Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1649093
MD5:	ca4a37c4e37044a6f27a300047cc41f5
SHA1:	eac1104e810b8a05e9cb8900a0e4daf73ab8998c
SHA256:	a55181a9277efe47ba8744273e847a42e5de4700c7f89e2e2cc12bd45f26661a
Tags:	NETexeMSILuser-jstrosch
Infos:

Detection

Score:	80
Range:	0 - 100
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

.NET source code contains very large array initializations

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Installs new ROOT certificates

Joe Sandbox ML detected suspicious sample

Overwrites Mozilla Firefox settings

Tries to harvest and steal browser information (history, passwords, etc)

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops certificate files (DER)

Enables debug privileges

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 1992 cmdline: "C:\Users\user\Desktop\file.exe" MD5: CA4A37C4E37044A6F27A300047CC41F5)

MSBuild.exe (PID: 5396 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cmd.exe (PID: 2312 cmdline: "cmd.exe" /C timeout 1 && del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 7366FBEFE66BA0F1F5304F7D6FEF09FE)

timeout.exe (PID: 2864 cmdline: timeout 1 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Compliance
• Networking
• E-Banking Fraud
• System Summary
• Data Obfuscation
• Persistence and Installation Behavior
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection
• Lowering of HIPS / PFW / Operating System Security Settings
• Stealing of Sensitive Information

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: file.exe

Virustotal: Detection: 15%

Perma Link

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Neural Call Log Analysis: 98.5%

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: d:\build\ob\bora-21004615\cayman_pcre\pcre\src\build-VS2017\Release\pcre.pdb source: file.exe
Source:	Binary string: D:\build\ob\bora-18521611\bora\build\build\LIBRARIES\sysimgbase\win32\release\sysimgbase.pdb\ source: file.exe
Source:	Binary string: d:\build\ob\bora-16930445\cayman_libsigcpp2\libsigcpp2\src\MSVC_Net2015\Win32\Release\sigc-2.0.pdb source: file.exe
Source:	Binary string: wntdll.pdbUGP source: file.exe, 00000001.00000002.1631698740.0000000003AC5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: d:\build\ob\bora-16930445\cayman_libsigcpp2\libsigcpp2\src\MSVC_Net2015\Win32\Release\sigc-2.0.pdb## source: file.exe
Source:	Binary string: wntdll.pdb source: file.exe, 00000001.00000002.1631698740.0000000003AC5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\build\ob\bora-18521611\bora\build\build\LIBRARIES\sysimgbase\win32\release\sysimgbase.pdb source: file.exe
Source:	Binary string: d:\build\ob\bora-21004615\cayman_pcre\pcre\src\build-VS2017\Release\pcre.pdb** source: file.exe

Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	TCP traffic detected without corresponding DNS query: 184.86.251.5
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.72.131
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.72.131
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.72.131
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	TCP traffic detected without corresponding DNS query: 184.86.251.5
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.72.131
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.131.245
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.131.245
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.72.131
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.131.245
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.131.245
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.131.245
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.72.131
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.131.245
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.72.131
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.131.245
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog

Source: global traffic

DNS traffic detected: DNS query: c.pki.goog

Source: file.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: file.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: file.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: file.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: file.exe	String found in binary or memory: http://ccodearchive.net/
Source: file.exe	String found in binary or memory: http://creativecommons.org/licenses/publicdomain.
Source: file.exe	String found in binary or memory: http://creativecommons.org/publicdomain/zero/1.0/
Source: file.exe	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: file.exe	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: file.exe	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: file.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: file.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: file.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: file.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: file.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: file.exe	String found in binary or memory: http://hdl.handle.net/1895.22/1013
Source: file.exe	String found in binary or memory: http://info.isl.ntt.co.jp/crypt/eng/info/chiteki.html
Source: file.exe	String found in binary or memory: http://invisible-island.net/ncurses/ncurses-examples.html
Source: file.exe	String found in binary or memory: http://jquery.com/
Source: file.exe	String found in binary or memory: http://jquery.org/license
Source: file.exe	String found in binary or memory: http://mail.gnome.org/archives/gtk-devel-list/2001-October/msg00087.html
Source: file.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: file.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: file.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: file.exe	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: file.exe	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: file.exe	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: file.exe	String found in binary or memory: http://opensource.org/licenses/ms-rl
Source: file.exe	String found in binary or memory: http://openwall.info/wiki/people/solar/software/public-domain-source-code/md5
Source: file.exe	String found in binary or memory: http://pcre.org/
Source: file.exe	String found in binary or memory: http://purl.oclc.org/dsdl/schematron
Source: file.exe	String found in binary or memory: http://purl.oclc.org/dsdl/schematronhttp://www.ascc.net/xml/schematronFailed
Source: file.exe	String found in binary or memory: http://relaxng.org/ns/structure/1.0
Source: file.exe	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: file.exe	String found in binary or memory: http://sizzlejs.com/
Source: file.exe	String found in binary or memory: http://tools.ietf.org/html/rfc1950
Source: file.exe	String found in binary or memory: http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm
Source: file.exe	String found in binary or memory: http://web.cs.ucdavis.edu/~rogaway/ocb/license1.pdf
Source: file.exe	String found in binary or memory: http://www.apache.org/licenses/LICENSE
Source: file.exe	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: file.exe	String found in binary or memory: http://www.ascc.net/xml/schematron
Source: file.exe	String found in binary or memory: http://www.bis.doc.gov/.
Source: file.exe	String found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/
Source: file.exe	String found in binary or memory: http://www.cnri.reston.va.us)
Source: file.exe	String found in binary or memory: http://www.cwi.nl)
Source: file.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe	String found in binary or memory: http://www.freetype.org)
Source: file.exe	String found in binary or memory: http://www.fsf.org
Source: file.exe	String found in binary or memory: http://www.gnu.org/licenses/
Source: file.exe	String found in binary or memory: http://www.levien.com/gdkrgb/
Source: file.exe	String found in binary or memory: http://www.mico.org/
Source: file.exe	String found in binary or memory: http://www.mozilla.org/MPL/
Source: file.exe	String found in binary or memory: http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtd
Source: file.exe	String found in binary or memory: http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtd-//OASIS//DTD
Source: file.exe	String found in binary or memory: http://www.openismus.com/
Source: file.exe	String found in binary or memory: http://www.opensource.org
Source: file.exe	String found in binary or memory: http://www.openssl.org/)
Source: file.exe	String found in binary or memory: http://www.pythonlabs.com/logos.html
Source: file.exe	String found in binary or memory: http://www.pythonware.com
Source: file.exe	String found in binary or memory: http://www.vmware.com/0/
Source: file.exe	String found in binary or memory: http://www.vmware.com/download/open_source.html
Source: file.exe	String found in binary or memory: http://www.xiph.org/
Source: file.exe	String found in binary or memory: http://www.zope.com/Marks).
Source: MSBuild.exe, 00000002.00000002.1689809314.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&ci=16965131449
Source: MSBuild.exe, 00000002.00000002.1689809314.0000000002A21000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1689809314.0000000002B23000.00000004.00000800.00020000.00000000.sdmp, prefs.js.2.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&ci=1696513144932.12791&key=1696513144400700
Source: MSBuild.exe, 00000002.00000002.1689809314.0000000002A21000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1689809314.0000000002B23000.00000004.00000800.00020000.00000000.sdmp, prefs.js.2.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&ci=1696513144932.12791&key=1696513144400700003.1&cta
Source: MSBuild.exe, 00000002.00000002.1689809314.0000000002A21000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1689809314.0000000002B23000.00000004.00000800.00020000.00000000.sdmp, prefs.js.2.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: MSBuild.exe, 00000002.00000002.1689809314.0000000002A21000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1689809314.0000000002B23000.00000004.00000800.00020000.00000000.sdmp, prefs.js.2.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: file.exe	String found in binary or memory: https://cs.chromium.org/chromium/src/LICENSE
Source: file.exe	String found in binary or memory: https://datatracker.ietf.org/ipr/1524/
Source: file.exe	String found in binary or memory: https://datatracker.ietf.org/ipr/1526/
Source: file.exe	String found in binary or memory: https://datatracker.ietf.org/ipr/1914/
Source: file.exe	String found in binary or memory: https://github.com/kiyolee/pcre-win-build/
Source: file.exe	String found in binary or memory: https://gitlab.gnome.org/GNOME/libxml2D
Source: prefs.js.2.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4ClZfC2k4pbW4ZbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi
Source: MSBuild.exe, 00000002.00000002.1689809314.0000000002A21000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1689809314.0000000002B23000.00000004.00000800.00020000.00000000.sdmp, prefs.js.2.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_b07fa4138d6cee96061521c23bb7cd6608bee0c31ef2bfdc
Source: MSBuild.exe, 00000002.00000002.1689809314.0000000002A21000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1689809314.0000000002B23000.00000004.00000800.00020000.00000000.sdmp, prefs.js.2.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: file.exe	String found in binary or memory: https://www.globalsign.com/repository/0
Source: file.exe	String found in binary or memory: https://www.gnu.org/licenses/
Source: file.exe	String found in binary or memory: https://www.openssl.org/source/license.html
Source: file.exe	String found in binary or memory: https://www.python.org/psf/)
Source: file.exe	String found in binary or memory: https://www.qt.io/licensing/
Source: file.exe	String found in binary or memory: https://www.ribose.com).

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Temp\TmpB237.tmp			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Temp\TmpB1F8.tmp			Jump to dropped file

System Summary

.NET source code contains very large array initializations

Source: file.exe, a.cs

Large array initialization: Main: array initializer size 32768

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FB56D0 NtAllocateVirtualMemory,	1_2_00FB56D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FB5438 NtReadVirtualMemory,	1_2_00FB5438
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FB5808 NtWriteVirtualMemory,	1_2_00FB5808
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FB5958 NtResumeThread,	1_2_00FB5958
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FB5318 NtSetContextThread,	1_2_00FB5318
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FB56C8 NtAllocateVirtualMemory,	1_2_00FB56C8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FB5430 NtReadVirtualMemory,	1_2_00FB5430
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FB5803 NtWriteVirtualMemory,	1_2_00FB5803
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FB5950 NtResumeThread,	1_2_00FB5950
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FB5310 NtSetContextThread,	1_2_00FB5310

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FB302D	1_2_00FB302D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FB1A10	1_2_00FB1A10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FB4717	1_2_00FB4717
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FB3087	1_2_00FB3087
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FB1A03	1_2_00FB1A03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00F3DB10	2_2_00F3DB10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_059C0410	2_2_059C0410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_059C5C88	2_2_059C5C88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_059C0C38	2_2_059C0C38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_059C4640	2_2_059C4640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_059C0C28	2_2_059C0C28

Source: file.exe, 00000001.00000002.1631141051.0000000000FEE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe, 00000001.00000000.1627302149.00000000007E0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameUI.Pipeline.exe0 vs file.exe
Source: file.exe, 00000001.00000000.1628419204.0000000000810000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameGlossina.exe@ vs file.exe
Source: file.exe, 00000001.00000000.1627302149.0000000000646000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamelibpcre.dll* vs file.exe
Source: file.exe, 00000001.00000000.1627302149.0000000000646000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesigc-2.0.dll4 vs file.exe
Source: file.exe, 00000001.00000002.1631495575.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUI.Pipeline.exe0 vs file.exe
Source: file.exe, 00000001.00000000.1627302149.00000000002F2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamelibxml2.dll0 vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamelibxml2.dll0 vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamelibpcre.dll* vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamesigc-2.0.dll4 vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameUI.Pipeline.exe0 vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameGlossina.exe@ vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal80.phis.spyw.evad.winEXE@8/7@2/0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2620:120:WilError_03

