622acf40d575e9d968274250eb43c86def
Instruction Fuzzy Hash: D4C1E175A502059FCF49DE7CD4A5BEE7BF1BB4B320F21A619D411AB394C23A9C06CB11

Function 6D4E2790 Relevance: 2.8, Strings: 1, Instructions: 1575COMMON

Download Yara Rule

Strings

^H?|, xrefs: 6D4E3405

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID: ^H?|
API String ID: 0-1970433246
Opcode ID: cd01b038f792f1956bb454ab26e75f5e354a59c6e246f8ddbd2b799a35f4f035
Instruction ID: d284dadd80a8549bdfcfd3213fd60d6ee344541e75c856f8eca9d1e4283cbaf3
Opcode Fuzzy Hash: cd01b038f792f1956bb454ab26e75f5e354a59c6e246f8ddbd2b799a35f4f035
Instruction Fuzzy Hash: DBB2F736A552819FCF06CEBCC6D9BDD77F2BB46392F209915D411DB3A4C62A8D0ACB01

Function 6D4DEB70 Relevance: 2.8, Strings: 2, Instructions: 290COMMON

Download Yara Rule

Strings

{t<, xrefs: 6D4DED03
}*R, xrefs: 6D4DED91

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID: {t<$}*R
API String ID: 0-858880832
Opcode ID: 88d077305edcae41a890799255defb8909c1f8942ec310015ff6e2fe54a487db
Instruction ID: 317487d8a965ee1e8b9b3fa2202fba85f74f6a16ce464b342c40422ac39a2f8e
Opcode Fuzzy Hash: 88d077305edcae41a890799255defb8909c1f8942ec310015ff6e2fe54a487db
Instruction Fuzzy Hash: 5FA19775A142099FCF48CFBCD9E1AEEBBF1BB4A310F104129E855EB350C635AC068B52

Function 6D4E0850 Relevance: 2.0, Strings: 1, Instructions: 717COMMON

Download Yara Rule

Strings

.x+G, xrefs: 6D4E0C9C

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID: .x+G
API String ID: 0-2776831907
Opcode ID: 5703963c851b57a7ad30338be761b98da9393487eb5f35a81f83373bb7d053a9
Instruction ID: 460133195c56f903cf1af8f8a6a9ee348bcfb0b0762deeebf04e8851d6104bbe
Opcode Fuzzy Hash: 5703963c851b57a7ad30338be761b98da9393487eb5f35a81f83373bb7d053a9
Instruction Fuzzy Hash: 16321636A60105AFCF09DEBCD8D0BDD77F2BB5A3A2F108519D821EB754C7269C0A8B05

Function 6D4E9510 Relevance: 1.9, Strings: 1, Instructions: 656COMMON

Download Yara Rule

Strings

*T-, xrefs: 6D4E9D75

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID: *T-
API String ID: 0-2395769403
Opcode ID: 75e5eec9a7dc775d45855a568c2f8793647359c569abd04ee87d25913300a898
Instruction ID: 60c537acc3d7bfb45c1532c9cb5c1a3517a99664b2ac2caa9b5bf295d48b6199
Opcode Fuzzy Hash: 75e5eec9a7dc775d45855a568c2f8793647359c569abd04ee87d25913300a898
Instruction Fuzzy Hash: 3C22DE32A24151AFCF09CE7CD5D6BDD37E2BB463A2F149219E811DB791D72A8C0ACB01

Function 6D4DB990 Relevance: 1.8, Strings: 1, Instructions: 571COMMON

Download Yara Rule

Strings

=^r, xrefs: 6D4DC01B

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID: =^r
API String ID: 0-2970007195
Opcode ID: e648a02b9a7b5277ef426d34b8787d54da69ddcff82574872a1ffe2dc501f614
Instruction ID: e03fd0b2e18fcfa23722a6b287251ef6ad5061bb0de253f4a028eabea9ce6124
Opcode Fuzzy Hash: e648a02b9a7b5277ef426d34b8787d54da69ddcff82574872a1ffe2dc501f614
Instruction Fuzzy Hash: 12120636A541028FDF45CE7CC6E5BDE3BF2EB4A364F208515D821DB794C23A8E0A8B51

Function 6D4D9AF0 Relevance: 1.8, Strings: 1, Instructions: 549COMMON

Download Yara Rule

Strings

x 9?, xrefs: 6D4DA19C

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID: x 9?
API String ID: 0-257995016
Opcode ID: b81a8bc77a99a48046c8095b3532195e21d6bb929268cdc50b107d75e4234794
Instruction ID: 99d0c8b8b2189a2d33dabcbb06ef06a4a5e7d2e1c19a25059f6fa07a62e632f6
Opcode Fuzzy Hash: b81a8bc77a99a48046c8095b3532195e21d6bb929268cdc50b107d75e4234794
Instruction Fuzzy Hash: 6002E372A441018FDF49DE6CC4B6BDE77E2AF5B324F219619C421EB394C32B4C4A8B51

Function 6D4DE440 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

8]mz, xrefs: 6D4DE793

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID: 8]mz
API String ID: 0-272383865
Opcode ID: 2f1ecff934e797f166ba1e6589c3213e4a1e4ab252ec3740049a725d566f6828
Instruction ID: af45938ec8827b0ccc009a4ef394222509372d4c499ac48e2f55973269f091c5
Opcode Fuzzy Hash: 2f1ecff934e797f166ba1e6589c3213e4a1e4ab252ec3740049a725d566f6828
Instruction Fuzzy Hash: AC023732A506028FDF05CE7CD5F5BDEB7E2AB47365F219529C461DB790C22A9D0A8B10

Function 6D4F0318 Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6D4F032E

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 21b77d871135a994d65e800a80b749085fca1c998d629dd3c4d05de039f8e442
Instruction ID: 0c1468e3bd3521f991da997fc758766fe7dd160eb278c5e94130fd7bc639bc95
Opcode Fuzzy Hash: 21b77d871135a994d65e800a80b749085fca1c998d629dd3c4d05de039f8e442
Instruction Fuzzy Hash: E35158B1A062068BEF15CF55C681BAEBBF0FBC9310F21856AD815EB750D3B49D81CB61

Function 6D4F4420 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 247a2a87b71334579f24d6931f77e34b2b68d60ba493685f2ca82e2827a5c82f
Instruction ID: dc3aba3cd33c665513d234412f2005e147076280de081c2ccd955a6cebc80ff5
Opcode Fuzzy Hash: 247a2a87b71334579f24d6931f77e34b2b68d60ba493685f2ca82e2827a5c82f
Instruction Fuzzy Hash: A841B471804219AEDB10DF69CD88EAABBB8EF89344F1542DDE51DE3220DA359E858F50

Function 6D4EE370 Relevance: .7, Instructions: 703COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0e2ad4f209d63aefb56d3425dcfd1368cd5b2c764d0403efb3ea4950286dedc
Instruction ID: 044612746dcc41601384574fc075c00174c7650ccf5b1a31de7e298f832e1ec4
Opcode Fuzzy Hash: f0e2ad4f209d63aefb56d3425dcfd1368cd5b2c764d0403efb3ea4950286dedc
Instruction Fuzzy Hash: 2C324676A50101AFCF09CE7CE5D4BDD77F3AB463A6F249125E821DB390D62A9D0ACB01

Function 6D4E6FA0 Relevance: .6, Instructions: 610COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c74b4b8e246154ccaf55f8e18ea95c7b4ef686d5873b9b2881cb0bab73b1ffa8
Instruction ID: f62327ae9a9274026424af27637faabb4ae98d3e93b73142b93f5e9b9b138134
Opcode Fuzzy Hash: c74b4b8e246154ccaf55f8e18ea95c7b4ef686d5873b9b2881cb0bab73b1ffa8
Instruction Fuzzy Hash: A5121432E181019FCF05CE7CC981BED7BE2BB463A2F14951AD811E7756D32A8D4ACB51

Function 6D4D2BB0 Relevance: .5, Instructions: 506COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 515bdb8af844d09eda8d77bd39def57a9cf4cde1cc3ebb34b1043531d93585a9
Instruction ID: 8a70a76a816cdaac769dd508b632546f6ac496fafe521b760bae318cae75a965
Opcode Fuzzy Hash: 515bdb8af844d09eda8d77bd39def57a9cf4cde1cc3ebb34b1043531d93585a9
Instruction Fuzzy Hash: 34F15B32A541428FDF89DD7CC5E57EE37E2AB53320F21D619C421DB798CA2A8D0A8B51

Function 6D4D50C0 Relevance: .4, Instructions: 433COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7f5da5e8ed990bd03845f61d747784e3c0f42db5980e5ab964b04b8afe6b28f
Instruction ID: d3889479cdf0e68a27e194bbcb9f0a10162a188c3a545dbc29f0b14933dc1ec9
Opcode Fuzzy Hash: a7f5da5e8ed990bd03845f61d747784e3c0f42db5980e5ab964b04b8afe6b28f
Instruction Fuzzy Hash: 4AE1E136A502028FCF45CE7CC5A5BEE77E2EB47324F249515C511EB799CA2A8E0ACF01

Function 6D4E21C0 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8171e2fb905f76ff621a90557d5a01e49aa3142705c10055e40827b358ea919
Instruction ID: efb14a6ae1d87e43b7880c6593b64a994380526ba56efd769d3503c74f665b9f
Opcode Fuzzy Hash: a8171e2fb905f76ff621a90557d5a01e49aa3142705c10055e40827b358ea919
Instruction Fuzzy Hash: 07D17C76E511175FDF09CE7CC5D57EF37E2A7423A2F208219C821DB394CA2A4E0A8B41

Function 6D4ECF00 Relevance: .4, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f67f898fc5109c3ed6950a5f3af7e1b6ae4be9c2ac0a91dd4333c635ed7b718f
Instruction ID: bc8a0f3f88e709e3a761c210701b4d9d92dfb1d8c69ca922beafe70a514e3e5d
Opcode Fuzzy Hash: f67f898fc5109c3ed6950a5f3af7e1b6ae4be9c2ac0a91dd4333c635ed7b718f
Instruction Fuzzy Hash: E1E1C076A002069FCF04CE6CD580BDEBBF2ABCA392F218115E815EB350D73A9D068B11

Function 6D4D3670 Relevance: .4, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01d0f13e6ab8b06f6a50d35764d54be776d52d45357a07f5b9273de56b9a4399
Instruction ID: e890de87cd008c00b41128307e590eb898fbdc5049a74a41f12a79a1395a7916
Opcode Fuzzy Hash: 01d0f13e6ab8b06f6a50d35764d54be776d52d45357a07f5b9273de56b9a4399
Instruction Fuzzy Hash: 88D11676A541068FDF09CE7CC5A9BED77F2AB86360F20D116D421D7398C62B9E0A8B11