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Local\Temp\TmpB1F8.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.69%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

Virustotal: Detection: 15%

Source: file.exe	String found in binary or memory: curl-7.70.0/install-sh
Source: file.exe	String found in binary or memory: tiff-4.1.0/contrib/addtiffo/addtiffo.c
Source: file.exe	String found in binary or memory: tiff-4.1.0/contrib/addtiffo/tif_overview.c
Source: file.exe	String found in binary or memory: tiff-4.1.0/contrib/addtiffo/tif_ovrcache.c
Source: file.exe	String found in binary or memory: tiff-4.1.0/contrib/addtiffo/tif_ovrcache.h
Source: file.exe	String found in binary or memory: tiff-4.1.0/contrib/addtiffo/Makefile.in
Source: file.exe	String found in binary or memory: tiff-4.1.0/contrib/addtiffo/Makefile.am
Source: file.exe	String found in binary or memory: tiff-4.1.0/contrib/addtiffo/CMakeLists.txt
Source: file.exe	String found in binary or memory: tiff-4.1.0/config/install-sh
Source: file.exe	String found in binary or memory: openssl-1.1.1h/util/add-depends.pl
Source: file.exe	String found in binary or memory: pcre-8.44/INSTALL
Source: file.exe	String found in binary or memory: pcre-8.44/install-sh
Source: file.exe	String found in binary or memory: [VMWARE DOES NOT DISTRIBUTE SUB-COMPONENT DOC-INSTALL.PL]
Source: file.exe	String found in binary or memory: atkmm-2.22.7.tar.xz\atkmm-2.22.7.tar\atkmm-2.22.7\doc\doc-install.pl
Source: file.exe	String found in binary or memory: pulseaudio-0.9.22.tar.gz\pulseaudio-0.9.22.tar\pulseaudio-0.9.22\src\modules\bluetooth\proximity-helper.c
Source: file.exe	String found in binary or memory: librsvg-2.40.21/INSTALL
Source: file.exe	String found in binary or memory: librsvg-2.40.21/install-sh
Source: file.exe	String found in binary or memory: ISO_6937-2-add
Source: file.exe	String found in binary or memory: NATS-SEFI-ADD
Source: file.exe	String found in binary or memory: NATS-DANO-ADD
Source: file.exe	String found in binary or memory: JIS_C6229-1984-b-add
Source: file.exe	String found in binary or memory: jp-ocr-b-add
Source: file.exe	String found in binary or memory: JIS_C6229-1984-hand-add
Source: file.exe	String found in binary or memory: jp-ocr-hand-add

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C timeout 1 && del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C timeout 1 && del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 1	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: esdsip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptprov.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32

Jump to behavior

Source: Google Chrome.lnk.2.dr	LNK file: ..\..\..\Program Files\Google\Chrome\Application\chrome.exe
Source: Google Chrome.lnk0.2.dr	LNK file: ..\..\..\..\..\..\..\Program Files (x86)\Google\Chrome\Application\chrome.exe
Source: Microsoft Edge.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Source: Google Chrome.lnk1.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files (x86)\Google\Chrome\Application\chrome.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: file.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: file.exe

Static file information: File size 5363712 > 1048576

Source: file.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x51cc00

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: d:\build\ob\bora-21004615\cayman_pcre\pcre\src\build-VS2017\Release\pcre.pdb source: file.exe
Source:	Binary string: D:\build\ob\bora-18521611\bora\build\build\LIBRARIES\sysimgbase\win32\release\sysimgbase.pdb\ source: file.exe
Source:	Binary string: d:\build\ob\bora-16930445\cayman_libsigcpp2\libsigcpp2\src\MSVC_Net2015\Win32\Release\sigc-2.0.pdb source: file.exe
Source:	Binary string: wntdll.pdbUGP source: file.exe, 00000001.00000002.1631698740.0000000003AC5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: d:\build\ob\bora-16930445\cayman_libsigcpp2\libsigcpp2\src\MSVC_Net2015\Win32\Release\sigc-2.0.pdb## source: file.exe
Source:	Binary string: wntdll.pdb source: file.exe, 00000001.00000002.1631698740.0000000003AC5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\build\ob\bora-18521611\bora\build\build\LIBRARIES\sysimgbase\win32\release\sysimgbase.pdb source: file.exe
Source:	Binary string: d:\build\ob\bora-21004615\cayman_pcre\pcre\src\build-VS2017\Release\pcre.pdb** source: file.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00F33348 pushfd ; iretd

2_2_00F33369

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BFC5FBF042F25A0BCAF8B7C2544DA203DF898B12 Blob

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Memory allocated: F70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 2AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 4AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: F30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2A20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 4A20000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 5360	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2012	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: file.exe	Binary or memory string: [VMware does not distribute this component 15-test_mp_rsa.t]
Source: file.exe	Binary or memory string: [VMware does not distribute this component ec_mult.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component e_afalg.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component dhtest.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 02-test_stack.t]
Source: file.exe	Binary or memory string: [VMware does not distribute this component idea_local.h]
Source: file.exe	Binary or memory string: [VMWARE DOES NOT DISTRIBUTE SUB-COMPONENT LIBFFI.EXP]
Source: file.exe	Binary or memory string: [VMware does not distribute this component tasn_dec.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component tls13secretstest.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component sljitNativePPC_common.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component pk7_smime.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 70-test_sslextension.t]
Source: file.exe	Binary or memory string: [VMware does not distribute this component uid.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component armcap.c]
Source: file.exe	Binary or memory string: VMWARE_B2B
Source: file.exe	Binary or memory string: [VMware does not distribute this component main.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component tserr.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component asn1_encode_test.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component RSA_public_encrypt.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component req.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component seed_cbc.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component ec_curve.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component x509_internal_test.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component ssl_asn1.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component a_d2i_fp.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component a_time.c]
Source: file.exe	Binary or memory string: @&!@@(msg.foundryErrMsgId.VIX_E_MNTAPI_CANT_MAKE_VAR_DIR)Cannot create directory '/var/run/vmware/fuse'
Source: file.exe	Binary or memory string: [VMware does not distribute this component obj_lib.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component SSL_CTX_set_record_padding_callback.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component o2i_SCT_LIST.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component ec_check.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component objectserr.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 99-test_ecstress.t]
Source: file.exe	Binary or memory string: [VMware does not distribute this component e_capi.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component EVP_PKEY_CTX_set_tls1_prf_md.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component mkdef.pl]
Source: file.exe	Binary or memory string: [VMware does not distribute this component SSL_CTX_set_cert_verify_callback.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component bn-c64xplus.asm]
Source: file.exe	Binary or memory string: [VMware does not distribute this component modes.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component dsa_prn.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component pmeth_gn.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component rsa_lib.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component rsa_sign.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component bioerr.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 80-test_ssl_old.t]
Source: file.exe	Binary or memory string: [VMware does not distribute this component ssl_init.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component pcre_jit_test.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 90-test_srp.t]
Source: file.exe	Binary or memory string: [VMware does not distribute this component s390x.S]
Source: file.exe	Binary or memory string: [VMware does not distribute this component passwd.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component rdcolmap.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component tb_pkmeth.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component SSL_get_peer_certificate.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component libpng-1.6.37.tar.gz\libpng-1.6.37.tar\libpng-1.6.37\contrib\oss-fuzz\libpng_read_fuzzer.cc]
Source: file.exe	Binary or memory string: VMware, Inc.1!0
Source: file.exe	Binary or memory string: [VMware does not distribute this component e_afalg.txt]
Source: file.exe	Binary or memory string: [VMware does not distribute this component v3_asid.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component cms_asn1.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component bss_log.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component driver.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component X509_NAME_get_index_by_NID.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component cipher_overhead_test.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component RIPEMD160_Init.pod]
Source: file.exe	Binary or memory string: <VMWARE-NULL>
Source: file.exe	Binary or memory string: [VMware does not distribute this component README.ijg]
Source: file.exe	Binary or memory string: [VMware does not distribute this component uplink-x86.pl]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 30-test_evp_extra.t]
Source: file.exe	Binary or memory string: [VMware does not distribute this component RAND_DRBG_get0_master.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component rc2cfb64.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component rc5cfb64.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component DTLS_get_data_mtu.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component SSL_CONF_CTX_set_ssl_ctx.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component ssl.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component scrypt.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component d1_lib.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component sha512.c]
Source: file.exe	Binary or memory string: @&!@@(msg.gostable8.guest.vmware-photon-64)VMware Photon OS 64-bit
Source: file.exe	Binary or memory string: [VMware does not distribute this component 03-test_internal_modes.t]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 17-renegotiate.conf.in]
Source: file.exe	Binary or memory string: [VMware does not distribute this component pcre16_config.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component mem_dbg.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 05-test_hmac.t]
Source: file.exe	Binary or memory string: [VMware does not distribute this component f_impl.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component SSL_get_peer_signature_nid.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component Makefile.in]
Source: file.exe	Binary or memory string: http://Failed to create socket to connect to vmware-authd (error %d).127.0.0.1Failed to connect to socket to vmware-authd (error %d).tlocalconnectlocalconnect%s message failed: %s%s message-send failed to send required bytes (sent:%d required:%d)Failed to read response to %s message: %sERRORFailed to read vmware-authd port number: %sTLOCALCONNECT%d %nMalformed response "%s"LOCALCONNECTUnknown response "%s"CnxAuthdConnectPipe%s: CreateFileW failed with ERROR_PIPE_BUSY
Source: file.exe	Binary or memory string: [VMware does not distribute this component ssl_utst.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component dso_vms.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component vms_rms.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component BN_num_bytes.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component EVP_blake2b512.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component ts_local.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component srp.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component ecdh_kdf.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component ar-lib]
Source: file.exe	Binary or memory string: [VMware does not distribute this component mkbuildinf.pl]
Source: file.exe	Binary or memory string: [VMware does not distribute this component jfdctflt.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component aria.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 05-sni.conf.in]
Source: file.exe	Binary or memory string: [VMware does not distribute this component md5cmp.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component field.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component LICENCE]
Source: file.exe	Binary or memory string: [VMware does not distribute this component v3_addr.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component pcre_newline.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component x509_att.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component m_sha3.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component pcre32_utf32_utils.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component tjbench.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component ripemd.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component srp_vfy.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component conf_include_test.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component bss_bio.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component evp_asn1.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component dsa_no_digest_size_test.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component asynctest.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 13-fragmentation.conf.in]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 80-test_cipherbytes.t]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 15-certstatus.conf.in]
Source: file.exe	Binary or memory string: [VMware does not distribute this component sm4.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component SSL_CTX_free.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component kdf.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component e_dasync_err.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component BN_rand.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component SSL_get_current_cipher.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component poly1305_ameth.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component ssl_test_ctx_test.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 02-protocol-version.conf.in]
Source: file.exe	Binary or memory string: [VMware does not distribute this component seed_ecb.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component ocsp_lib.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component f_int.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component b_print.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component rsa_pss.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component openssl.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component des_local.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component p12_add.c]
Source: file.exe	Binary or memory string: clinuxPreGlibc25.isolinux.isodarwinPre15.isodarwin.isofreebsd.isowindows.isonetware.isowinPre2k.isosolaris.isowinPreVista.isoamazonlinuxarm-debianarm-Fedoraarm-freeBSDarm-otherarm-other5xlinuxarm-other6xlinuxarm-rhelarm-ubuntuarm-vmkernelarm-vmware-photonarm-windowsasianuxcoreosCRXPodCRXSysdebianflatcarlinuxMintnldnt4oesopenserveros2experimentalrhelunixwarevmware-photonwhistlerwin2000windows2019srvwindows2019srvNextwindows2022srvNextwindows7Server64Guestwindows7srvwindows8srvwindows9srvwinLonghorn64GuestwinLonghornGuestwinServer2008ClusterwinServer2008DatacenterwinServer2008DatacenterCorewinServer2008EnterprisewinServer2008EnterpriseCorewinServer2008SmallBusinesswinServer2008SmallBusinessPremiumwinServer2008StandardwinServer2008StandardCorewinServer2008WebwinVista
Source: file.exe	Binary or memory string: [VMware does not distribute this component PEM_write_bio_PKCS7_stream.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component cb.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component PKCS7_sign_add_signer.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component e_null.c]
Source: file.exe	Binary or memory string: [PURSUANT TO THE LICENSE TERMS FOR LIBPAM-0.99.3.0, VMWARE IS ELECTING TO
Source: file.exe	Binary or memory string: [VMware does not distribute this component objxref.pl]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 06-sni-ticket.conf.in]
Source: file.exe	Binary or memory string: [VMware does not distribute this component find-unused-errs]
Source: file.exe	Binary or memory string: [VMware does not distribute this component dsa_gen.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component pkcs7err.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component RAND_egd.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component pcbc_enc.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component tb_rsa.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component config.guess]
Source: file.exe	Binary or memory string: [VMware does not distribute this component a_digest.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component testutil_init.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component vms_decc_init.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component cryptlib.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component bss_file.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component ocspapitest.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component rand_drbg.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component pcre_fullinfo.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component OSSL_STORE_INFO.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component v3_pcons.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component e_old.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component dso_openssl.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component sslbuffertest.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 02-test_internal_ctype.t]
Source: file.exe	Binary or memory string: [VMware does not distribute this component X509_cmp.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component f_impl.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component su-filter.pl]
Source: file.exe	Binary or memory string: [VMware does not distribute this component symhacks.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component packeted_bio.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component e_rc4.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component x509_meth.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 80-test_cms.t]
Source: file.exe	Binary or memory string: [VMware does not distribute this component i_ofb64.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component evp_test.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component pcre_study.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component c_ofb64.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component missing]
Source: file.exe	Binary or memory string: [VMware does not distribute this component pcre16_string_utils.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 05-test_md2.t]
Source: file.exe	Binary or memory string: [VMware does not distribute this component SSL_CTX_load_verify_locations.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component README.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component safestack.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 80-test_pkcs12.t]
Source: file.exe	Binary or memory string: [VMware does not distribute this component s3_msg.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component lhash.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component BN_CTX_new.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component dsa_ameth.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component bio_cb.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component pcre_printint.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component ssl_cert.c]
Source: file.exe	Binary or memory string: VMware HiddenVMware ReservedDEVCREAT: Partition type mismatch
Source: file.exe	Binary or memory string: [VMware does not distribute this component ui_util.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component x_int64.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component sm4.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component buffererr.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component SSL_CONF_CTX_set_flags.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component jdcolor-mmi.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component bftest.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component spkac.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component jfdctfst-altivec.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component store_strings.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component ct_local.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 70-test_tls13kexmodes.t]
Source: file.exe	Binary or memory string: [VMware does not distribute this component rmd_local.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component cfb64enc.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component EVP_cast5_cbc.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component p12_sbag.c]
Source: file.exe	Binary or memory string: VMWARE_CFG_DIR
Source: file.exe	Binary or memory string: [VMware does not distribute this component EVP_PKEY_print_private.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component x509_obj.c]
Source: file.exe	Binary or memory string: http://www.vmware.com/0/
Source: file.exe	Binary or memory string: [VMware does not distribute this component pkwrite.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component pk7_lib.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component by_dir.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component EVP_idea_cbc.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component conf_mall.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component md32_common.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component sljitNativeMIPS_common.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component ui_null.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component pcre_globals.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component c_allc.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component bn_exp2.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component sha.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component v3nametest.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component client.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component generate_ssl_tests.pl]
Source: file.exe	Binary or memory string: [VMware does not distribute this component conf_ssl.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component cryptlib.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component e_dasync_err.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component BIO_meth_new.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component SSL_CTX_set_cert_cb.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 10-test_bn.t]
Source: file.exe	Binary or memory string: [VMware does not distribute this component ocsp_asn.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component ts_rsp_utils.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component rsaz-x86_64.pl]
Source: file.exe	Binary or memory string: [VMware does not distribute this component checkhandshake.pm]
Source: file.exe	Binary or memory string: [VMware does not distribute this component TJTransformer.java]
Source: file.exe	Binary or memory string: [VMware does not distribute this component EVP_PKEY_cmp.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component base.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component cms_pwri.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component p5_scrypt.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component ct.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component PEM_read_bio_ex.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component bn_rand.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component rc5.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component v3_sxnet.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component statem_local.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component __DECC_INCLUDE_EPILOGUE.H]