Function 6D4D8DB0 Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7005444b84701db5c898262109adcad70715d3d6a280e100506293f9d06fe575
Instruction ID: bffa089184616b78763e526ee70579bbfe63167f8d9bc6feb40c2a9672bc92ef
Opcode Fuzzy Hash: 7005444b84701db5c898262109adcad70715d3d6a280e100506293f9d06fe575
Instruction Fuzzy Hash: 06D12536A542058FCF44CEBCD5A4BDD7BF2BB4A320F249519E811E7398D23A8D4ACB41

Function 6D4E56E0 Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 563eae2d3f5a9094bcc1db58020cb6b19d01638e8bff154fab0c03c036ac4821
Instruction ID: a1411a4aa3e1eea7501f125550ac21074545da7f3a0c895901cd9d13ed994958
Opcode Fuzzy Hash: 563eae2d3f5a9094bcc1db58020cb6b19d01638e8bff154fab0c03c036ac4821
Instruction Fuzzy Hash: D4C13536A541169FCF08CE7CC5D5BEE37F2BB463A1F219219C821DB794D22A8D0ACB51

Function 6D4DA240 Relevance: .4, Instructions: 352COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aa61bbab7119e2e9617b20bafec3c968cdaec9c20d1c141f58527fc1026dae3
Instruction ID: 59931972bc59576a206694137ad9e2db075b9bd7f530787d6d04306b9c8e9688
Opcode Fuzzy Hash: 1aa61bbab7119e2e9617b20bafec3c968cdaec9c20d1c141f58527fc1026dae3
Instruction Fuzzy Hash: A7C12136E501028FCF05CEACC5A6FEE37F2AF56314F219115C821EB755C22A8E0A8F12

Function 6D4D0DE0 Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: febb423e5a7e0234d1aadf507a182ade59cbeed54c346c4e3e9f08cc9e36f08c
Instruction ID: b5a0f3bcd6c1e25c07d3542bdf72d0a08f0d4de4585bbd0d3cbb2aa81964ff91
Opcode Fuzzy Hash: febb423e5a7e0234d1aadf507a182ade59cbeed54c346c4e3e9f08cc9e36f08c
Instruction Fuzzy Hash: F2B14B32E541068FCF49CDBCC5E5BEE3BF2AB423A0F20C616D911D7798C62A8E468745

Function 6D4D9690 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe52986c0f9bffd387456b5786c7fba3a8680178f891cac2dcf12ec47a42a46a
Instruction ID: 88c3678cea0d4e4998e4f2acf96e7ba22e81d4a14ad398a46e6ad03e6e1d3d5f
Opcode Fuzzy Hash: fe52986c0f9bffd387456b5786c7fba3a8680178f891cac2dcf12ec47a42a46a
Instruction Fuzzy Hash: 4DA13537A501568FCF49CE7CD5B8BEE3BF2AB42320F259615C421DB794D22B8D0A8752

Function 6D4BE610 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8ed5458698f95981f593100f735154c18955cf93dce05a51b9f0763f9422140
Instruction ID: 69b341f3d78ac3c02bec9b32741f5070b8d20f37399933ebb3b99c3b03dd6d06
Opcode Fuzzy Hash: c8ed5458698f95981f593100f735154c18955cf93dce05a51b9f0763f9422140
Instruction Fuzzy Hash: B5A13632A541518FDF05CE7CC4D0BEE7BF2ABA6320F24D225D421E7394C63A9D4A8B61

Function 6D4D8520 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55d68a935d73aa3a1a4f01d06da0c259eb4f61c983a6b0bb764a0b0438ec2252
Instruction ID: 3ed80d3816720a1ec1685206f194dc7273d3341bcdb2689b215a70e9b1bdfbd5
Opcode Fuzzy Hash: 55d68a935d73aa3a1a4f01d06da0c259eb4f61c983a6b0bb764a0b0438ec2252
Instruction Fuzzy Hash: D8A1E372A541158FCF44CE7CE9A4BEE7BF2BB4A324F10A219D861E7344D32A9D05CB45

Function 6D4D32A0 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a632671e7b6010589ee95426f1e082652637fd36f513654c374fe46d75d9743c
Instruction ID: 379a3661cf8e25476e1c1102e9f1f9d23cf5f77fcf3135c8d896f5be8a679d72
Opcode Fuzzy Hash: a632671e7b6010589ee95426f1e082652637fd36f513654c374fe46d75d9743c
Instruction Fuzzy Hash: D4910032A541428FCF49CEBCC9E9BEE3BF2FB46350F159519C411DB790CA2A8D0A8B51

Function 6D4E01B0 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4bef50f890c76b8ab1b603bec9dff84984c40c70e9b6ea8bd8e3aada73d02ae
Instruction ID: 8262e09def366f9028252fd7d77776e38ed3b45aa54194cb5ad476c071a70838
Opcode Fuzzy Hash: b4bef50f890c76b8ab1b603bec9dff84984c40c70e9b6ea8bd8e3aada73d02ae
Instruction Fuzzy Hash: 36914C32A541069FCF05CEBCD4D5BEE37F2AB47362F218219C535E7394CA298D4A8791

Function 6D4E7840 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97492c80c684a02983ba0b10d0a2081b85c91f3c2637153e124763f1a0598308
Instruction ID: c8f4f399b172b440bb82f1f21be73591cb9e6ddd36e00941f83440350686fda0
Opcode Fuzzy Hash: 97492c80c684a02983ba0b10d0a2081b85c91f3c2637153e124763f1a0598308
Instruction Fuzzy Hash: 23812632E582069FDF05CA7CC891BEE37F2AB473B6F11D219C521DB691D62E4D4A8B40

Function 6D4D92F0 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fe31c5021eb591e22e57779c1f79811b40b9d8a87f75b1e074cd4729d1ed0e1
Instruction ID: 1632c396c33a4df1a9c145d5c57a3b39ff62dc60978f70ee6b97516ba3564a84
Opcode Fuzzy Hash: 3fe31c5021eb591e22e57779c1f79811b40b9d8a87f75b1e074cd4729d1ed0e1
Instruction Fuzzy Hash: 36811672A441168FCF458E7CD5F5BEE3BE2A752360F148619C832DB7D4C22B8D4A8B81

Function 6D4D1280 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85f1e305b85e0c443652b370d887e9ce93bcb7b10ba38c378e2d63040782b72e
Instruction ID: 555523d3b17654e05fdd7ce798d2ca888a1fd6337600069bec43181718cac689
Opcode Fuzzy Hash: 85f1e305b85e0c443652b370d887e9ce93bcb7b10ba38c378e2d63040782b72e
Instruction Fuzzy Hash: 46811072E946058FCF40CEBCC4A5BDE7BF1BB4A320F118119D825EB384C72A9D0A8B51

Function 6D4D3C10 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ec55fe04536a03ea8f4b4f1cf010f0257b0698a957325f7f27462d9c73e308d
Instruction ID: 79c7ec071457711e866d54b87eb271e247064f4cb928d4013635f3701d29675c
Opcode Fuzzy Hash: 2ec55fe04536a03ea8f4b4f1cf010f0257b0698a957325f7f27462d9c73e308d
Instruction Fuzzy Hash: C871F236A541498FCF09CEBCD5A8BED7BF1EB4A320F10C119E415E7784C6369D0A8B15

Function 6D4E1EC0 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eae292ccf5261d840c0061090d053989197947f80cd8b0f72c2a4bbb51735f43
Instruction ID: 4f35b1f308c86425f617020b132500041876da59c338e59453342a34e28263d1
Opcode Fuzzy Hash: eae292ccf5261d840c0061090d053989197947f80cd8b0f72c2a4bbb51735f43
Instruction Fuzzy Hash: 6B6158366501069FCF05CE7CD9D5BEEB7F2BB82392F208515C521D7784C6268E0AC696

Function 6D4E0560 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48c4bbd72f3e168e8f65f70da26e1b4d6ed6b9a37f2e0b6589a4dbd21518441b
Instruction ID: a86617ec95aedd101209ca7fbbb814b9471ebc208aea597b9ff02dab42bb6d5a
Opcode Fuzzy Hash: 48c4bbd72f3e168e8f65f70da26e1b4d6ed6b9a37f2e0b6589a4dbd21518441b
Instruction Fuzzy Hash: 0871EC76E1520A9FCF09CEBDC591BDDBBF1BB4A392F148106D424EB340CA369D0A8B55

Function 6D4ED460 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67610349e6ac1d39f9eb4df5dcfe19bce7b3f9d4c17c0d484c7d819217765e12
Instruction ID: 60a1581a2c10bbc6f787d05e0215d74f981ed390e7a380313aad299bf02ea13c
Opcode Fuzzy Hash: 67610349e6ac1d39f9eb4df5dcfe19bce7b3f9d4c17c0d484c7d819217765e12
Instruction Fuzzy Hash: FC510632A5420A9FDF04DE7CD584BEE37F1ABC3396F158115C429EB394D32A8E0A8751

Function 6D4DF0C0 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ffffe8f67207a9aa050f62d0b014f3b6b4aca39c830630224a44ee9e7e0be5b
Instruction ID: 7ac40a40a8ef39c5e610533b27f28a92b696ea8e0a519dfef150c8837820fba8
Opcode Fuzzy Hash: 4ffffe8f67207a9aa050f62d0b014f3b6b4aca39c830630224a44ee9e7e0be5b
Instruction Fuzzy Hash: 8051FF75E252559FCF44CEBCD5A5ADEBBF1BB4A320F208219E820EB384C6365D068B15

Function 6D4F3F61 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1244d2490e722d8e2d4b08a687ba54e345a4788b81df14d6debf1e67a5b6da9d
Instruction ID: f0ad0d3b6c644b8447d06ea897764feebd721d98f6d36474be3e0385ec967922
Opcode Fuzzy Hash: 1244d2490e722d8e2d4b08a687ba54e345a4788b81df14d6debf1e67a5b6da9d
Instruction Fuzzy Hash: F2E08C32A12228EBCB14CB88C944E9AF3FCEB84B44B1540AAF611D3220C270DE01CBE0

Function 6D4F6640 Relevance: 19.6, APIs: 13, Instructions: 113
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___free_lconv_mon.LIBCMT ref: 6D4F6684