Source: file.exe	Binary or memory string: [VMware does not distribute this component cms_local.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component conf_api.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component p12_local.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component SSL_rstate_string.pod]
Source: file.exe	Binary or memory string: @&!@@(msg.foundryErrMsgId.VIX_E_TOOLS_NOT_RUNNING)VMware Tools are not running in the guest
Source: file.exe	Binary or memory string: [VMware does not distribute this component 70-test_verify_extra.t]
Source: file.exe	Binary or memory string: [VMware does not distribute this component rsa_test.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component evp_test.h]
Source: file.exe	Binary or memory string: noreply@vmware.com0
Source: file.exe	Binary or memory string: [VMware does not distribute this component SSL_CTX_set1_sigalgs.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component errtest.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component d2i_SSL_SESSION.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component ASN1_STRING_TABLE_add.pod]
Source: file.exe	Binary or memory string: vmware
Source: file.exe	Binary or memory string: [VMware does not distribute this component sljitNativeSPARC_32.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component jfdctint-altivec.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component f_string.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component BN_copy.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component ecp_nistputil.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 90-test_shlibload.t]
Source: file.exe	Binary or memory string: [VMWARE DOES NOT DISTRIBUTE SUB-COMPONENT CJK_TAB_TO_H.C]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 03-test_internal_curve448.t]
Source: file.exe	Binary or memory string: [VMware does not distribute this component crypto.pod]
Source: file.exe	Binary or memory string: @&!@@(msg.foundryErrMsgId.VIX_E_TOOLS_INSTALL_IMAGE_COPY_FAILED)Could not copy VMware Tools image to the guest operating system
Source: file.exe	Binary or memory string: [VMware does not distribute this component 70-test_wpacket.t]
Source: file.exe	Binary or memory string: [VMware does not distribute this component CMS_get0_type.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component sparccpuid.S]
Source: file.exe	Binary or memory string: [VMware does not distribute this component curve448_tables.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component ectest.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component DSA_new.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component err.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component cmll-x86.pl]
Source: file.exe	Binary or memory string: [VMware does not distribute this component rc4_skey.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component expat-2.2.9.tar.gz\expat-2.2.9.tar\expat-2.2.9\doc\xmlwf.xml]
Source: file.exe	Binary or memory string: [VMware does not distribute this component test_test.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component dsa_sign.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 10-test_exp.t]
Source: file.exe	Binary or memory string: [VMware does not distribute this component sha1_one.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 25-test_crl.t]
Source: file.exe	Binary or memory string: [VMware does not distribute this component v3_cpols.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 20-test_enc.t]
Source: file.exe	Binary or memory string: vmware64-core
Source: file.exe	Binary or memory string: [VMware does not distribute this component dh_lib.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component x_sig.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component digest.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component e_des.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component v3_prn.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component lhash.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component EVP_PKEY_sign.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component conf_api.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component bntests.pl]
Source: file.exe	Binary or memory string: [VMware does not distribute this component x_x509.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component danetest.in]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 05-test_rand.t]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 90-test_threads.t]
Source: file.exe	Binary or memory string: [VMware does not distribute this component RSA_sign_ASN1_OCTET_STRING.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component Certificate.pm]
Source: file.exe	Binary or memory string: [VMware does not distribute this component ERR_load_strings.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component dtlsv1listentest.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 25-test_x509.t]
Source: file.exe	Binary or memory string: [VMware does not distribute this component bio.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component output.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component process_docs.pl]
Source: file.exe	Binary or memory string: [VMware does not distribute this component dsa_meth.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component pcre_visibility.m4]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 90-test_sslbuffers.t]
Source: file.exe	Binary or memory string: [VMware does not distribute this component EVP_PKEY_verify.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component jsimd_neon.S]
Source: file.exe	Binary or memory string: [VMware does not distribute this component enc.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component threads_pthread.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 05-test_cast.t]
Source: file.exe	Binary or memory string: [VMware does not distribute this component CTLOG_STORE_new.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component tb_cipher.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component jsimdext.inc]
Source: file.exe	Binary or memory string: [VMware does not distribute this component err.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component dso_lib.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component version.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component OBJ_nid2obj.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component p12_crpt.c]
Source: file.exe	Binary or memory string: [NOTE: VMWARE, INC. ELECTS TO USE AND DISTRIBUTE THIS SUBPACKAGE UNDER THE TERMS OF THE BSD-3 LICENSE, THE TEXT OF WHICH IS SET FORTH BELOW. THE ORIGINAL LICENSE TERMS ARE REPRODUCED BELOW ONLY AS A REFERENCE.]
Source: file.exe	Binary or memory string: [VMware does not distribute this component CertificateVerify.pm]
Source: file.exe	Binary or memory string: [VMware does not distribute this component x509v3.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 03-test_exdata.t]
Source: file.exe	Binary or memory string: [VMware does not distribute this component nseq.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component p_open.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component pcre16_refcount.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component pem_oth.c]
Source: file.exe	Binary or memory string: vmware-authd version (%s) does not match that of client (%u.%u)
Source: file.exe	Binary or memory string: [VMware does not distribute this component rc5_enc.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component poly1305.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component DSA_sign.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component eck_prn.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 90-test_tls13secrets.t]
Source: file.exe	Binary or memory string: [VMware does not distribute this component mem.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component cms_ess.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component refcount.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component ocsp_ht.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component rc2_local.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component ocsp_ext.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component SCT_print.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component ct.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component evp_enc.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component bf_local.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component des.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component md4.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 03-custom_verify.conf.in]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 90-test_constant_time.t]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 15-test_rsapss.t]
Source: file.exe	Binary or memory string: [VMware does not distribute this component sparcv8plus.S]
Source: file.exe	Binary or memory string: [VMware does not distribute this component SSL_get_client_random.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component str2key.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 04-test_asn1_string_table.t]
Source: file.exe	Binary or memory string: [VMware does not distribute this component SSL_session_reused.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component format_output.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component i_cfb64.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component EVP_BytesToKey.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component cms.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component SCT_new.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component store_local.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component SSL_CTX_set_tlsext_use_srtp.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component copy.pl]
Source: file.exe	Binary or memory string: [VMware does not distribute this component ServerKeyExchange.pm]
Source: file.exe	Binary or memory string: [VMWARE DOES NOT DISTRIBUTE SUB-COMPONENT LIBTOOL-LDFLAGS]
Source: file.exe	Binary or memory string: [VMware does not distribute this component pkcs7.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component blake2_local.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component pcre16_maketables.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component DSA_do_sign.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component p12_p8d.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 95-test_external_boringssl.t]
Source: file.exe	Binary or memory string: [VMware does not distribute this component e_ossltest.txt]
Source: file.exe	Binary or memory string: [VMware does not distribute this component RSA_sign.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component e_capi.txt]
Source: file.exe	Binary or memory string: [VMware does not distribute this component DH_size.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component x_val.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component ocsperr.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component ct_test.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component crl2p7.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component bio_ok.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component store_init.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component ecp_nist.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component pcre_ord2utf8.c]
Source: file.exe	Binary or memory string: [VMWARE DOES NOT DISTRIBUTE THE SUB-COMPONENT LICENSED UNDER GPL 2.0]
Source: file.exe	Binary or memory string: VMware Hidden
Source: file.exe	Binary or memory string: [VMware does not distribute this component X509_new.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component X509_SIG_get0.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component bn_err.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component ecp_mont.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component CA.pl.in]
Source: file.exe	Binary or memory string: [VMware does not distribute this component rdrand_sanitytest.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component pcre32_version.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component pem_sign.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component ui_local.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 15-test_ecparam.t]
Source: file.exe	Binary or memory string: by sending a request, with your name and address to: VMware, Inc., 3401
Source: file.exe	Binary or memory string: [VMware does not distribute this component libpng-1.6.37.tar.gz\libpng-1.6.37.tar\libpng-1.6.37\contrib\gregbook\LICENSE]
Source: file.exe	Binary or memory string: [VMware does not distribute this component configure]
Source: file.exe	Binary or memory string: [VMware does not distribute this component passwd.pod]
Source: file.exe	Binary or memory string: [VMWARE DOES NOT DISTRIBUTE THE SUB COMPONENT LICENSED UNDER GPL2.0]
Source: file.exe	Binary or memory string: [VMware does not distribute this component SSL_CTX_set_ct_validation_callback.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component ecp_oct.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component LPdir_win32.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component pem_info.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component s_apps.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 70-test_sslsignature.t]
Source: file.exe	Binary or memory string: [VMware does not distribute this component SCT_validate.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component bn_shift.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component bio_meth.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component pcre.h.in]
Source: file.exe	Binary or memory string: [VMware does not distribute this component dh_rfc5114.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component evp_cnf.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component m_md4.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component ossl_shim.cc]
Source: file.exe	Binary or memory string: [VMware does not distribute this component jquanti-mmi.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component SSL_SESSION_get0_peer.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component aes_ecb.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component dsaerr.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component DSA_generate_parameters.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component opt.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component eng_devcrypto.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component proxy-certificates.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component nsseq.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component list.pod]
Source: file.exe	Binary or memory string: [NOTE: VMWARE, INC. ELECTS TO USE AND DISTRIBUTE THIS SUBPACKAGE UNDER THE TERMS OF THE BSD-4 LICENSE, THE TEXT OF WHICH IS SET FORTH BELOW. THE ORIGINAL LICENSE TERMS ARE REPRODUCED BELOW ONLY AS A REFERENCE.]
Source: file.exe	Binary or memory string: [VMware does not distribute this component stack_test.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component conf_sap.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component dh_meth.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component evp_pkey.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component enginetest.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component testutil.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component ec.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component bnshift.txt]
Source: file.exe	Binary or memory string: [VMware does not distribute this component errstr.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component ocsp.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component rc5ofb64.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component eng_openssl.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component SSL_SESSION_get_protocol_version.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component sha_local.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component ec_key.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component SSL_CTX_set_ex_data.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component pcre16_byte_order.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component NewSessionTicket.pm]
Source: file.exe	Binary or memory string: [VMware does not distribute this component RAND_DRBG_reseed.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component pcre_string_utils.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component DSA_meth_new.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component s_server.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 03-test_internal_chacha.t]
Source: file.exe	Binary or memory string: [VMware does not distribute this component protocol_version.pm]
Source: file.exe	Binary or memory string: [VMware does not distribute this component pkcs7.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component s3_enc.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component tls13ccstest.c]
Source: file.exe	Binary or memory string: vmware-photon
Source: file.exe	Binary or memory string: [VMware does not distribute this component hm_ameth.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 80-test_ssl_test_ctx.t]
Source: file.exe	Binary or memory string: [VMware does not distribute this component EVP_mdc2.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component bn.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component PKCS12_parse.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component PEM_read_CMS.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component BIO_s_socket.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 30-test_evp.t]
Source: file.exe	Binary or memory string: [VMware does not distribute this component bn_add.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component x509_dup_cert_test.c]
Source: file.exe	Binary or memory string: [VMWARE DOES NOT DISTRIBUTE THE SUB-COMPONENT LICENSED UNDER LGPL 2.1]
Source: file.exe	Binary or memory string: @&!@@(msg.foundryErrMsgId.VIX_E_TOOLS_INSTALL_IMAGE_INACCESIBLE)The VMware Tools image is inaccessible
Source: file.exe	Binary or memory string: [VMware does not distribute this component chacha_enc.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component ax_pthread.m4]
Source: file.exe	Binary or memory string: [VMware does not distribute this component eng_local.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component smime.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component LPdir_unix.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component rand_key.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component e_padlock-x86_64.pl]
Source: file.exe	Binary or memory string: [VMware does not distribute this component d2i_test.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component pcregexp.pas]
Source: file.exe	Binary or memory string: [VMware does not distribute this component BIO_printf.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component with_fallback.pm]
Source: file.exe	Binary or memory string: [VMware does not distribute this component txt_db.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component bndiv.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component TJBench.java]
Source: file.exe	Binary or memory string: [VMware does not distribute this component engineerr.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component rsa_mp.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component kdferr.h]
Source: file.exe	Binary or memory string: [VMware does not distribute this component conf_err.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component SSL_CTX_set_ctlog_list_file.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component md4_dgst.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component BN_mod_inverse.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component 30-test_afalg.t]
Source: file.exe	Binary or memory string: [VMware does not distribute this component CMS_add1_recipient_cert.pod]
Source: file.exe	Binary or memory string: [VMware does not distribute this component uninstall.in]
Source: file.exe	Binary or memory string: [VMware does not distribute this component ClientHello.pm]
Source: file.exe	Binary or memory string: [VMware does not distribute this component TJScalingFactor.java]
Source: file.exe	Binary or memory string: [VMware does not distribute this component conf.c]
Source: file.exe	Binary or memory string: [VMware does not distribute this component OPENSSL_fork_prepare.pod]
Source: file.exe	Binary or memory string: 220 VMware Authentication Daemon Version

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 40A000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 40C000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 940008	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C timeout 1 && del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 1	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Overwrites Mozilla Firefox settings

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\xte0v1np.default-release\prefs.js			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\xte0v1np.default-release\prefs.js			Jump to behavior

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\xte0v1np.default-release\prefs.js			Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	311 Process Injection	1 Disable or Modify Tools	1 OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Browser Session Hijacking	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	311 Process Injection	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	1 Data from Local System	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	12 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Install Root Certificate	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	15%	Virustotal		Browse
SAMPLE	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://www.freetype.org)	0%	Avira URL Cloud	safe
http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtd-//OASIS//DTD	0%	Avira URL Cloud	safe
http://ccodearchive.net/	0%	Avira URL Cloud	safe
http://www.levien.com/gdkrgb/	0%	Avira URL Cloud	safe
http://invisible-island.net/ncurses/ncurses-examples.html	0%	Avira URL Cloud	safe
http://purl.oclc.org/dsdl/schematron	0%	Avira URL Cloud	safe
http://www.mico.org/	0%	Avira URL Cloud	safe
http://purl.oclc.org/dsdl/schematronhttp://www.ascc.net/xml/schematronFailed	0%	Avira URL Cloud	safe
http://www.ascc.net/xml/schematron	0%	Avira URL Cloud	safe
http://www.cnri.reston.va.us)	0%	Avira URL Cloud	safe
http://www.fsf.org	0%	Avira URL Cloud	safe
http://mail.gnome.org/archives/gtk-devel-list/2001-October/msg00087.html	0%	Avira URL Cloud	safe
http://www.xiph.org/	0%	Avira URL Cloud	safe
https://cs.chromium.org/chromium/src/LICENSE	0%	Avira URL Cloud	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&ci=1696513144932.12791&key=1696513144400700	0%	Avira URL Cloud	safe
http://openwall.info/wiki/people/solar/software/public-domain-source-code/md5	0%	Avira URL Cloud	safe
http://info.isl.ntt.co.jp/crypt/eng/info/chiteki.html	0%	Avira URL Cloud	safe
http://www.cl.cam.ac.uk/~mgk25/	0%	Avira URL Cloud	safe
http://www.zope.com/Marks).	0%	Avira URL Cloud	safe
http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtd	0%	Avira URL Cloud	safe
http://pcre.org/	0%	Avira URL Cloud	safe
http://www.pythonlabs.com/logos.html	0%	Avira URL Cloud	safe
http://web.cs.ucdavis.edu/~rogaway/ocb/license1.pdf	0%	Avira URL Cloud	safe
http://www.cwi.nl)	0%	Avira URL Cloud	safe
https://www.ribose.com).	0%	Avira URL Cloud	safe
http://www.opensource.org	0%	Avira URL Cloud	safe
http://www.openismus.com/	0%	Avira URL Cloud	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&ci=16965131449	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
pki-goog.l.google.com	142.250.65.195	true	false	high
c.pki.goog	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://c.pki.goog/r/r4.crl	false		high
http://c.pki.goog/r/gsr1.crl	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://jquery.org/license	file.exe	false		high
http://www.levien.com/gdkrgb/	file.exe	false	Avira URL Cloud: safe	unknown
http://invisible-island.net/ncurses/ncurses-examples.html	file.exe	false	Avira URL Cloud: safe	unknown
http://ccodearchive.net/	file.exe	false	Avira URL Cloud: safe	unknown
http://sizzlejs.com/	file.exe	false		high
http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtd-//OASIS//DTD	file.exe	false	Avira URL Cloud: safe	unknown
http://creativecommons.org/publicdomain/zero/1.0/	file.exe	false		high
http://purl.oclc.org/dsdl/schematron	file.exe	false	Avira URL Cloud: safe	unknown
http://www.freetype.org)	file.exe	false	Avira URL Cloud: safe	unknown
http://www.ascc.net/xml/schematron	file.exe	false	Avira URL Cloud: safe	unknown
http://www.mico.org/	file.exe	false	Avira URL Cloud: safe	unknown
http://www.pythonware.com	file.exe	false		high
https://datatracker.ietf.org/ipr/1526/	file.exe	false		high
https://www.openssl.org/source/license.html	file.exe	false		high
http://www.fsf.org	file.exe	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/dsdl/schematronhttp://www.ascc.net/xml/schematronFailed	file.exe	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_b07fa4138d6cee96061521c23bb7cd6608bee0c31ef2bfdc	MSBuild.exe, 00000002.00000002.1689809314.0000000002A21000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1689809314.0000000002B23000.00000004.00000800.00020000.00000000.sdmp, prefs.js.2.dr	false		high
http://www.zope.com/Marks).	file.exe	false	Avira URL Cloud: safe	unknown
http://www.vmware.com/download/open_source.html	file.exe	false		high
https://datatracker.ietf.org/ipr/1914/	file.exe	false		high
http://openwall.info/wiki/people/solar/software/public-domain-source-code/md5	file.exe	false	Avira URL Cloud: safe	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&ci=1696513144932.12791&key=1696513144400700	MSBuild.exe, 00000002.00000002.1689809314.0000000002A21000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1689809314.0000000002B23000.00000004.00000800.00020000.00000000.sdmp, prefs.js.2.dr	false	Avira URL Cloud: safe	unknown
https://cs.chromium.org/chromium/src/LICENSE	file.exe	false	Avira URL Cloud: safe	unknown
https://github.com/kiyolee/pcre-win-build/	file.exe	false		high
http://www.gnu.org/licenses/	file.exe	false		high
http://info.isl.ntt.co.jp/crypt/eng/info/chiteki.html	file.exe	false	Avira URL Cloud: safe	unknown
http://www.cl.cam.ac.uk/~mgk25/	file.exe	false	Avira URL Cloud: safe	unknown
http://www.xiph.org/	file.exe	false	Avira URL Cloud: safe	unknown
https://www.qt.io/licensing/	file.exe	false		high
http://www.apache.org/licenses/LICENSE-2.0	file.exe	false		high
http://www.cnri.reston.va.us)	file.exe	false	Avira URL Cloud: safe	unknown
http://mail.gnome.org/archives/gtk-devel-list/2001-October/msg00087.html	file.exe	false	Avira URL Cloud: safe	unknown
https://www.gnu.org/licenses/	file.exe	false		high
http://creativecommons.org/licenses/publicdomain.	file.exe	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&ci=1696513144932.12791&key=1696513144400700003.1&cta	MSBuild.exe, 00000002.00000002.1689809314.0000000002A21000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1689809314.0000000002B23000.00000004.00000800.00020000.00000000.sdmp, prefs.js.2.dr	false		high
http://www.vmware.com/0/	file.exe	false		high
http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtd	file.exe	false	Avira URL Cloud: safe	unknown
http://pcre.org/	file.exe	false	Avira URL Cloud: safe	unknown
https://www.python.org/psf/)	file.exe	false		high
http://www.opensource.org	file.exe	false	Avira URL Cloud: safe	unknown
http://www.bis.doc.gov/.	file.exe	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4ClZfC2k4pbW4ZbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi	prefs.js.2.dr	false		high
http://www.pythonlabs.com/logos.html	file.exe	false	Avira URL Cloud: safe	unknown
http://web.cs.ucdavis.edu/~rogaway/ocb/license1.pdf	file.exe	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	MSBuild.exe, 00000002.00000002.1689809314.0000000002A21000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1689809314.0000000002B23000.00000004.00000800.00020000.00000000.sdmp, prefs.js.2.dr	false		high
http://www.cwi.nl)	file.exe	false	Avira URL Cloud: safe	unknown
http://tools.ietf.org/html/rfc1950	file.exe	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	MSBuild.exe, 00000002.00000002.1689809314.0000000002A21000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1689809314.0000000002B23000.00000004.00000800.00020000.00000000.sdmp, prefs.js.2.dr	false		high
http://hdl.handle.net/1895.22/1013	file.exe	false		high
http://www.apache.org/licenses/LICENSE	file.exe	false		high
https://datatracker.ietf.org/ipr/1524/	file.exe	false		high
http://opensource.org/licenses/ms-rl	file.exe	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	MSBuild.exe, 00000002.00000002.1689809314.0000000002A21000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1689809314.0000000002B23000.00000004.00000800.00020000.00000000.sdmp, prefs.js.2.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&ci=16965131449	MSBuild.exe, 00000002.00000002.1689809314.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm	file.exe	false		high
https://gitlab.gnome.org/GNOME/libxml2D	file.exe	false		high
http://relaxng.org/ns/structure/1.0	file.exe	false		high
http://www.openssl.org/)	file.exe	false		high
http://www.openismus.com/	file.exe	false	Avira URL Cloud: safe	unknown
http://jquery.com/	file.exe	false		high
https://www.ribose.com).	file.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1649093
Start date and time:	2025-03-26 14:05:54 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal80.phis.spyw.evad.winEXE@8/7@2/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 66 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212, 199.232.210.172, 20.3.187.198, 52.165.164.15
Excluded domains from analysis (whitelisted): fe3.delivery.mp.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:07:47	API Interceptor	1x Sleep call for process: MSBuild.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pki-goog.l.google.com	toch.exe	Get hash	malicious	Go Stealer, Skuld Stealer, Xmrig	Browse	142.251.40.227
	CEnZGYPvcA.exe	Get hash	malicious	XWorm	Browse	142.251.40.131
	92.255.85.2.exe	Get hash	malicious	XWorm	Browse	142.250.80.3
	92.255.85.2.bat	Get hash	malicious	XWorm	Browse	142.250.80.35
	file.exe	Get hash	malicious	CryptOne, LummaC Stealer, Socks5Systemz	Browse	142.251.35.163
	file.exe	Get hash	malicious	LummaC Stealer	Browse	142.250.80.67
	EFT Remittance_(Bobd)CQDM.htm	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	142.250.80.67
	https://protect.checkpoint.com/v2/r01/___https://lsems.gravityzone.bitdefender.com/xhfsdfMW5hMR~QDcqg1KugH/rhrqqgrWni2pyg1KugH/og75AgMRA37Cu37x!i2GzU2ZBRIJz0ZOA1YpCSoGOfZu2gE3yRpN701JyRpOm4ZZyRp4q0YpC41S1h5KD47KphMiO0J/ARo394ZuDi6WW41uA0ZCGZsV/hKq4hn5DVqi1SpSG0Iiq0YiNiZC33pyAQYOLfD5DVoOH4EWH45yy38iYhrWx0YiVg5yOT0VyRpOmZ1K2gpqsW5R/g5c81YGRQYOLV8umhLS2X6OG02WJ48S4XrSZhspDQYOHj0O/ZZO4YYpEY0i64ZCT0KSvgIWoXKR8hZi9SJ6HZ1WSYoWD07KS1LZBgs09XESu4KOBh0WJ1r02gq3CTL/54pS~WrB7gMqXfMGfR6WVW7iZWpyq45mYQYOHgoWvY6KEf1qKh5OXS2us02tyRp4vTYGnVYGm0Y4HX7SK0ZRyRpOuiEm/SKGC0si/irc90Z63XL9yRp36Z5KZYLlyRpOSWqSIQYOHXLW8X64mhKKzhEGBf0tBX24yV1utSEWG0ISpR7WMR0JDZ80OXrmQYsZyRp4G1suTX1tCYruxfYGJXr6O40SD056PXZOrREqxjZyAjpW7X1yrgYGuiJOUXJcUi50ORqOKTJ4LgJmWWrmJYJKJ0sSZVZuy08uNXK4G1LW5WEGWRYOST1SrY7KI400ERquY06iU32JCgLcxTZSX3EmVV0uCR8iWW2O9QYOHi8mrYLcRg5mPg5i9S0p5iqOo12G6i0ZyRp44TMh7RIqnV2iJX7/G4pK6j1BBWLC5R5qSg00pZJO2YqmTXZC2Zr/0310008uSX005S6Kt100zTKKDS2W2f0RBX7K/jolDfqqQWqSN31mHZr/4Ro4NXqm54p/VgLi01MKBTY3yRp35gLiTY76rW8OMZ5Z8j1uJWp6wR7uNi6GnjrOE4LuRRoRESZ4XjX5DVsqPW7/sfJi5V7c23pu3S1BCYZ/WYr0EV7J6h0mE1J4vV0WsQYSJQYSJWo0kXKb5hLqtXMqsYqSHRMN/Zr42RLV5SJcPfKS6WrmuZrCXiK4Rh2m~08WYXMSmg1q6Z1l5Z00~Y1WChJ0t0Ii6hES8XImMiM0QYryZ4EWO1KqsSZ0K00WfX5WS11C636i63Ep80qSYjo4mWE4111p6Y5tyRp4Y45c43py9fEqOV5351KGy1Km/R0S40H5DWqZC0JyGW1iAYIqCgMG7gZS~003CX1yMV0GDfsZyRp38f54wZJuS00O7R5cE1ol6jJ6XhMpD1p0vj0uXi0uZf6JyRp4GRZ6IgpC/0puyW0itV0JyR5VyR5V=dJ9a86J/5GGJ6/HFH867JHa95G57Ja897H65~G65b9/b7c9/a8J6JI56758~GFFJI?h=6&fru;n=6&fru;ithx=6___.YzJ1OnNlcXVhbGNvcnA6YzpvOjVjN2U0MGNlMGRhNDNkZDEwYjk3ODU0ZTRhMGNmYTFjOjc6MDQyMTpiZDMwNmQ3NDgyNWUwNmM1NzVmMTk0YTFiN2ZjZDQ3NWZjMzIzMTMzNjg2ZmY0ZTMyY2VmMDdmYWRhZDI0MTJjOmg6VDpU	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	172.217.16.195
	qoutation.js	Get hash	malicious	XWorm	Browse	142.250.64.99
bg.microsoft.map.fastly.net	1.ps1	Get hash	malicious	AsyncRAT, Xmrig	Browse	199.232.210.172
	gkd.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	199.232.214.172
	MDRHZBOL2477518 CO.xls	Get hash	malicious	Unknown	Browse	199.232.214.172
	k6sMqU4WU6.bat	Get hash	malicious	AsyncRAT, DcRat	Browse	199.232.210.172
	toch.exe	Get hash	malicious	Go Stealer, Skuld Stealer, Xmrig	Browse	199.232.210.172
	3Judiciario02-jRc3-8Gwc1-T12.msi	Get hash	malicious	Unknown	Browse	199.232.210.172
	MauThietKeNTCTY2025.bat	Get hash	malicious	AsyncRAT, DcRat	Browse	199.232.214.172
	Documents.js	Get hash	malicious	ScreenConnect Tool	Browse	199.232.210.172
	CEnZGYPvcA.exe	Get hash	malicious	XWorm	Browse	199.232.214.172
	ORDER 517-2025.xla.xlsx	Get hash	malicious	Unknown	Browse	199.232.210.172

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Fri Mar 7 13:07:34 2025, atime=Tue Feb 25 23:36:44 2025, length=3388000, window=hide
Category:	dropped
Size (bytes):	2420
Entropy (8bit):	3.574688950231698
Encrypted:	false
SSDEEP:	48:8S7dUOT4mjYrnvPdAKRkdAhuLoxdAKRFdAKRW:8S38nuL
MD5:	97AC2059E913B8BA24B0D437C5DF97E6
SHA1:	05D4AF9AE5036D64C440CF6B6A745E2BC6315C31
SHA-256:	2CBFD4B7F0ADD750DEA8F55CC3AA3E7A061C678D964F5DE7F82300F695A8E41B
SHA-512:	0F7FCAC82F414C79AA09B1FE5D588F367DF5B6A23E94009361E25B1ABC9BF76EFB539DC2D1AC09D4A3EDF9C6E29806CDB75E667C312D5EC9697E09CEF5A165DB
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ......,....$.aFj...f~.....`.3.....................#....P.O. .:i.....+00.../C:\.....................1.....EW.q..PROGRA~1..t......O.IgZ.p....B...............J.....o4_.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VgZGp....L.....................p+j.G.o.o.g.l.e.....T.1.....gZGp..Chrome..>......CW.VgZGp....M.....................:...C.h.r.o.m.e.....`.1.....gZGp..APPLIC~1..H......CW.VgZHp..........................:...A.p.p.l.i.c.a.t.i.o.n.....`.2.`.3.ZZ.. .chrome.exe..F......CW.VgZ.p..............................c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n...-.-.p.r.o.x.y.-.s.e.r.v.e.r