Part of subcall function 6D4F857A: _free.LIBCMT ref: 6D4F8597
Part of subcall function 6D4F857A: _free.LIBCMT ref: 6D4F85A9
Part of subcall function 6D4F857A: _free.LIBCMT ref: 6D4F85BB
Part of subcall function 6D4F857A: _free.LIBCMT ref: 6D4F85CD
Part of subcall function 6D4F857A: _free.LIBCMT ref: 6D4F85DF
Part of subcall function 6D4F857A: _free.LIBCMT ref: 6D4F85F1
Part of subcall function 6D4F857A: _free.LIBCMT ref: 6D4F8603
Part of subcall function 6D4F857A: _free.LIBCMT ref: 6D4F8615
Part of subcall function 6D4F857A: _free.LIBCMT ref: 6D4F8627
Part of subcall function 6D4F857A: _free.LIBCMT ref: 6D4F8639
Part of subcall function 6D4F857A: _free.LIBCMT ref: 6D4F864B
Part of subcall function 6D4F857A: _free.LIBCMT ref: 6D4F865D
Part of subcall function 6D4F857A: _free.LIBCMT ref: 6D4F866F

_free.LIBCMT ref: 6D4F6679

Part of subcall function 6D4F3F27: HeapFree.KERNEL32(00000000,00000000,?,6D4F3439), ref: 6D4F3F3D
Part of subcall function 6D4F3F27: GetLastError.KERNEL32(?,?,6D4F3439), ref: 6D4F3F4F

_free.LIBCMT ref: 6D4F669B
_free.LIBCMT ref: 6D4F66B0
_free.LIBCMT ref: 6D4F66BB
_free.LIBCMT ref: 6D4F66DD
_free.LIBCMT ref: 6D4F66F0
_free.LIBCMT ref: 6D4F66FE
_free.LIBCMT ref: 6D4F6709
_free.LIBCMT ref: 6D4F6741
_free.LIBCMT ref: 6D4F6748
_free.LIBCMT ref: 6D4F6765
_free.LIBCMT ref: 6D4F677D

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 0a3e034691ade8f84c23fe1a789a6b2a0aaf07ae949d5d3cf3d704b556f47d26
Instruction ID: c7033d51c859392c52780d49c4ae7223d6f428ad0026b8ccb250cd2014a10f08
Opcode Fuzzy Hash: 0a3e034691ade8f84c23fe1a789a6b2a0aaf07ae949d5d3cf3d704b556f47d26
Instruction Fuzzy Hash: 8B315931608602DFEB11DB34D848F6A77F8EF81315F214829E5A8D72B1DF31EC468AA1

Function 6D4F3AA3 Relevance: 15.1, APIs: 10, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 6D4F3AB9

Part of subcall function 6D4F3F27: HeapFree.KERNEL32(00000000,00000000,?,6D4F3439), ref: 6D4F3F3D
Part of subcall function 6D4F3F27: GetLastError.KERNEL32(?,?,6D4F3439), ref: 6D4F3F4F

_free.LIBCMT ref: 6D4F3AC5
_free.LIBCMT ref: 6D4F3AD0
_free.LIBCMT ref: 6D4F3ADB
_free.LIBCMT ref: 6D4F3AE6
_free.LIBCMT ref: 6D4F3AF1
_free.LIBCMT ref: 6D4F3AFC
_free.LIBCMT ref: 6D4F3B07
_free.LIBCMT ref: 6D4F3B12
_free.LIBCMT ref: 6D4F3B20

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 6e9706b3e773f39cf943460c46055bbe1a103a7d8e559edcfbafed1eb44c71f3
Instruction ID: 72e1da7f0536fa15c2ba3ed71a2f7f25109d6f77473884dedd19b14573b6c813
Opcode Fuzzy Hash: 6e9706b3e773f39cf943460c46055bbe1a103a7d8e559edcfbafed1eb44c71f3
Instruction Fuzzy Hash: 8421B676904108EFCB01DF94D884EDE7BB8EF48248B0151AAF615DB531DB31EA49CB91

Function 6D4F5568 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

api-ms-, xrefs: 6D4F55BF
ext-ms-, xrefs: 6D4F55D3
94Om, xrefs: 6D4F556A

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID: 94Om$api-ms-$ext-ms-
API String ID: 0-3364086374
Opcode ID: dbef93ccb0320f327c870f6dab26a282edace8ba397e5ae3707c65803c9f6d19
Instruction ID: 29d78fdb59405bf9198941a4b3b48c2f4cbc3f6f9f0c11a09ccc8476fd8443f6
Opcode Fuzzy Hash: dbef93ccb0320f327c870f6dab26a282edace8ba397e5ae3707c65803c9f6d19
Instruction Fuzzy Hash: C021EB71915222ABEB129A64DC44F3A3779AFC3B60F25C510E92AA73B1D730DD13C6E1

Function 6D4F1D40 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_ValidateLocalCookies.LIBCMT ref: 6D4F1D77
___except_validate_context_record.LIBVCRUNTIME ref: 6D4F1D7F
_ValidateLocalCookies.LIBCMT ref: 6D4F1E08
__IsNonwritableInCurrentImage.LIBCMT ref: 6D4F1E33
_ValidateLocalCookies.LIBCMT ref: 6D4F1E88

Strings

csm, xrefs: 6D4F1E1D

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 7a345518c3f2282f37bd66bd829983ddfb7e3fdab394e2b8f441c7356debc774
Instruction ID: 0162157f382ab6038498de0ee6c2fd3a04df93ae95ad4413738bc5948597124b
Opcode Fuzzy Hash: 7a345518c3f2282f37bd66bd829983ddfb7e3fdab394e2b8f441c7356debc774
Instruction Fuzzy Hash: A0418074E04249ABCF10CF68C880EAEBBB5AFC5318F158059E914AB361D731ED16CB91

Function 6D4F48AD Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

C:\Users\user\Desktop\46VHQmFDxC.exe, xrefs: 6D4F48B2
;JOm, xrefs: 6D4F48FE

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID: ;JOm$C:\Users\user\Desktop\46VHQmFDxC.exe
API String ID: 0-2073565676
Opcode ID: 4ed0bfcda73bb93829462c1f602077dff61f3ea8528eb073e2ff30de2430dea4
Instruction ID: a74492387244023cc028b651b079d33d646751ced15a8027045a96ee85e0f981
Opcode Fuzzy Hash: 4ed0bfcda73bb93829462c1f602077dff61f3ea8528eb073e2ff30de2430dea4
Instruction Fuzzy Hash: 31218071708206AFD7109E759D80E6B77BCEBC93A87118618F95CD6270EF21EC4387A0

Function 6D4F8719 Relevance: 10.6, APIs: 7, Instructions: 65
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6D4F86E1: _free.LIBCMT ref: 6D4F8706

_free.LIBCMT ref: 6D4F8767

Part of subcall function 6D4F3F27: HeapFree.KERNEL32(00000000,00000000,?,6D4F3439), ref: 6D4F3F3D
Part of subcall function 6D4F3F27: GetLastError.KERNEL32(?,?,6D4F3439), ref: 6D4F3F4F

_free.LIBCMT ref: 6D4F8772
_free.LIBCMT ref: 6D4F877D
_free.LIBCMT ref: 6D4F87D1
_free.LIBCMT ref: 6D4F87DC
_free.LIBCMT ref: 6D4F87E7
_free.LIBCMT ref: 6D4F87F2

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 7df7bc2e45ad0bb9c7f8bc702183ee147632bc2a3689b57671c2733396f6c7e8
Instruction ID: 271097733c79df3e2ba380ff6dd5e42ee49a5c7e389e7a74d21709b8bfc4a62e
Opcode Fuzzy Hash: 7df7bc2e45ad0bb9c7f8bc702183ee147632bc2a3689b57671c2733396f6c7e8
Instruction Fuzzy Hash: 3B11AFB1608B04EAEA20E7B1CC09FCF77ACEF85305F85081CE399AA071DB24F8565695

Function 6D4F782F Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000001,?), ref: 6D4F7877
__fassign.LIBCMT ref: 6D4F7A5C
__fassign.LIBCMT ref: 6D4F7A79
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D4F7AC1
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6D4F7B01
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D4F7BA9

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: 349583a7e2bb11e392fe6fb6989ff55b71c3b7c1594da50425998c9d4089a4dc
Instruction ID: a82196ee3588f9b86826d2ffd2036e33383204b0ea26ef132f415191dffcf443
Opcode Fuzzy Hash: 349583a7e2bb11e392fe6fb6989ff55b71c3b7c1594da50425998c9d4089a4dc
Instruction Fuzzy Hash: E6C17D71D082599FDF15CFA8C880EEDBBB5AF89308F28415AE855B7251D2359E42CF60

Function 6D4F2217 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6D4F1EE5,6D4EFF28,6D4EF8EF,?,6D4EFB27,?,00000001,?,?,00000001,?,6D500908,0000000C,6D4EFC20), ref: 6D4F2225
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6D4F2233
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6D4F224C
SetLastError.KERNEL32(00000000,6D4EFB27,?,00000001,?,?,00000001,?,6D500908,0000000C,6D4EFC20,?,00000001,?), ref: 6D4F229E

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 28c538a2520722eee7edf1106a2fb7d855b686b0c2f3952812dcb91c82213151
Instruction ID: eb7c314d62ffa7f8366926dc93e310b48950d53d8286258d365a369526fc8bb3
Opcode Fuzzy Hash: 28c538a2520722eee7edf1106a2fb7d855b686b0c2f3952812dcb91c82213151
Instruction Fuzzy Hash: 3601B53230D3925DEB3166B46CC4E1A3764EBC3779772022EE524D55F0EF118C436182

Function 6D4F2393 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,6D4F2454,00000000,?,00000001,00000000,?,6D4F24CB,00000001,FlsFree,6D4FC354,FlsFree,00000000), ref: 6D4F2423

Strings

api-ms-, xrefs: 6D4F23E3

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: bb5412b5b407b6ae31880df520dad127ff61aeefd16392ca57ce3e7c47e47163
Instruction ID: 39a7c45d14767ae64de5b013acbf0ab6d6a10ec37138cf1f4d568fc6b0a8bc57
Opcode Fuzzy Hash: bb5412b5b407b6ae31880df520dad127ff61aeefd16392ca57ce3e7c47e47163
Instruction Fuzzy Hash: B111AB31A456719BDB329A689C80F5933B4EF83770F254121E915FB2A0DBA0ED4286D5

Function 6D4F2DA7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,6D4F2D59,?,?,6D4F2D21,?,00000001,?), ref: 6D4F2DBC
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6D4F2DCF
FreeLibrary.KERNEL32(00000000,?,?,6D4F2D59,?,?,6D4F2D21,?,00000001,?), ref: 6D4F2DF2

Strings

CorExitProcess, xrefs: 6D4F2DC7
mscoree.dll, xrefs: 6D4F2DB5

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b24c24fe268d04ae5581c6f1192f6a1d908de385c7ff14f34c62d78af7719108
Instruction ID: 340ea6388220829321f2b21d41f33b27121a0e9ea0286331d7934334c422527d
Opcode Fuzzy Hash: b24c24fe268d04ae5581c6f1192f6a1d908de385c7ff14f34c62d78af7719108
Instruction Fuzzy Hash: 3CF01C31502699FBDF11AB50DD49FEE7A79EF8275AF204060E811E2270DB34CE11EB95

Function 6D4F8678 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 6D4F8690

Part of subcall function 6D4F3F27: HeapFree.KERNEL32(00000000,00000000,?,6D4F3439), ref: 6D4F3F3D
Part of subcall function 6D4F3F27: GetLastError.KERNEL32(?,?,6D4F3439), ref: 6D4F3F4F

_free.LIBCMT ref: 6D4F86A2
_free.LIBCMT ref: 6D4F86B4
_free.LIBCMT ref: 6D4F86C6
_free.LIBCMT ref: 6D4F86D8

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 6a8ee282262ba2f7b3c0312b0303c7ec8a55a42c215046198c1f9357a87e1c86
Instruction ID: bbc0c9641961513552bad3b8a10fd087f2cff2df801192e389f633225282b9c0
Opcode Fuzzy Hash: 6a8ee282262ba2f7b3c0312b0303c7ec8a55a42c215046198c1f9357a87e1c86
Instruction Fuzzy Hash: 11F04FB15092459BDB10EF55D485E2B33F9EAC23153A6180AF128DBA60CB30FC828AE5

Function 6D4F4231 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6D4F43CB

Strings

*?, xrefs: 6D4F4274

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: efaba169b8992d2e26a785112f36f40523865fa27bba120f56925424b36ce35c
Instruction ID: cd9b59b089704a3be13c1a73e5ff38d4f0e2c44a85bd9a4e8edc7f2eaee019a2
Opcode Fuzzy Hash: efaba169b8992d2e26a785112f36f40523865fa27bba120f56925424b36ce35c
Instruction Fuzzy Hash: D9614C75E0421A9FDB14CFA8C9809EEFBF5EF88354B258169D915F7310DB319E428B90

Function 6D4F809F Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 170fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6D4F782F: GetConsoleOutputCP.KERNEL32(?,00000001,?), ref: 6D4F7877

WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,?,6D4F6059,?,00000000,00000000,6D500BB8,0000002C,6D4F60CA,?), ref: 6D4F81E5
GetLastError.KERNEL32 ref: 6D4F81EF
__dosmaperr.LIBCMT ref: 6D4F822E

Strings

Y`Om, xrefs: 6D4F81D0, 6D4F81BF, 6D4F81AF, 6D4F819F, 6D4F8162, 6D4F814B, 6D4F814F, 6D4F8167, 6D4F81A4, 6D4F81B4, 6D4F81C4

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID: ConsoleErrorFileLastOutputWrite__dosmaperr
String ID: Y`Om
API String ID: 910155933-2608077371
Opcode ID: c1a0875da4b70a850e2afa67bd036b0c2375dcfbc7eaf3bef32025d297cf2193
Instruction ID: de9cc6b145ed16258a2b38296fa9048a81cf0b31080901e9f72055286806202a
Opcode Fuzzy Hash: c1a0875da4b70a850e2afa67bd036b0c2375dcfbc7eaf3bef32025d297cf2193
Instruction Fuzzy Hash: 3651B1B1A0810AABDB01CBAAC944FEEBB75EFC6314F150149E510AF271D7359E43CBA1

Function 6D4F4145 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6D4F4767: _free.LIBCMT ref: 6D4F4775

Part of subcall function 6D4F533B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,00000000,00000000,?,6D4F72D3,?,00000000,00000000), ref: 6D4F53E7

GetLastError.KERNEL32 ref: 6D4F41AD
__dosmaperr.LIBCMT ref: 6D4F41B4
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 6D4F41F3
__dosmaperr.LIBCMT ref: 6D4F41FA

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: e04a3bb7ab1aee7249fdf885be941e653adc28b2a22b01584d58db86cd521075
Instruction ID: 56365cabb3d62822a059122fda06493121ce810812853924e17af870ea07561f
Opcode Fuzzy Hash: e04a3bb7ab1aee7249fdf885be941e653adc28b2a22b01584d58db86cd521075
Instruction Fuzzy Hash: BD21B5716082066F9B009FA58E84D6777BCEFC93E87118528E96D83660EB30EC0387A0

Function 6D4F3BE7 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,6D4F7C77,?,00000001,6D4F60CA,?,6D4F8134,00000001,?,?,?,6D4F6059,?,00000000), ref: 6D4F3BEC
_free.LIBCMT ref: 6D4F3C49
_free.LIBCMT ref: 6D4F3C7F
SetLastError.KERNEL32(00000000,FFFFFFFF,000000FF,?,6D4F8134,00000001,?,?,?,6D4F6059,?,00000000,00000000,6D500BB8,0000002C,6D4F60CA), ref: 6D4F3C8A

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 629e98e1c0924c311f922b9a0d589d0c902064f9f319340429e89070e29e4430
Instruction ID: e89b8a9eff2c379a8adcf7a638ea3c1c574ec43628609d66046a44b5a5f2afca
Opcode Fuzzy Hash: 629e98e1c0924c311f922b9a0d589d0c902064f9f319340429e89070e29e4430
Instruction Fuzzy Hash: 5A117B3320C245AADF01A6798D8CF3E257697C2B79B364129F624962B0EB21CC4755A2

Function 6D4F3D3E Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00000001,6D4F4010,6D4F3F4D,?,?,6D4F3439), ref: 6D4F3D43
_free.LIBCMT ref: 6D4F3DA0
_free.LIBCMT ref: 6D4F3DD6
SetLastError.KERNEL32(00000000,FFFFFFFF,000000FF,?,00000001,6D4F4010,6D4F3F4D,?,?,6D4F3439), ref: 6D4F3DE1

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 0739ec82d898b30b9b861913a9f8261d4fb034b8cc21bf654f166c59e3a0d2bb
Instruction ID: 39c673627502656131aeb91a2a06c76bd7b7cd65affd3a024fcc4dc19a64977c
Opcode Fuzzy Hash: 0739ec82d898b30b9b861913a9f8261d4fb034b8cc21bf654f166c59e3a0d2bb
Instruction Fuzzy Hash: 0E118A3120C7456ADF1155798D88F2E2579DBC2B79F324129F624D62F0DB22CC4785A2

Function 6D4F8EC6 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,6D4F8923,?,00000001,?,00000001,?,6D4F7C06,?,?,00000001), ref: 6D4F8EDD
GetLastError.KERNEL32(?,6D4F8923,?,00000001,?,00000001,?,6D4F7C06,?,?,00000001,?,00000001,?,6D4F8155,Y`Om), ref: 6D4F8EE9

Part of subcall function 6D4F8EAF: CloseHandle.KERNEL32(FFFFFFFE,6D4F8EF9,?,6D4F8923,?,00000001,?,00000001,?,6D4F7C06,?,?,00000001,?,00000001), ref: 6D4F8EBF

___initconout.LIBCMT ref: 6D4F8EF9

Part of subcall function 6D4F8E71: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6D4F8EA0,6D4F8910,00000001,?,6D4F7C06,?,?,00000001,?), ref: 6D4F8E84

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,6D4F8923,?,00000001,?,00000001,?,6D4F7C06,?,?,00000001,?), ref: 6D4F8F0E

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: b0e38198230a2e84eac46a1d7b640fa851818d233bb11abcdaff65547c62fce3
Instruction ID: afd4cbb43589b3c4d62d47bfece248660121bf2ae383b0addf1d4dab7fe70256
Opcode Fuzzy Hash: b0e38198230a2e84eac46a1d7b640fa851818d233bb11abcdaff65547c62fce3
Instruction Fuzzy Hash: 07F0F836104519BFCF122F969C04E9E3E76EB8A7B0B154010FA299A530C732CC609BA5

Function 6D4F4FC3 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 6D4F4B5E: GetOEMCP.KERNEL32(00000000,6D4F4DCF,?,00000001,6D4F8134,6D4F8134,00000001,?,?), ref: 6D4F4B89

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,6D4F4E16,?,00000000,?,6D4F6059,?,?,?,?,6D4F8134), ref: 6D4F5021
GetCPInfo.KERNEL32(00000000,?,?,?,6D4F4E16,?,00000000,?,6D4F6059,?,?,?,?,6D4F8134,00000001,?), ref: 6D4F5063

Strings

Y`Om, xrefs: 6D4F4FDB

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID: Y`Om
API String ID: 546120528-2608077371
Opcode ID: bc259ad3493af7c190965c80ab9ce2949fa2abefd31cd4e38ca43f321667a651
Instruction ID: 60000316cea8b8e53fa448ab14a6eac2e8d7a9567b0e8f628a15b7c8ecfefcff
Opcode Fuzzy Hash: bc259ad3493af7c190965c80ab9ce2949fa2abefd31cd4e38ca43f321667a651
Instruction Fuzzy Hash: 96510370A042069EEB21CF25C940EBBBBF5EFC2304F24C06ED1A687261D775A947CB91

Function 6D4F2E35 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\46VHQmFDxC.exe, xrefs: 6D4F2E78, 6D4F2E7F, 6D4F2EB5

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\46VHQmFDxC.exe
API String ID: 0-3783591300
Opcode ID: 3b1e1a9c1f0cf6d6e2d9138c84e0f7bfac0109dd7235422354758003498fd857
Instruction ID: 7e16b741ddda47c9a634024efe7a61cbbe009cf8f6d72e8e99c59455a7ec19cd
Opcode Fuzzy Hash: 3b1e1a9c1f0cf6d6e2d9138c84e0f7bfac0109dd7235422354758003498fd857
Instruction Fuzzy Hash: 1A41A671A18255EBDB21DB99C8C0E9EBBF8EBC9304B21006AE514D7260DB708E42D7A1

Function 6D4DEF50 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

string too long, xrefs: 6D4DF042, 6D4DF0A2

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID:
String ID: string too long
API String ID: 0-2556327735
Opcode ID: dcfae4bf28c1981f0bf094230ae112d6179adf3c13ffd5e2d09630c6168e3511
Instruction ID: c12aa41806c31932fec43e2f9ce60ac93d9bf5581fbca14ab6713c62a7ecf87d
Opcode Fuzzy Hash: dcfae4bf28c1981f0bf094230ae112d6179adf3c13ffd5e2d09630c6168e3511
Instruction Fuzzy Hash: C6310536A541568FDF01DABCD4E0BEEBBF1AB42324F119929C891D7351D7368D0AC782