C:\Users\user\AppData\Local\Temp\TmpB1F8.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	2540
Entropy (8bit):	7.801552142126602
Encrypted:	false
SSDEEP:	48:CDAZse4GVajjgsrMM7wEIyxduDwLHXsZ5z/C2iJQ7sKXhVFm1:C+sfGEjgsgM7lIKuK3qB6HJQ7BFm
MD5:	CBC6B2AD4BF883EA7ECB41D8D86B0964
SHA1:	3051043976773ABFC145A23942B42E4C7CAC5A1C
SHA-256:	C8844BA7CA7DF3C75532044792065C3D2B742C389FC9FA1A6E2776ED425917AF
SHA-512:	355B1E180D067ABAAB69F1F51CF0776DEE7156156195094825A1BA7FAC3BCF7AB303B5D68BE373878F400CD34EC9061DC549706B8AD344E66AC8968DAA7E812F
Malicious:	false
Reputation:	low
Preview:	0......0......H..............0...0......H..............0...0......H............0...0....H.......0........J..........+"J.).V9...,...:'.......>.i..$V.Y.R..w......?)fA....l..B.I....W....d}.uw..),}.-..S......Z.fM.%<.R..Ln.<.U.]]....m.QS..R4..T.....)s>.(@.<C...>.../.F............\|.i.:.._..1...@ns.<...!....O.'g.<X.........ctf.=.........4.......?e......G}..N~.>P.....A^.e...8.]..Z...l-se....g ..M;....@w....G...E...)...\.}W.lP...z..X.J..%!I..F&l....Kc.Ve$;........!.]..\...r..)..B.....< .>>.5O{%..$.....?..\.7.&.......r....5 :.k......s-S.{z.pZ...QY0.tV0....H.....0.8..Jf..V..W?.....v.).k$ag.J3f"..t...3)....v............v.j}.)4j.^r..r.....n._"o.j..t0.W......O.zH...6.$..).gd...Z.b..40..M.f...A....C....v.w..}.....r.3.e..5..9..\|.9N..{rCN{..6.k..W.........h.w.uEQR.AQI@-l..+....J_....s{.....}2p.......O.E.....}.76".x6.,.M./.8.u.....WM......?..%.....\@mU.Kr....]......{..#...A.).........E.`..q..E............o..5...f...wR...H.9.z..\|q....0.uI....

C:\Users\user\AppData\Local\Temp\TmpB237.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	2540
Entropy (8bit):	7.801552142126602
Encrypted:	false
SSDEEP:	48:CDAZse4GVajjgsrMM7wEIyxduDwLHXsZ5z/C2iJQ7sKXhVFm1:C+sfGEjgsgM7lIKuK3qB6HJQ7BFm
MD5:	CBC6B2AD4BF883EA7ECB41D8D86B0964
SHA1:	3051043976773ABFC145A23942B42E4C7CAC5A1C
SHA-256:	C8844BA7CA7DF3C75532044792065C3D2B742C389FC9FA1A6E2776ED425917AF
SHA-512:	355B1E180D067ABAAB69F1F51CF0776DEE7156156195094825A1BA7FAC3BCF7AB303B5D68BE373878F400CD34EC9061DC549706B8AD344E66AC8968DAA7E812F
Malicious:	false
Reputation:	low
Preview:	0......0......H..............0...0......H..............0...0......H............0...0....H.......0........J..........+"J.).V9...,...:'.......>.i..$V.Y.R..w......?)fA....l..B.I....W....d}.uw..),}.-..S......Z.fM.%<.R..Ln.<.U.]]....m.QS..R4..T.....)s>.(@.<C...>.../.F............\|.i.:.._..1...@ns.<...!....O.'g.<X.........ctf.=.........4.......?e......G}..N~.>P.....A^.e...8.]..Z...l-se....g ..M;....@w....G...E...)...\.}W.lP...z..X.J..%!I..F&l....Kc.Ve$;........!.]..\...r..)..B.....< .>>.5O{%..$.....?..\.7.&.......r....5 :.k......s-S.{z.pZ...QY0.tV0....H.....0.8..Jf..V..W?.....v.).k$ag.J3f"..t...3)....v............v.j}.)4j.^r..r.....n._"o.j..t0.W......O.zH...6.$..).gd...Z.b..40..M.f...A....C....v.w..}.....r.3.e..5..9..\|.9N..{rCN{..6.k..W.........h.w.uEQR.AQI@-l..+....J_....s{.....}2p.......O.E.....}.76".x6.,.M./.8.u.....WM......?..%.....\@mU.Kr....]......{..#...A.).........E.`..q..E............o..5...f...wR...H.9.z..\|q....0.uI....

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Thu Oct 5 13:05:22 2023, atime=Wed Sep 27 08:36:54 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2702
Entropy (8bit):	3.66478752643622
Encrypted:	false
SSDEEP:	48:8SdadjTTcvLC0lRYrnvsYd/KRkdAhuLoxdAKR+/KR0HynP:8S4AC7OuLjHy
MD5:	C7656AAE8AA05BCAE56D1A31B18FC90B
SHA1:	C1F45EE2971D87D692F60CF3E46B32626F4F4781
SHA-256:	5015B97F23869D2F74798FFAEE4C1F97D5C6B4C519551909AC2311512394F1BB
SHA-512:	C95905E99E74F207A91919E08B81FBA2C7D475F2D95FD0292FDD7237644C81BAC5C6BE95053B6F7972D7FB827B1290D140FA4AC042CBE78957F0148D1728528D
Malicious:	false
Preview:	L..................F.@.. ......,.....Jo......X.&&... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....EW.e..PROGRA~1..t......O.IEW.p....B...............J.....t%..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VEW.p....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.f..Chrome..>......CW.VEW.p....M.....................c...C.h.r.o.m.e.....`.1.....EW.f..APPLIC~1..H......CW.VEW.p...........................P..A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.L .chrome.exe..F......CW.VEW.p....I.....................l...c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.M.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Thu Aug 5 21:41:46 2021, mtime=Thu Oct 5 13:07:16 2023, atime=Fri Sep 29 11:17:35 2023, length=4210216, window=hide
Category:	dropped
Size (bytes):	2796
Entropy (8bit):	3.742823418389991
Encrypted:	false
SSDEEP:	48:8QAQI2dOe7xsJmrnzTdRd/uLoqdLXuHjPkZy+7:80NuLduDPkZy
MD5:	F548FD251822E4181E3CF0A56CB88F1F
SHA1:	07A8DCD3D53C8089FC3720122138789FD2359F6E
SHA-256:	0772A2FF2C5E52C65D69796221673C3A6A8757210C26ADA7F4AF132472FAA095
SHA-512:	4F4E6C48F02ED52AB41B80D3B8AC486A8CC8DAFFF559EE4CE17C5109F114B78DD6214D906B8613AF16AEDC271C61526C5689C7A5B74F609786C8A075A48667C5
Malicious:	false
Preview:	L..................F.@.. .....\|.K...9..>.....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DW-F..PROGRA~2.........O.IEW.p....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....CW.`..MICROS~1..D......(Ux.EW.p..........................6\|..M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.EW.p...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8.EW.p..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8.EW.p....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j............F.......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe....B.r.o.w.s.e. .t.h.e. .w.e.b.N.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.1.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Thu Oct 5 11:48:37 2023, atime=Wed Sep 27 08:36:54 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2638
Entropy (8bit):	3.6519203502004247
Encrypted:	false
SSDEEP:	48:8SfPdtT1xBC0lRYrnv3d/KRkdAhuLoxdAKR+/KR2eqP:8SzJbC7QuLne
MD5:	DBBC794EBA0F007A9D19188F8A6F4C70
SHA1:	FD96E0482B72E26F7A2CBD9FF07B52B17E242DDF
SHA-256:	090AAB0EBD8B000D07E745F2A5A111742EFF943FF3185186070FA4C7C6BFA931
SHA-512:	84D8A54F57693A289AA044A7DFE4C71F201FDD3B958E949CD93F0623F8356945828A8710F023D43EEA783B871B345FC1CCD0167EAE101B2FFFC7E7DCBF543B9D
Malicious:	false
Preview:	L..................F.@.. ......,.......B.....X.&&... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....EW.e..PROGRA~1..t......O.IEW.e....B...............J.....t%..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VEW.e....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.e..Chrome..>......CW.VEW.f....M......................Uk.C.h.r.o.m.e.....`.1.....EW.f..APPLIC~1..H......CW.VEW.f...........................t..A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.L .chrome.exe..F......CW.VEW.f....I.....................l...c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\xte0v1np.default-release\prefs.js

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9729
Entropy (8bit):	5.522631979298995
Encrypted:	false
SSDEEP:	192:InnTRVgYbBp6Q+GaXES6BszhkUNBw8DKSc:mAej+0BU+qw/r
MD5:	C1599C407D3F4B91F2EDA0E2DBB6ECA6
SHA1:	BA07576399FBF376D1175969CF408E23979709D1
SHA-256:	3D57C659B7360AD7F00C7937C59135DC56EE62F7528AB5E5034BBAF26C449539
SHA-512:	6E9DE7247279A33B7C801EFC323488A61D59E8584906E7FF7C37B3A69586AE79AF1803C812A3813B8FB785BCEE56F9D0745D47A9FE22C4B356800C038FE7B999
Malicious:	true
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "42c220e3-810c-4591-b772-124a85cf4bad");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696514917);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696514919);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.92964474931813
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.69% Win32 Executable (generic) a (10002005/4) 49.65% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% InstallShield setup (43055/19) 0.21% Windows Screen Saver (13104/52) 0.07%
File name:	file.exe
File size:	5'363'712 bytes
MD5:	ca4a37c4e37044a6f27a300047cc41f5
SHA1:	eac1104e810b8a05e9cb8900a0e4daf73ab8998c
SHA256:	a55181a9277efe47ba8744273e847a42e5de4700c7f89e2e2cc12bd45f26661a
SHA512:	f7786ba0fb6446bcff41dd8166332a2569ed6491d63fe50122b21adab03c95bd60225a60a451e026773e5d17733c2f4fcbccb213dda1c4f42ad8b2144c786001
SSDEEP:	98304:kLLyjD2ICcZ/vHRdBAUZL10rBb4oaQgOlmI0:kLLyjD2xeRdV+rTA6mp
TLSH:	1946BF15BB42C232E9E102B163BADBF7E42D9E34331751CB71D4B0D8567A1E222BF649
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....i.g..............0...Q...........Q.. ........@.. .......................@R...........@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x91eade
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67D9699B [Tue Mar 18 12:39:55 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x51ea84	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x520000	0x800	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x522000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x51cae4	0x51cc00	c1f23a769932963ce359ba37b78a7d82	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x520000	0x800	0x800	6236d1607280fa0fa8dc4f094cfee469	False	0.38623046875	data	3.7304050719376187	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x522000	0xc	0x200	dad26ad2881fe5446454a8268317633e	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x520090	0x43a	data			0.4436229205175601
RT_MANIFEST	0x5204dc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
Comments	Designed to enhance productivity and security.
CompanyName	Quantum Innovations
FileDescription	NextCloud Suite
FileVersion	6.9.40.284
InternalName	Glossina.exe
LegalCopyright	2024 Skyline Software. Do not distribute without permission.
LegalTrademarks	HyperDrive
OriginalFilename	Glossina.exe
ProductName	NextCloud Suite
ProductVersion	6.9.40.284
Assembly Version	6.9.40.284