Function 6D4F4DB4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 6D4F4B5E: GetOEMCP.KERNEL32(00000000,6D4F4DCF,?,00000001,6D4F8134,6D4F8134,00000001,?,?), ref: 6D4F4B89

_free.LIBCMT ref: 6D4F4E2C

Strings

x{, xrefs: 6D4F4EBE

Memory Dump Source

Source File: 00000000.00000002.1378137405.000000006D4B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D4B0000, based on PE: true

Associated: 00000000.00000002.1378120829.000000006D4B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378185702.000000006D4FB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D502000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378210390.000000006D544000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1378281972.000000006D54F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d4b0000_46VHQmFDxC.jbxd

Yara matches

Similarity

API ID: _free
String ID: x{
API String ID: 269201875-3015111431
Opcode ID: 7f39b64b7d08907cbf5aa2ddfdb6cd343209229d3b83cf072a96f4e1e071d012
Instruction ID: 4d91f5092e293ac27404caadf3d8f1a0e334c9d6988f77839937e5ae1702ed26
Opcode Fuzzy Hash: 7f39b64b7d08907cbf5aa2ddfdb6cd343209229d3b83cf072a96f4e1e071d012
Instruction Fuzzy Hash: ED31927290820AAFCB01DF68D940E9E77B4FF88355F11416AE519973A0EB32DD52CF91

Analysis Process: MSBuild.exePID: 8004, Parent PID: 7908COMMON

Execution Graph

Execution Coverage:	6.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	38
Total number of Limit Nodes:	7

Executed Functions

Function 06573F50 Relevance: .5, Instructions: 524COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2104d31320512b2072a552726b66baf3595f2ff34eacf64cd459a66f6de15901
Instruction ID: 4b89a9bc07012be0f915a3e931585156460d4e5c7569c526bd360eff1636b6e2
Opcode Fuzzy Hash: 2104d31320512b2072a552726b66baf3595f2ff34eacf64cd459a66f6de15901
Instruction Fuzzy Hash: 33128034B002158FDB54DF69D884AAEBBF6BF89710B158169E905EB365DF30EC41CBA0

Function 065767D8 Relevance: .4, Instructions: 413COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a54bc891cee19ebcc58e0037c9336f78ef26e9f3a8d3d1c6d79d26b4ec605643
Instruction ID: 2492bf2a4c328eb7351db851fe63fab71ea0a07ab2e21ce221bff7b48ddf6fcd
Opcode Fuzzy Hash: a54bc891cee19ebcc58e0037c9336f78ef26e9f3a8d3d1c6d79d26b4ec605643
Instruction Fuzzy Hash: 69F1D330A006099FDB45DF64E880B9EBBF6FF89300F148569E405EB2A1DB74ED45CBA0

Function 0657A3D8 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec529a1aa285983ad736bdf289e82a467412ccb1b7974b321bd2fdef71c73973
Instruction ID: 18efc2f34e8b2bdf4d1c5299431c652631f543dc66712c8861078dcdaf5c8dcf
Opcode Fuzzy Hash: ec529a1aa285983ad736bdf289e82a467412ccb1b7974b321bd2fdef71c73973
Instruction Fuzzy Hash: EDD1D634D00218CFCB58EFB4E894A9DBBB3FF8A301F1095A9E51AA7254DB315986CF51

Function 02BFD0A8 Relevance: 6.1, APIs: 4, Instructions: 130
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 02BFD136
GetCurrentThread.KERNEL32 ref: 02BFD173
GetCurrentProcess.KERNEL32 ref: 02BFD1B0
GetCurrentThreadId.KERNEL32 ref: 02BFD209

Memory Dump Source

Source File: 00000003.00000002.2619746644.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bf0000_MSBuild.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: e5e5f62d66549f1166a6f0aae2040ee2129c86e3b331836c4b75be4a8d1388f2
Instruction ID: f000e281395d4224a60520a0ba22805633f8e5a3a247c3046456fea2d40e904f
Opcode Fuzzy Hash: e5e5f62d66549f1166a6f0aae2040ee2129c86e3b331836c4b75be4a8d1388f2
Instruction Fuzzy Hash: C15178B09007498FDB54CFA9D548B9EBBF1EF88304F20849DE019A73A0DB785985CB65

Function 02BFD0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 02BFD136
GetCurrentThread.KERNEL32 ref: 02BFD173
GetCurrentProcess.KERNEL32 ref: 02BFD1B0
GetCurrentThreadId.KERNEL32 ref: 02BFD209

Memory Dump Source

Source File: 00000003.00000002.2619746644.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bf0000_MSBuild.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 12ecfa4efdbd758301591c2cb68147564925e001bd8d472b95fbba244499f512
Instruction ID: d0724b7b173e3250b2d479cb5a031aac926a896a20d5490d64d2ff35f6c3e8a0
Opcode Fuzzy Hash: 12ecfa4efdbd758301591c2cb68147564925e001bd8d472b95fbba244499f512
Instruction Fuzzy Hash: 6A5168B09007498FDB54CFAAD548BDEBBF1EF88304F208459E019A7390DB785985CB65

Function 02BFAE30 Relevance: 1.7, APIs: 1, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02BFB086

Memory Dump Source

Source File: 00000003.00000002.2619746644.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bf0000_MSBuild.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 57a3352ccf97d0daac898b8695cbe29f7467600cc5a7622e955fd2ee8002b2ff
Instruction ID: 307c723c6366d3d8e91110bd18c9924768dfed6fdc31b242c9a08d0ec1bf15cb
Opcode Fuzzy Hash: 57a3352ccf97d0daac898b8695cbe29f7467600cc5a7622e955fd2ee8002b2ff
Instruction Fuzzy Hash: D78147B0A00B058FD768DF69D04179ABBF1FF88704F10896DD58ADBA50D775E84ACB90

Function 02BF5935 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02BF59F1

Memory Dump Source

Source File: 00000003.00000002.2619746644.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bf0000_MSBuild.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: ccc4a7d9e6ef077fd96a818f2f73a54644edbf55cccffb629635f484a83889e9
Instruction ID: aae395e73dbeda7011a39057918b159d0594c6c553f72c227006fe272c29ace4
Opcode Fuzzy Hash: ccc4a7d9e6ef077fd96a818f2f73a54644edbf55cccffb629635f484a83889e9
Instruction Fuzzy Hash: 5541E1B0D00718CBEB24DFA9C8847CDBBB5FF48304F20845AD518AB250DB75698ACF50

Function 02BF4248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02BF59F1

Memory Dump Source

Source File: 00000003.00000002.2619746644.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bf0000_MSBuild.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: ee262ae9df01670c4e3b8c1b4c6af6ba8a6e7408581f8b61d4610e9935ff0300
Instruction ID: 8a35466f93de14ac564b1d6b569e2d6f2b2ff4a57dc38d4c5076919e56e035ac
Opcode Fuzzy Hash: ee262ae9df01670c4e3b8c1b4c6af6ba8a6e7408581f8b61d4610e9935ff0300
Instruction Fuzzy Hash: 3341D1B0D00718CFEB24CFA9C884B8DBBB5FF49304F60845AD518AB251DB79694ACF90

Function 02BFD300 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02BFD387

Memory Dump Source

Source File: 00000003.00000002.2619746644.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bf0000_MSBuild.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 54845eaf798a6345c9ee8ffb4c2df9d0ea3097ea375ac70120b439581aee67b0
Instruction ID: fe6289f188fab5ddb6e6965bd2684ad7f69d1d4b8f7285c33180c8ac5f179b1f
Opcode Fuzzy Hash: 54845eaf798a6345c9ee8ffb4c2df9d0ea3097ea375ac70120b439581aee67b0
Instruction Fuzzy Hash: EF21E2B59003499FDB10CFAAD984ADEBBF9EB48310F14841AE918A3310D378A944CFA1

Function 02BFD2F9 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02BFD387

Memory Dump Source

Source File: 00000003.00000002.2619746644.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bf0000_MSBuild.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0a23a67a962288f4f4d0b7968ad39f51f3dbab5a9c04287334c99f00a69ffc38
Instruction ID: a43fb228ed32aee1b4963a36f3740e1e5e3a6aa7ca9bb350bf43adaf349e9d34
Opcode Fuzzy Hash: 0a23a67a962288f4f4d0b7968ad39f51f3dbab5a9c04287334c99f00a69ffc38
Instruction Fuzzy Hash: 8321E2B5D003499FDB10CFAAD585ADEBBF5EB48310F14845AE918A3250C378A955CF61

Function 02BFB020 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02BFB086

Memory Dump Source

Source File: 00000003.00000002.2619746644.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bf0000_MSBuild.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 09f606297b5df4c897d5a0f6a8de930691cd704e5b1337b7cb75154c9b109ab1
Instruction ID: 0a021b78ef0d0ffaf383a241cfb65513e5bcabef7c5676aa9609ddba4c910645
Opcode Fuzzy Hash: 09f606297b5df4c897d5a0f6a8de930691cd704e5b1337b7cb75154c9b109ab1
Instruction Fuzzy Hash: CB1113B5D003498FCB20CFAAC444BDEFBF4EB88314F10845AD529A7610C379A549CFA1

Function 065759D8 Relevance: 1.5, Strings: 1, Instructions: 294
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 06575C29

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 75148aaff558c55d556885ce630c5f46a9697f6f6da7da6f27ba18f7cfaeac93
Instruction ID: 3d290ada59839dd795f6ae4c97a73971b2e0309d5c7724055558084cf794d0d9
Opcode Fuzzy Hash: 75148aaff558c55d556885ce630c5f46a9697f6f6da7da6f27ba18f7cfaeac93
Instruction Fuzzy Hash: 34C15C34600602CFC725CF28D580A6ABBF6FF89310759C999D49A9B661EB30FD46CF90

Function 065748B8 Relevance: .6, Instructions: 594
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6edb3dd532909fd242293af43cd072e6a6fc1ec62784cd505d7de664352cd44c
Instruction ID: 6dcb2731f6b7ffa9343490cdc2ff91b309edbadf6156d518327716dfbae68557
Opcode Fuzzy Hash: 6edb3dd532909fd242293af43cd072e6a6fc1ec62784cd505d7de664352cd44c
Instruction Fuzzy Hash: 3B323A747006058FDB54DF29D488A6ABBF6FF89310B1584A9E506CB3A2DB30EC45CF51

Function 065748A8 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89f9a5f858bd21d4f31b923846bdb8134d4ecfa0bec311aeadbe7af51edf94d5
Instruction ID: c943b0d1b730231f57f4fcedde66993052359d9be81a2761608f5870e93bd546
Opcode Fuzzy Hash: 89f9a5f858bd21d4f31b923846bdb8134d4ecfa0bec311aeadbe7af51edf94d5
Instruction Fuzzy Hash: F3B14834B106058FCB54DF39D488A6ABBF6BF89600B1580A9E446DB3B2DB30EC05CF61