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 43
• 443 (HTTPS)
• 80 (HTTP)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 26, 2025 14:07:00.354691982 CET	49677	443	192.168.2.3	2.23.227.215
Mar 26, 2025 14:07:00.354711056 CET	49676	443	192.168.2.3	2.23.227.215
Mar 26, 2025 14:07:00.354897976 CET	49675	443	192.168.2.3	184.86.251.5
Mar 26, 2025 14:07:00.870569944 CET	49673	443	192.168.2.3	204.79.197.203
Mar 26, 2025 14:07:01.182820082 CET	49673	443	192.168.2.3	204.79.197.203
Mar 26, 2025 14:07:01.792191029 CET	49673	443	192.168.2.3	204.79.197.203
Mar 26, 2025 14:07:02.682811022 CET	49674	443	192.168.2.3	2.23.227.215
Mar 26, 2025 14:07:02.995245934 CET	49673	443	192.168.2.3	204.79.197.203
Mar 26, 2025 14:07:05.401562929 CET	49673	443	192.168.2.3	204.79.197.203
Mar 26, 2025 14:07:08.949242115 CET	49678	443	192.168.2.3	20.42.72.131
Mar 26, 2025 14:07:09.261081934 CET	49678	443	192.168.2.3	20.42.72.131
Mar 26, 2025 14:07:09.870347977 CET	49678	443	192.168.2.3	20.42.72.131
Mar 26, 2025 14:07:09.964081049 CET	49676	443	192.168.2.3	2.23.227.215
Mar 26, 2025 14:07:09.964083910 CET	49677	443	192.168.2.3	2.23.227.215
Mar 26, 2025 14:07:09.964119911 CET	49675	443	192.168.2.3	184.86.251.5
Mar 26, 2025 14:07:10.214092016 CET	49673	443	192.168.2.3	204.79.197.203
Mar 26, 2025 14:07:11.073551893 CET	49678	443	192.168.2.3	20.42.72.131
Mar 26, 2025 14:07:12.292190075 CET	49674	443	192.168.2.3	2.23.227.215
Mar 26, 2025 14:07:13.104923964 CET	49680	80	192.168.2.3	184.30.131.245
Mar 26, 2025 14:07:13.105037928 CET	49681	80	192.168.2.3	204.79.197.203
Mar 26, 2025 14:07:13.417160988 CET	49680	80	192.168.2.3	184.30.131.245
Mar 26, 2025 14:07:13.417243958 CET	49681	80	192.168.2.3	204.79.197.203
Mar 26, 2025 14:07:13.479665041 CET	49678	443	192.168.2.3	20.42.72.131
Mar 26, 2025 14:07:14.026514053 CET	49680	80	192.168.2.3	184.30.131.245
Mar 26, 2025 14:07:14.026525974 CET	49681	80	192.168.2.3	204.79.197.203
Mar 26, 2025 14:07:15.229657888 CET	49680	80	192.168.2.3	184.30.131.245
Mar 26, 2025 14:07:15.229762077 CET	49681	80	192.168.2.3	204.79.197.203
Mar 26, 2025 14:07:17.635895967 CET	49680	80	192.168.2.3	184.30.131.245
Mar 26, 2025 14:07:17.635920048 CET	49681	80	192.168.2.3	204.79.197.203
Mar 26, 2025 14:07:18.292200089 CET	49678	443	192.168.2.3	20.42.72.131
Mar 26, 2025 14:07:19.823524952 CET	49673	443	192.168.2.3	204.79.197.203
Mar 26, 2025 14:07:20.402411938 CET	49686	80	192.168.2.3	142.250.65.195
Mar 26, 2025 14:07:20.496453047 CET	80	49686	142.250.65.195	192.168.2.3
Mar 26, 2025 14:07:20.496635914 CET	49686	80	192.168.2.3	142.250.65.195
Mar 26, 2025 14:07:20.496889114 CET	49686	80	192.168.2.3	142.250.65.195
Mar 26, 2025 14:07:20.590136051 CET	80	49686	142.250.65.195	192.168.2.3
Mar 26, 2025 14:07:20.590645075 CET	80	49686	142.250.65.195	192.168.2.3
Mar 26, 2025 14:07:20.597363949 CET	49686	80	192.168.2.3	142.250.65.195
Mar 26, 2025 14:07:20.690591097 CET	80	49686	142.250.65.195	192.168.2.3
Mar 26, 2025 14:07:20.745368004 CET	49686	80	192.168.2.3	142.250.65.195
Mar 26, 2025 14:07:22.448411942 CET	49680	80	192.168.2.3	184.30.131.245
Mar 26, 2025 14:07:22.448573112 CET	49681	80	192.168.2.3	204.79.197.203
Mar 26, 2025 14:07:27.901618004 CET	49678	443	192.168.2.3	20.42.72.131
Mar 26, 2025 14:07:32.057866096 CET	49680	80	192.168.2.3	184.30.131.245
Mar 26, 2025 14:07:32.057878017 CET	49681	80	192.168.2.3	204.79.197.203

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 26, 2025 14:07:20.297635078 CET	54786	53	192.168.2.3	1.1.1.1
Mar 26, 2025 14:07:20.398585081 CET	53	54786	1.1.1.1	192.168.2.3
Mar 26, 2025 14:07:32.762568951 CET	55655	53	192.168.2.3	1.1.1.1
Mar 26, 2025 14:07:32.866611958 CET	53	55655	1.1.1.1	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 26, 2025 14:07:20.297635078 CET	192.168.2.3	1.1.1.1	0x549e	Standard query (0)	c.pki.goog	A (IP address)	IN (0x0001)	false
Mar 26, 2025 14:07:32.762568951 CET	192.168.2.3	1.1.1.1	0x3621	Standard query (0)	c.pki.goog	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 26, 2025 14:07:19.823843002 CET	1.1.1.1	192.168.2.3	0xd92f	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Mar 26, 2025 14:07:19.823843002 CET	1.1.1.1	192.168.2.3	0xd92f	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Mar 26, 2025 14:07:20.398585081 CET	1.1.1.1	192.168.2.3	0x549e	No error (0)	c.pki.goog	pki-goog.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 26, 2025 14:07:20.398585081 CET	1.1.1.1	192.168.2.3	0x549e	No error (0)	pki-goog.l.google.com		142.250.65.195	A (IP address)	IN (0x0001)	false
Mar 26, 2025 14:07:32.866611958 CET	1.1.1.1	192.168.2.3	0x3621	No error (0)	c.pki.goog	pki-goog.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 26, 2025 14:07:32.866611958 CET	1.1.1.1	192.168.2.3	0x3621	No error (0)	pki-goog.l.google.com		142.250.80.67	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

c.pki.goog

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.3	49686	142.250.65.195	80

Timestamp	Bytes transferred	Direction	Data
Mar 26, 2025 14:07:20.496889114 CET	202	OUT	GET /r/gsr1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Mar 26, 2025 14:07:20.590645075 CET	223	IN	HTTP/1.1 304 Not Modified Date: Wed, 26 Mar 2025 12:19:48 GMT Expires: Wed, 26 Mar 2025 13:09:48 GMT Age: 2852 Last-Modified: Tue, 07 Jan 2025 07:28:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding
Mar 26, 2025 14:07:20.597363949 CET	200	OUT	GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Mar 26, 2025 14:07:20.690591097 CET	222	IN	HTTP/1.1 304 Not Modified Date: Wed, 26 Mar 2025 13:00:24 GMT Expires: Wed, 26 Mar 2025 13:50:24 GMT Age: 416 Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding

Statistics

CPU Usage

• file.exe
• MSBuild.exe
• cmd.exe
• conhost.exe
• timeout.exe

Click to jump to process

Memory Usage

• file.exe
• MSBuild.exe
• cmd.exe
• conhost.exe
• timeout.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry

Click to dive into process behavior distribution

Click to jump to process

Target ID:	1
Start time:	09:07:41
Start date:	26/03/2025
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x2f0000
File size:	5'363'712 bytes
MD5 hash:	CA4A37C4E37044A6F27A300047CC41F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:07:42
Start date:	26/03/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Imagebase:	0x6e0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:07:47
Start date:	26/03/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /C timeout 1 && del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xa70000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:07:47
Start date:	26/03/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff78a5a0000
File size:	873'472 bytes
MD5 hash:	7366FBEFE66BA0F1F5304F7D6FEF09FE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:07:47
Start date:	26/03/2025
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout 1
Imagebase:	0x860000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	46.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	56.8%
Total number of Nodes:	155
Total number of Limit Nodes:	13

Executed Functions

Function 00FB302D Relevance: 2.5, Strings: 1, Instructions: 1287
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(, xrefs: 00FB40F3

Memory Dump Source

Source File: 00000001.00000002.1631056349.0000000000FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fb0000_file.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 437ef7678782c3891cf90ec625c2534f62ec30dd0e9c20f46fb93bd8f6d8d3dc
Instruction ID: 3cd5d3586471546038b2cd6d183e68056b8f0ca720f721916c38817d8a82bd8d
Opcode Fuzzy Hash: 437ef7678782c3891cf90ec625c2534f62ec30dd0e9c20f46fb93bd8f6d8d3dc
Instruction Fuzzy Hash: 33A2BC74E012298FDB64DF65CD88BE9BBB2BF89300F1481EA940DA7251DB349E85DF50

Function 00FB5430 Relevance: 1.6, APIs: 1, Instructions: 125
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 00FB550B

Memory Dump Source

Source File: 00000001.00000002.1631056349.0000000000FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fb0000_file.jbxd

Similarity

API ID: MemoryReadVirtual
String ID:
API String ID: 2834387570-0
Opcode ID: 67e8cf2dfcf566383e0286469cf8043701cfb1d09d2db41607fc861645a99f7f
Instruction ID: 8c0febd89138ea6a9e51d11db73e79612346a2dfc9fbc34fe48f06ed556a3cc3
Opcode Fuzzy Hash: 67e8cf2dfcf566383e0286469cf8043701cfb1d09d2db41607fc861645a99f7f
Instruction Fuzzy Hash: 20419AB5D012489FCF10CFA9D984ADEFBF1AB49314F24902AE819B7210D379A945CF64

Function 00FB5803 Relevance: 1.6, APIs: 1, Instructions: 125
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 00FB58DB

Memory Dump Source

Source File: 00000001.00000002.1631056349.0000000000FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fb0000_file.jbxd

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: ee4cfa81613044d683587d29e5dba648c7eaf61b99ebdd5d1535299f2c07d583
Instruction ID: 05670851de656c24745f5e881205de64e2010e962e64212ee32f1d5c3f336604
Opcode Fuzzy Hash: ee4cfa81613044d683587d29e5dba648c7eaf61b99ebdd5d1535299f2c07d583
Instruction Fuzzy Hash: C34198B5D012489FCB10CFAAD984ADEFBF1EB49310F20902AE919B7210D379A905CF64

Function 00FB56C8 Relevance: 1.6, APIs: 1, Instructions: 115
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(?,?,?,?,?,?), ref: 00FB578D

Memory Dump Source

Source File: 00000001.00000002.1631056349.0000000000FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fb0000_file.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: e863bcb3b59fe3c41b745d0b7364cec6ffbf304091e703a297394ec45556ce91
Instruction ID: 17eb2fa13c6caa17a9e3f62dcad1c8d0d39e2ccbf42b976274e73e36a4f9fee0
Opcode Fuzzy Hash: e863bcb3b59fe3c41b745d0b7364cec6ffbf304091e703a297394ec45556ce91
Instruction Fuzzy Hash: 944189B5D012589FCF10CFA9D984ADEFBB1BF09310F20902AE915B7210D775A945CFA4

Function 00FB5438 Relevance: 1.6, APIs: 1, Instructions: 114
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 00FB550B

Memory Dump Source

Source File: 00000001.00000002.1631056349.0000000000FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fb0000_file.jbxd

Similarity

API ID: MemoryReadVirtual
String ID:
API String ID: 2834387570-0
Opcode ID: ee1cf4010e57571fe49013cf03c395902cc9043cace8eaac95505f6df4e18c93
Instruction ID: c77936adb4ea560194021b149c45b6d2cdb5ebac8378034190936ff7b9b4819c
Opcode Fuzzy Hash: ee1cf4010e57571fe49013cf03c395902cc9043cace8eaac95505f6df4e18c93
Instruction Fuzzy Hash: E14188B4D012489FCF10CFAAD984ADEBBF1AB49314F24942AE819B7210D779A945CF64