Function 06577D58 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e5d60b5bdbb9bc7c74d932c2d43e1da6e3951c609295586b8ed61230c495906
Instruction ID: 81134636f5990a0d4ab34174ee81469822a2e0ee8595f4f17be68225a9f62bee
Opcode Fuzzy Hash: 3e5d60b5bdbb9bc7c74d932c2d43e1da6e3951c609295586b8ed61230c495906
Instruction Fuzzy Hash: 81513771E00219CFDB54CFA9E884BDEBBF5BF48300F148529E815AB250D7749946CF90

Function 06577D4C Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5508771ca2c049805a4782cd83d9579638b42bcfbc5dbebb137dde1c8137dbc7
Instruction ID: 6e2ef4e22c3d488bc098b7bb889cb45f176087e007d4fdb4cdeeda416e0614ac
Opcode Fuzzy Hash: 5508771ca2c049805a4782cd83d9579638b42bcfbc5dbebb137dde1c8137dbc7
Instruction Fuzzy Hash: 3C5126B0E0025D9FDB64CFA9E885BDEBBF5BB48300F148529E815AB250DB749846CF91

Function 065759C8 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70615db0f2d044350c64784212f3beae7bc487f93a94dd11073e0fd2bfc8426b
Instruction ID: bd5201dfc104e9c6017b1b53b892160e3407df5ce6ecb6a2f7658cb95668b144
Opcode Fuzzy Hash: 70615db0f2d044350c64784212f3beae7bc487f93a94dd11073e0fd2bfc8426b
Instruction Fuzzy Hash: 1E416D34A00605CFCB50CF59D880A6AB7F6FF89310B55C9A9E5599B361EB30F841CF90

Function 06573DE0 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d95570531db5a81958512ee1a8841506bc6aceefd7b648a69181e37b954ca77e
Instruction ID: 622af3d6e3e83a3d5bc45ec7541f9f5aee37ca965dc6725e7be54b749caa1fb2
Opcode Fuzzy Hash: d95570531db5a81958512ee1a8841506bc6aceefd7b648a69181e37b954ca77e
Instruction Fuzzy Hash: E93134317102154FC729A738E85066F77EAEFCA220715447AE449CB780DE75EC4787B1

Function 065784C8 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b3dad10c17ef7f48075c7a7f883cdad1432d587ca57fb64d6e254e8cb30ca46
Instruction ID: 7d9cb22c40c35d08c3cc5189e88a42637374e8a24d27b566236a789cc2db689c
Opcode Fuzzy Hash: 8b3dad10c17ef7f48075c7a7f883cdad1432d587ca57fb64d6e254e8cb30ca46
Instruction Fuzzy Hash: AE31AD317002059FCB58EB78A86066F37E3EBC9211B14443ED50ADB381EE79DD0A87E2

Function 06575579 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9590aaf9362f06241b66ca19a52c4aaee9e296f0288b9e7c5762b5a58550aef7
Instruction ID: bbd3108fda7ddda260c8f957bfb6bed04512e98d6fd61c1e7df78eaa683d84df
Opcode Fuzzy Hash: 9590aaf9362f06241b66ca19a52c4aaee9e296f0288b9e7c5762b5a58550aef7
Instruction Fuzzy Hash: A4318C35B00210AFDB19DF34D884A5EBBB6FF8A240B508469E905CB355EF34ED45CBA0

Function 06575588 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 606c5d733b2db5fabbd81e951bfd8cbc32de30974308a038677c04c67dd18ea7
Instruction ID: 1ad9a50c4e57c0d5d3af5d7791714e48134d0e495c4df225fc7ce3537989292e
Opcode Fuzzy Hash: 606c5d733b2db5fabbd81e951bfd8cbc32de30974308a038677c04c67dd18ea7
Instruction Fuzzy Hash: FF318B35B002119FDB19DF34E884A6EBBB6FF8A240B508469E905CB355EF71ED45CB90

Function 065787A0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b48667ff862fcc0320c63f6c56ca6374865c02d47a41b9b7c86fd1307161c9bb
Instruction ID: 6d8a6f0cb6240168682eb956c1b086ccd1bcfad4af2fd23fec471268150f0ea1
Opcode Fuzzy Hash: b48667ff862fcc0320c63f6c56ca6374865c02d47a41b9b7c86fd1307161c9bb
Instruction Fuzzy Hash: 6441E271D01248DFDB54DFAAD844ADEFBF6BF88310F14842AE415AB250DB35A946CF90

Function 06578796 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91959e60cc3d8f95eacd34e9081be5cf6a1b99f00560bc1b7757be48273d6ac0
Instruction ID: 584329f8edee4dad154484f3ed703f16ad0b4f0d25d103fa09eff96564167ecb
Opcode Fuzzy Hash: 91959e60cc3d8f95eacd34e9081be5cf6a1b99f00560bc1b7757be48273d6ac0
Instruction Fuzzy Hash: 8131D4B1D012489FDB14DFAAD985ADEBFF6BF88300F14842AD415A7250DB359946CF90

Function 06578A98 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e56f9a13cf3bd1f45a1ea962a123928bd44c7d9476d0f18bee9dfa3503f07c41
Instruction ID: afa6e7e83125b76565b423628ac912b9ca225383623b33f0e15b1d8e54620ad8
Opcode Fuzzy Hash: e56f9a13cf3bd1f45a1ea962a123928bd44c7d9476d0f18bee9dfa3503f07c41
Instruction Fuzzy Hash: D031E3B1D012589FDB14CFAAD894BDEBBF5FF48310F14842AE409A7240D774A946CB94

Function 00DAD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2619125428.0000000000DAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dad000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d278bb856a6cf22ff210725df06c3c7979eb39b46377c982486a9181fa8b582
Instruction ID: 11e2cfe11b8b4cc944ff4a5c0de5f505a1dfc3d82c3e35f6cafd03fa9cc7ae5b
Opcode Fuzzy Hash: 4d278bb856a6cf22ff210725df06c3c7979eb39b46377c982486a9181fa8b582
Instruction Fuzzy Hash: 00210371500304DFDB05DF10D9C0B16BB66FB99324F24C569E80A0B656C37AE856DAB2

Function 00DBD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2619171331.0000000000DBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dbd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dc5cc232ebbe7a2afb1e56b40ff1a3580ac9508ab32af354587dcb0bbee490f
Instruction ID: e7fe755c8cb6d67c6a442d0502227ba041cde1b41117a0cb1e9cdfdd756de48f
Opcode Fuzzy Hash: 3dc5cc232ebbe7a2afb1e56b40ff1a3580ac9508ab32af354587dcb0bbee490f
Instruction Fuzzy Hash: F8212271604300DFDB14EF10D8C0B56BB62EB88314F24C5A9E84A0B282D33AD847CA72

Function 06578A8C Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6de5598eaca95bc0eacb15f8620218b25c65316bedbf152276c749009a507b95
Instruction ID: be49b5293a4173b278d211e87f7d1164638c8d084b6f4ccb2f5bb69b12f9ada9
Opcode Fuzzy Hash: 6de5598eaca95bc0eacb15f8620218b25c65316bedbf152276c749009a507b95
Instruction Fuzzy Hash: 6C21FBB1D012589FDB24CFA6D895BDEBBF9FF48310F14842AE409A7240D774A946CF60

Function 06575089 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d2311f2e85c0385998faf228193915e0795bc69b078262bddbb39744a3430f8
Instruction ID: 0afe99c5914439480b37fb75088fcc6f7205d414652f4da999533fe24a454d41
Opcode Fuzzy Hash: 2d2311f2e85c0385998faf228193915e0795bc69b078262bddbb39744a3430f8
Instruction Fuzzy Hash: DA118276B00104ABC720DA59EC85E6BBBFAFBC8660B05C529F91DD7344DA34ED018BE0

Function 00DBD005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2619171331.0000000000DBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dbd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 498b43a76fbc670a81b55669505d3b4f19f9e75056ad993cb0726f9a3436c389
Instruction ID: def203e4d2190e97144ff8375106e19c8c5f07ec69779dda7d51939d65d43739
Opcode Fuzzy Hash: 498b43a76fbc670a81b55669505d3b4f19f9e75056ad993cb0726f9a3436c389
Instruction Fuzzy Hash: 7C218E75509380CFCB06DF20D990715BF72EB46314F28C5EAD8498B2A7C33A980ACB62

Function 0657BC5F Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 101feb259947b6c941dda058ebbbcadc406e92e2ead23567264dacc96dfc66de
Instruction ID: ed68f5368adbdc8f62dd66b95c52bdcbb9cf43fe6694e6d4fe01863f629f8334
Opcode Fuzzy Hash: 101feb259947b6c941dda058ebbbcadc406e92e2ead23567264dacc96dfc66de
Instruction Fuzzy Hash: B901C8302112049FC7956B7CA8649AF37A7EEC2250714852AF107CF641DEB4BEC687B6

Function 0657B2D9 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18b1ddb71f7432e67cf0b17d1ee09de984da31435d234456d303940f85973e9e
Instruction ID: 2e9ce6ee58beae498232f26dfed90dbfb1c8baa76a778e43e53eba861ff6b4e7
Opcode Fuzzy Hash: 18b1ddb71f7432e67cf0b17d1ee09de984da31435d234456d303940f85973e9e
Instruction Fuzzy Hash: 2D11963490A384AFCB02EF78E96055D7F76BF46200B1441DAE444DB257DB345F45CB61

Function 00DAD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2619125428.0000000000DAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dad000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1166f709330a6c50fb0ccab333658baa4cf0de4601631cd9e1789cef95a599a7
Instruction ID: 656cdf870b07bd275c6663ee573eaa112bc3be084676c256a2a62afffb15ec70
Opcode Fuzzy Hash: 1166f709330a6c50fb0ccab333658baa4cf0de4601631cd9e1789cef95a599a7
Instruction Fuzzy Hash: 6B112676404240CFCB05CF00D5C4B16BF72FB99324F28C6A9D80A0B656C33AE856CBA1

Function 0657C499 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 176a1f0ff11d53f65f8121c0ec829b78c3a25e6573efa33dc040179aeee6fc2f
Instruction ID: a37b24e449cba36d30f8c025643a0a7eb45615f2d93efc6e1e50611c9222fda8
Opcode Fuzzy Hash: 176a1f0ff11d53f65f8121c0ec829b78c3a25e6573efa33dc040179aeee6fc2f
Instruction Fuzzy Hash: D701E5302043004FD355AF74E41465E7BB3EFCA715B10C62AE1468B645DFB49A0A8BA1