Function 00FB5808 Relevance: 1.6, APIs: 1, Instructions: 114
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 00FB58DB

Memory Dump Source

Source File: 00000001.00000002.1631056349.0000000000FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fb0000_file.jbxd

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: 91b0d36236386691563670e784355ddcf985ee054a41dd57183bcb0defeb96a2
Instruction ID: ce1c4e21e3f16a7007bceed91a2864d8927c846aeaa6ec6aa11bddc65dd71502
Opcode Fuzzy Hash: 91b0d36236386691563670e784355ddcf985ee054a41dd57183bcb0defeb96a2
Instruction Fuzzy Hash: 2A4188B4D012489FCB10CFAAD984ADEBBF1AB49310F20942AE818B7250D779A945CF64

Function 00FB56D0 Relevance: 1.6, APIs: 1, Instructions: 111
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(?,?,?,?,?,?), ref: 00FB578D

Memory Dump Source

Source File: 00000001.00000002.1631056349.0000000000FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fb0000_file.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 2a6bce29dae94c1d1c081b262f2f142fe78178b60edeb1d40afc03fd838a1b4c
Instruction ID: 63bfb59b34ac635919fc1f0852e25d0cd5b84df79dbcd7d935dd028ce699f3d8
Opcode Fuzzy Hash: 2a6bce29dae94c1d1c081b262f2f142fe78178b60edeb1d40afc03fd838a1b4c
Instruction Fuzzy Hash: B94177B9D002589FCF10CFAAD984ADEFBB1BB09310F20902AE915B7210D775A9458FA4

Function 00FB5310 Relevance: 1.6, APIs: 1, Instructions: 97nativethreadCOMMON

Download Yara Rule

APIs

NtSetContextThread.NTDLL(?,?), ref: 00FB53C7

Memory Dump Source

Source File: 00000001.00000002.1631056349.0000000000FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fb0000_file.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 5fac1e5dfa001c921a873fad41bab82c5c31830ebb7f17946b18313b0af3d576
Instruction ID: 93e11142feada03e9fb893ad2a81834402e529f67f94aeca811d963c2e236e18
Opcode Fuzzy Hash: 5fac1e5dfa001c921a873fad41bab82c5c31830ebb7f17946b18313b0af3d576
Instruction Fuzzy Hash: E241AAB4D012589FCB14CFAAD984ADEBBF1AF49310F24802AE418BB310D779A945CF64

Function 00FB5318 Relevance: 1.6, APIs: 1, Instructions: 92nativethreadCOMMON

Download Yara Rule

APIs

NtSetContextThread.NTDLL(?,?), ref: 00FB53C7

Memory Dump Source

Source File: 00000001.00000002.1631056349.0000000000FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fb0000_file.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: cd68d536f6350cff2f84915f4e98142bac65a5c38ac6a1b279a6e2b818314a23
Instruction ID: ea40ea18b119b6311a31972e9054e44a31194fcbaee638819e1fb8043daf4444
Opcode Fuzzy Hash: cd68d536f6350cff2f84915f4e98142bac65a5c38ac6a1b279a6e2b818314a23
Instruction Fuzzy Hash: DA319AB4D002589FCB14CFAAD984ADEBBF1AF49310F24802AE418B7300D779A945CFA4

Function 00FB5950 Relevance: 1.6, APIs: 1, Instructions: 91nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 00FB59E6

Memory Dump Source

Source File: 00000001.00000002.1631056349.0000000000FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fb0000_file.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 11a8ae18501b376f84c0d858c5594b3b601b382df76b1857a7882785bb5249d1
Instruction ID: 1ec97d90e37729993e401a06f41b3cc746d91be738bac8511d00521b67329afa
Opcode Fuzzy Hash: 11a8ae18501b376f84c0d858c5594b3b601b382df76b1857a7882785bb5249d1
Instruction Fuzzy Hash: 1F319CB5D012589FCB10CFA9D984ADEFBF0BB49320F10946AE515B7200C779A946CF94

Function 00FB5958 Relevance: 1.6, APIs: 1, Instructions: 82nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 00FB59E6

Memory Dump Source

Source File: 00000001.00000002.1631056349.0000000000FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fb0000_file.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 5c92d07d27e2914f226a0e60aeeda04dc7be7a809e6d5c8feae16fc38f8f9791
Instruction ID: 4f541edb71558d9a535ea5c91db41bc0e8961b18f217b6abf672eb4472b44374
Opcode Fuzzy Hash: 5c92d07d27e2914f226a0e60aeeda04dc7be7a809e6d5c8feae16fc38f8f9791
Instruction Fuzzy Hash: EB318BB5D012589FCB10CFAAD984ADEFBF5BB49310F10942AE815B7300D779A945CFA4

Function 00FB3087 Relevance: .6, Instructions: 612COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1631056349.0000000000FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54f2895aea7bfb706b51be727c4c4bd4020cd4e20b7219e5dd055425ad60fd93
Instruction ID: 6c278d7c0a74d1e29858b4574b023c00a50c1811c0f652a36fc564dc8658bd6a
Opcode Fuzzy Hash: 54f2895aea7bfb706b51be727c4c4bd4020cd4e20b7219e5dd055425ad60fd93
Instruction Fuzzy Hash: 21A11371D053698FDB25DF6ACC547DABBB2AF8A300F1481EAD448AB261DB305E85CF50

Function 00FB4717 Relevance: .5, Instructions: 486COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1631056349.0000000000FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d6fe88d5539dd9bb8173b7ef43f66498a10c4a965b15e2ea78f4eb5a9a77fa0
Instruction ID: 66b8c1fb19885552fc9861b15244053e3af0692ee9d2d92cd4f5ca176abb9672
Opcode Fuzzy Hash: 8d6fe88d5539dd9bb8173b7ef43f66498a10c4a965b15e2ea78f4eb5a9a77fa0
Instruction Fuzzy Hash: 8A22D9B1E012288FDB68CFA9CC90BDDBBB1AF88301F5481A9D509AB355DB705E85DF50

Function 00FB1A10 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1631056349.0000000000FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b693392b96375c1abc88ec371c0ca387f4a8a00606c98769d63b68f0fab93df6
Instruction ID: 9d335398a1cf56b8d09975e6d69276f26af6045fd6fa4e0b9d3f5b8b02ed3a3a
Opcode Fuzzy Hash: b693392b96375c1abc88ec371c0ca387f4a8a00606c98769d63b68f0fab93df6
Instruction Fuzzy Hash: 5BC19274D012288FDB68DF66C890BDDBBB2BF89310F1081AAD509A7355DB349E85DF90

Function 00FB1A03 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1631056349.0000000000FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00443bf5e24121da4db0afa7cd693d851493e967efe5b6adb49a9f0533d74007
Instruction ID: 41c55ddd7031d8e256b8456c0395a7dd3a1361aafed1340b22385eaa001a4811
Opcode Fuzzy Hash: 00443bf5e24121da4db0afa7cd693d851493e967efe5b6adb49a9f0533d74007
Instruction Fuzzy Hash: 3951C2B5D012288BDB28CF6AD8447DDBBF2BF89300F10C5AAD449A7354EB705A85CF90

Function 00FB4FE2 Relevance: 1.7, APIs: 1, Instructions: 239
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessInternalW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00FB51EE

Memory Dump Source

Source File: 00000001.00000002.1631056349.0000000000FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fb0000_file.jbxd

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 4a5503f8afead3041e908a85dc3db53a2162186eb25c8b9b3cb677b74f8789a6
Instruction ID: d1ed59a64949d3b0dc741e6460feada09ab6ba6bb268b8e0b6e9701a9c13ccf2
Opcode Fuzzy Hash: 4a5503f8afead3041e908a85dc3db53a2162186eb25c8b9b3cb677b74f8789a6
Instruction Fuzzy Hash: 6F81EE74C042598FCF25CFA9C880BEEBBB1BF09300F1490AAE949B7250D7749A85DF54

Function 00FB5000 Relevance: 1.7, APIs: 1, Instructions: 227
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessInternalW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00FB51EE

Memory Dump Source

Source File: 00000001.00000002.1631056349.0000000000FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fb0000_file.jbxd

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: ddef02986b29f0a8278883d2753d55dfb6e16fa76e1020379684a7a36a1f9e62
Instruction ID: f332adb9212fc3a26bd5ec1b664bba71204730e370fcde0b387810ecd1ff1370
Opcode Fuzzy Hash: ddef02986b29f0a8278883d2753d55dfb6e16fa76e1020379684a7a36a1f9e62
Instruction Fuzzy Hash: A381BD74D0025D9FCB25CFA9C880BEEBBB1BF09300F1494AAE949B7250D7749A85DF54

Function 00FB14C4 Relevance: 1.7, APIs: 1, Instructions: 159
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,?,?,?,?,?,?), ref: 00FB1619

Memory Dump Source

Source File: 00000001.00000002.1631056349.0000000000FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fb0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 090480b501d97c9005c73d90d353291a420f513415fe8311e59286f91fef1d0f
Instruction ID: b4e19c6464ca49af4cd95d07f8206359715018fc7475b24fe382e38bdebf9978
Opcode Fuzzy Hash: 090480b501d97c9005c73d90d353291a420f513415fe8311e59286f91fef1d0f
Instruction Fuzzy Hash: A751ECB4D002189FDF20CFAAD884ADEBBB1FF0A310F24916AE819B7250D7749985DF54

Function 00FB14D0 Relevance: 1.7, APIs: 1, Instructions: 152
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,?,?,?,?,?,?), ref: 00FB1619

Memory Dump Source

Source File: 00000001.00000002.1631056349.0000000000FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fb0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e11a91da0e0f0dd6ec81204ef36f5287e38632e2abddfd11dc84dfc2add061f6
Instruction ID: 5134a48febdd4b0765b0161177726f92111b1fbf5ec20911d5c3e0e737b7723d
Opcode Fuzzy Hash: e11a91da0e0f0dd6ec81204ef36f5287e38632e2abddfd11dc84dfc2add061f6
Instruction Fuzzy Hash: C451C9B4D002189FDF20CFAAD884AEEBBB1FB09314F24912AE819B7350D7749985DF54

Function 00FB16DD Relevance: 1.6, APIs: 1, Instructions: 148
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingA.KERNEL32(?,?,?,?,?,?), ref: 00FB1823

Memory Dump Source

Source File: 00000001.00000002.1631056349.0000000000FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fb0000_file.jbxd

Similarity

API ID: CreateFileMapping
String ID:
API String ID: 524692379-0
Opcode ID: a3a6e2377c6482cb07e5ba0bfe7ab680878c05179367982612488b22b98b665d
Instruction ID: 2686eb26426fd2967aa985fc68c8f6aecdbb1d20e6f0a9a52bca56331d7679ce
Opcode Fuzzy Hash: a3a6e2377c6482cb07e5ba0bfe7ab680878c05179367982612488b22b98b665d
Instruction Fuzzy Hash: 8C51CDB4D00258DFDB20CFAAD884ADEBBF1BB09310F20916AE814B7351DB749985DF54

Function 00FB16E8 Relevance: 1.6, APIs: 1, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingA.KERNEL32(?,?,?,?,?,?), ref: 00FB1823

Memory Dump Source

Source File: 00000001.00000002.1631056349.0000000000FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fb0000_file.jbxd

Similarity

API ID: CreateFileMapping
String ID:
API String ID: 524692379-0
Opcode ID: 2c5180ac6f416f