Function 06578350 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7615776f8f7bd06c3e78a7b58fb67d9847fb413333b9447a541241f01ba723c0
Instruction ID: cab2c5a922a4bc890d5b3fd3685a291e1855ab7007358aed7ae92f7eb871098e
Opcode Fuzzy Hash: 7615776f8f7bd06c3e78a7b58fb67d9847fb413333b9447a541241f01ba723c0
Instruction Fuzzy Hash: 91017C71B001199BDB50DEA9AC88AAFB7FAFB84661B14803AE605D3340EB70991587A1

Function 0657BC70 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a77fca537a49f0dbcbc5f40f19057a4e30129b4ecc6437521b0c2af0e8eb412
Instruction ID: 2247c17178a1380ab457a622504b1bee274f2f6b035bcf8196ad7b969bfb10a5
Opcode Fuzzy Hash: 7a77fca537a49f0dbcbc5f40f19057a4e30129b4ecc6437521b0c2af0e8eb412
Instruction Fuzzy Hash: 0601B5312102058F87D9AB3CE45492E36A7EEC1290354882AF107CF640EEB4BDC687A6

Function 0657ACB8 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92eb22e9609a7cfe79fb3a2051e2ae194a8ac656970e8464e6c234125dd9dc41
Instruction ID: c6c8373c4baef5aea37c4bcf2fd255808792c8e5fc44a9d6a49c53669216ce17
Opcode Fuzzy Hash: 92eb22e9609a7cfe79fb3a2051e2ae194a8ac656970e8464e6c234125dd9dc41
Instruction Fuzzy Hash: 92F04C32709250AFC7630BE57C644EE7F6AEB8378134854AEF146C7251DA644903C7F6

Function 0657E8B0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69181e758f011ae53fced3fc60908a6ae4cab84f02e7d59500875054ccd9d327
Instruction ID: d130e548bed3957a9c511f1568cf354e566fbab128f307b73ab666108bc95d48
Opcode Fuzzy Hash: 69181e758f011ae53fced3fc60908a6ae4cab84f02e7d59500875054ccd9d327
Instruction Fuzzy Hash: 0301D634609304DFCB16AF74D81489A3FBAEF8620071484EAE505CB362DB32DD11DB91

Function 06576E90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ab4adca131d560d77e11e7cc708c6b405c78dfb9abe91792f26e22ff3aba3c1
Instruction ID: 9ad060a9ff788fede39fa5c1805681bd0ca9b66fffdbba7d011762ab4d96e70b
Opcode Fuzzy Hash: 8ab4adca131d560d77e11e7cc708c6b405c78dfb9abe91792f26e22ff3aba3c1
Instruction Fuzzy Hash: DCF068671040983BCB514EDA5C51EFB3FEDDB8E151F084056FA94D1141C41DC911ABB1

Function 0657C4A8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4db4b8a4688bbb379c7e96191cbcff90f8ce59ac77616a2eeeaeec33d04ce5a4
Instruction ID: a9eca59084223529a8d1521033e298ee5be2af2cfb87dbcb4010aa9501aae1a2
Opcode Fuzzy Hash: 4db4b8a4688bbb379c7e96191cbcff90f8ce59ac77616a2eeeaeec33d04ce5a4
Instruction Fuzzy Hash: 4E01D2302003048BD315AF65E01861ABBF3EFC9715B50CA2DE14A8B644DFB4A90A8BA1

Function 06575508 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f34b4a500c52e8af9c2485bf0aa692a986176c9b8c2081775b4e802592d039fa
Instruction ID: fbe01e4170e4279dfe6bc15f5cf9bd0603fcef074624a87a38d5c5136cf16761
Opcode Fuzzy Hash: f34b4a500c52e8af9c2485bf0aa692a986176c9b8c2081775b4e802592d039fa
Instruction Fuzzy Hash: E801D130A11302CFDBA99A35F404A23B3F7BF84209744883DE10686654FE75E484CF80

Function 06578F42 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 517799cc0d4afcf7905ce41280e5c9a12c6f455b175e11edb5508688b08a4377
Instruction ID: e6ab0d04faa3a8c6eb8b49ffe4b4efd61e835a3b1dcd0cf7869b3be9b51057e0
Opcode Fuzzy Hash: 517799cc0d4afcf7905ce41280e5c9a12c6f455b175e11edb5508688b08a4377
Instruction Fuzzy Hash: 160116B4C04209EFDB44DFA4E949BAEBBB4FB09300F5044A9E815B3381D7745A41DFA5

Function 0657C170 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f940c621737a6187964de7d6a64fbe9a4c594d552b749b6fab81d1de21564ae
Instruction ID: d1f6a3e7d83f41d9db1e23832e3e8b767163b1dda796bd5121705b6726cabf04
Opcode Fuzzy Hash: 9f940c621737a6187964de7d6a64fbe9a4c594d552b749b6fab81d1de21564ae
Instruction Fuzzy Hash: A701D131101B009FC311AF69E818592BBFBFB49300700C61BE586C6611CB30A64ACF94

Function 00DAD5F3 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2619125428.0000000000DAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dad000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 722fdb885a76455fe1f062bf064ac5119acbcf1c8ca2384884441fcbd1e4c78d
Instruction ID: 5bb75a4f3111feb6b4dfb9920993f6d7be0b689065b00038db939a5f3e809247
Opcode Fuzzy Hash: 722fdb885a76455fe1f062bf064ac5119acbcf1c8ca2384884441fcbd1e4c78d
Instruction Fuzzy Hash: 32F0F976200644AF9720CF0ADC84C27FBAEEBD5774719C55AE84A4BA52C671FC42CEB0

Function 06578F50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d09db09ea09251808927a3d168b334d6ddaf6d19da25e04ea4f35ce49a981b5
Instruction ID: 4683e68d53d19b568e57851d54efe827135002b66e2fe0ee9e7aa2b639d2ef78
Opcode Fuzzy Hash: 1d09db09ea09251808927a3d168b334d6ddaf6d19da25e04ea4f35ce49a981b5
Instruction Fuzzy Hash: 310116B4D04209EFCB44DFA8E9496AEBBF1BF49300F1084A9D414A3380E7340A40CF91

Function 0657ADE9 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8efd51d368d37a0c531d6fce16906f9fea613e56b616822457818054cffafd98
Instruction ID: 6afdbf8e3eba14b6e3d80039be3a3f0ef55356e1d64d787528adcd520318ad1e
Opcode Fuzzy Hash: 8efd51d368d37a0c531d6fce16906f9fea613e56b616822457818054cffafd98
Instruction Fuzzy Hash: E2F082312052406BC3512FAAB895ADBBFEFEBCB654B00446AF11AD3243CA65684587F6

Function 00DAD5E4 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2619125428.0000000000DAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dad000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9788e942d49981f3ac3294c6f2fdd74c243ce60c92816af339a0d6ca8ea21e21
Instruction ID: 879266ee8e644584feba59b806de7201c0b0a869be7f45c967bb9bb8512df9ab
Opcode Fuzzy Hash: 9788e942d49981f3ac3294c6f2fdd74c243ce60c92816af339a0d6ca8ea21e21
Instruction Fuzzy Hash: 2BF03C75104680AFD325CF05CC84C22BFB9EF867607198489E89A4B652C635FC42CB70

Function 065767C8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20d3d6b8befe97b9d1a50a8fe8932925b1f0b9d0db9a2be110682f5d69a6216a
Instruction ID: 9df69dcae416fc7707b270bd6dc225c4b4d20fa56b77992db03722213f037944
Opcode Fuzzy Hash: 20d3d6b8befe97b9d1a50a8fe8932925b1f0b9d0db9a2be110682f5d69a6216a
Instruction Fuzzy Hash: 12F02431B507006FC7208A24EC41F527FE9EB86720F048166F214CF1E2D7B1E809DB40

Function 06575098 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eac6061fd1a4f31062330f81b1b692e370208a4a1aa4fd895bc35e6141ceed2
Instruction ID: ff3eb7a17608d127dbd5b8eb6117d1f6c6cee295f48c38dccd621747f87db5a0
Opcode Fuzzy Hash: 7eac6061fd1a4f31062330f81b1b692e370208a4a1aa4fd895bc35e6141ceed2
Instruction Fuzzy Hash: BCF0FE35700204AFD714DB59D885D6BBBEAEFC9750B14C529F9098B345CA70EC4197E1

Function 0657C110 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 474aebdc9557aab05d5836fbba4cd64701656d4518ee232292892aaa9c0dfa87
Instruction ID: 9f861a8dddf85f60d98896b2a0a16e33aab4809695df6197caf40245af655c54
Opcode Fuzzy Hash: 474aebdc9557aab05d5836fbba4cd64701656d4518ee232292892aaa9c0dfa87
Instruction Fuzzy Hash: 91F0FC301057D04FC312A728E82479B3FF7DF82214B04455AE242CF242CBA55905C7A1

Function 06576EA0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a90678b1ee5f6fb8384b26c3d97e7403f1b252403f23c947708c221ddee4d72
Instruction ID: a28b2175c284645b22a7ce5fb8e30c6c66e34cbeec002778fa297b9c02ebdb48
Opcode Fuzzy Hash: 1a90678b1ee5f6fb8384b26c3d97e7403f1b252403f23c947708c221ddee4d72
Instruction Fuzzy Hash: F9F037762041E83F8B554E9A5C10CFB7FEDDA8E161B08415AFED8D2141C429C921ABB0

Function 06578341 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 650d330d99ad22ae62edd2be8409fbf83d4616d99a4bdad40abf989367e67ebd
Instruction ID: 78e045723cc263d8e4844c3f077390dff56cbe56cbd22e6e60c370ed4a814576
Opcode Fuzzy Hash: 650d330d99ad22ae62edd2be8409fbf83d4616d99a4bdad40abf989367e67ebd
Instruction Fuzzy Hash: D1F0EC31F101155B8B50996DAC9C9BF7BFDFB851617080037E914D3240FB34981587B1

Function 06578FC0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38a9427319beaa6dad581b222622deae7c24d5842711717a82c15ae155e15e91
Instruction ID: fb5772a40a61a3cfb416de1c409704327920598c5650b9e8c23c42d2fa78bfe8
Opcode Fuzzy Hash: 38a9427319beaa6dad581b222622deae7c24d5842711717a82c15ae155e15e91
Instruction Fuzzy Hash: 9FF0A9B0C09249DFDB40CFA0E8195AEBFB0FF1A201F0041E6E802E73A1E7384A41CB41

Function 0657B368 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cade7c2d45d72fe1fec563da046bf351276857ef76c456ba23732227bd77f82
Instruction ID: 9e1fd492183fd233558b740068165d2f4787bdfd0cbc091ff725cceab2883883
Opcode Fuzzy Hash: 2cade7c2d45d72fe1fec563da046bf351276857ef76c456ba23732227bd77f82
Instruction Fuzzy Hash: EBF03C34A01208EFCB48EFB8E455A5CBBB2FB48200B5481AAE906DB355EF305E44CF55

Function 065754F8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33e8fc69f83316313017a47398ea34cad997cda7e4b7888c521617a4a589d174
Instruction ID: 64177d8f409ffc4452c6980458acb36e6147935b92f161e5bbea7d9b89560976
Opcode Fuzzy Hash: 33e8fc69f83316313017a47398ea34cad997cda7e4b7888c521617a4a589d174
Instruction Fuzzy Hash: 2BF0B4715007418FDBA9CE61F501B67BBB2BF80715F48886DE04646A65EE75E489CF40

Function 0657AC60 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5031caed275ac1cac20ad88ca484e98e792d1ba6d21c4b3166a7965a7ad39d6
Instruction ID: 3f3884e573425ce2bf0d12b97726885ca9a769711c33fe1cf9fbb1d5d02397f2
Opcode Fuzzy Hash: e5031caed275ac1cac20ad88ca484e98e792d1ba6d21c4b3166a7965a7ad39d6
Instruction Fuzzy Hash: 10F082312082945FC7171B6978644DE7F6BDB86554304009BE586CB293DA540945C7EA

Function 0657ADF8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84a785186fe8f6cc36b3a87127b9ff0c1a527e7c61c7c0ef537cf1ffca51a543
Instruction ID: 218f91cdda2cf53e8597749f3c2618b6ebd7bb0920c0218c4a412c8cca006c95
Opcode Fuzzy Hash: 84a785186fe8f6cc36b3a87127b9ff0c1a527e7c61c7c0ef537cf1ffca51a543
Instruction Fuzzy Hash: 3BE012312001006BC7546E9AB489A9F7ADFEBCA755B40452DF20ED3242DEB6684547F5

Function 0657C180 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c81011f006cd8dcb935d24610672e85f92204d903e9f872191db25b32d6d5d2d
Instruction ID: 812f0120f31faebb9cb4965601d333bc9d9f1d363f0e9afa8277f0c8c4b83dd9
Opcode Fuzzy Hash: c81011f006cd8dcb935d24610672e85f92204d903e9f872191db25b32d6d5d2d
Instruction Fuzzy Hash: 1CF09075500B018FD715DF2AE448516BBF7FB88310700C62EE94BC6A10DF70A54ACF84

Function 0657CC38 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e37e0e713d672f36b8c16f99ccedc649238d9afafd91ef3455f2e36345b8bf9
Instruction ID: 5a42cbd4385418fa92d1930d09d5f254bf8d5df2966f83abbc74826b03ff6505
Opcode Fuzzy Hash: 9e37e0e713d672f36b8c16f99ccedc649238d9afafd91ef3455f2e36345b8bf9
Instruction Fuzzy Hash: 68E048311066545FC742EA29FC64BDA3766EB46A61B00415AE040C7647DB341E498BE2

Function 0657B500 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd618fcde6b783b58d06a85aec2f0ced0cefcc7b05e7ae68b720515718d1dc3a
Instruction ID: 616e865db5c7c3836df43fde74b1b5c1916033f51e8f446ce0ab79106e4247b8
Opcode Fuzzy Hash: cd618fcde6b783b58d06a85aec2f0ced0cefcc7b05e7ae68b720515718d1dc3a
Instruction Fuzzy Hash: E4F01535D0020CAFCB41DFB8E9488CDBBB9EB44200F1082A6D905EA240FA315B559B90

Function 0657C120 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f60c3733377eaf841f4f3b4b0e587496235a0c8ec7ea68d765d6f318734a01ba
Instruction ID: d6fee7089516c4cdd8e5c6315bd7075b5f6c59b62f2007dfd5506010afc0d8dc
Opcode Fuzzy Hash: f60c3733377eaf841f4f3b4b0e587496235a0c8ec7ea68d765d6f318734a01ba
Instruction Fuzzy Hash: 28E065302047904FC715AB2DF41879F7BEBDF85654F04852EE246CF641DBB5AC058B96

Function 0657CE88 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f425845f6b4c9818ad673fef832c65d4b416c095fa4aa3dc73d4ac95efda624f
Instruction ID: 65fcce6b9b80ed559b5d0765e3824f050186c033741bc31e12286ddaa21ef64e
Opcode Fuzzy Hash: f425845f6b4c9818ad673fef832c65d4b416c095fa4aa3dc73d4ac95efda624f
Instruction Fuzzy Hash: C8E09270105355EFCB43AA25F955B963BA5BF02620705409AE840CB647D7348D0187A6

Function 06575698 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07249a662d12c80f01a5558a0f166ab3c683644d691d86d9732c538799d4449e
Instruction ID: 0b0777481ac3d138ed4e9b3c0371746f48855c6f22a4d6e8b11384479bf4fdf1
Opcode Fuzzy Hash: 07249a662d12c80f01a5558a0f166ab3c683644d691d86d9732c538799d4449e
Instruction Fuzzy Hash: 99E092B210C310AFD3049B60E81589B7BA4EB95221B05886EF444C7141E671E945C7A5

Function 0657E280 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61fd39d9d09abde29504ce3451884204cb776528f5d37ad4f7d2e5d152aa52c6
Instruction ID: df47b382838c7ec666894cf786e76fee29e44f5de13f2c6291ee73d14799012d
Opcode Fuzzy Hash: 61fd39d9d09abde29504ce3451884204cb776528f5d37ad4f7d2e5d152aa52c6
Instruction Fuzzy Hash: A5E0D8350057059FC701F625BC5178537A9B745B00B014049E4119B69BD7741E568BE5

Function 0657E1FF Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07e2b75e7088297b60dd7128462b470dfa445173648b92d75d52536a15b09862
Instruction ID: 85920d10c9ce00c9827cee8c4366d0d445e4f0f331359761ba796bf8775b25ec
Opcode Fuzzy Hash: 07e2b75e7088297b60dd7128462b470dfa445173648b92d75d52536a15b09862
Instruction Fuzzy Hash: ACE0D871A45304EFC701CF68E801AAE3BB6DB42200F2041DBE409DB291D5704F148752

Function 0657E8F8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36d29a91d38eb21caca6d61eda6ef733b2c2ba0af57645f0016679fe922b0983
Instruction ID: ea022c25b6dca35426cf300a47143c0e309f78cb7aaecad01ae3c31352409512
Opcode Fuzzy Hash: 36d29a91d38eb21caca6d61eda6ef733b2c2ba0af57645f0016679fe922b0983
Instruction Fuzzy Hash: 6EE01239115244AFC712AB68ED60C963F7ABF4A71030440C5F5408F273C721DA21DBB1

Function 0657AC80 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9f5542a01ac1a4e10999f3f7caced7b866bcea8675bbc5c416018211463287b
Instruction ID: 58ab717ac01ab410964717d6fd3a0a24e446506983aa0a326f137bfb074db195
Opcode Fuzzy Hash: c9f5542a01ac1a4e10999f3f7caced7b866bcea8675bbc5c416018211463287b
Instruction Fuzzy Hash: EED05B31310115678B45276AF4584AE77ABDBC5761300552DF607D3340DF755D0147E5

Function 0657B510 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f8c75c9b6931f63e4c05d1fe08beea0e427cfb39707a13025eda5faef5c0e00
Instruction ID: af1fbf40581c20dc6098a861ecbee29ca765ce0eb609606ce68c2cb02cfab3be
Opcode Fuzzy Hash: 6f8c75c9b6931f63e4c05d1fe08beea0e427cfb39707a13025eda5faef5c0e00
Instruction Fuzzy Hash: 15E07575D0020CEFCB40DFA4D5448DDBBB9EB48200F1082A6D905E7200EA315B559B80

Function 0657E210 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52ebd2b6cc8716c493329bce65fed1038f81120506df94a874d54189e33cb8dd
Instruction ID: 1db1549a6f8aaf5b92f5d1d5de02c12987253b1ef3a10735c20cd78066223f34
Opcode Fuzzy Hash: 52ebd2b6cc8716c493329bce65fed1038f81120506df94a874d54189e33cb8dd
Instruction Fuzzy Hash: 59D05B71A0020CFFCB40DFACE90195D77B9DB45214B1081EDD409D7241EA715F009B91

Function 0657F8EA Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c28e8d5137a08c5bcac4704afe2b7eb53eada8a1130b0d2b5aca31eddfb913e8
Instruction ID: da078da2c7de1b191b213d594636516841551f341f2ea7e7494375cbaef384ab
Opcode Fuzzy Hash: c28e8d5137a08c5bcac4704afe2b7eb53eada8a1130b0d2b5aca31eddfb913e8
Instruction Fuzzy Hash: 40C080727040100B0388BA5C702006E75D7D3CD2E3385403FFA0EC7344CE708D4243A5

Function 06573721 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd48fa46a3268362b526e3dc0cf0e37ae1076830a841e7fbc65494abef5ee034
Instruction ID: 10f19f6b274e26e811eed0d03512d400f5d2b64fc0498091fe7084936e66c742
Opcode Fuzzy Hash: cd48fa46a3268362b526e3dc0cf0e37ae1076830a841e7fbc65494abef5ee034
Instruction Fuzzy Hash: B8B092B229010077E7145100EC07FD63929D7D1B60F1A9216BA06A9585CA9EA01995B5

Function 0657DFD1 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621144766.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9253832cb1ea34ba812ffcea737badae43d0899e97acfe5352c0fdcb9022a1
Instruction ID: 7a3d05e1127be7f4aabc6c96b62811d98f42abd7b6a0a8d09f85fd26d0e26d01
Opcode Fuzzy Hash: ae9253832cb1ea34ba812ffcea737badae43d0899e97acfe5352c0fdcb9022a1
Instruction Fuzzy Hash: 3EC0923568E3E88EDF021BB9AC1DC003E227F82A3171641CBE241CE1A3D6620006C7B2

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 46VHQmFDxC.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Desktop\Google Chrome.lnk

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\46VHQmFDxC.exe.log

C:\Users\user\AppData\Local\Temp\Tmp7327.tmp

C:\Users\user\AppData\Local\Temp\Tmp7338.tmp

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

C:\Users\user\AppData\Roaming\gdi32.dll

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Windows Analysis Report
46VHQmFDxC.exe

Function 6D4C55B0 Relevance: 16.8, APIs: 3, Strings: 6, Instructions: 1054
COMMON

Function 6D4EFA1E Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Function 6D4EFACE Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Function 6D4EF917 Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Function 6D4F401E Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE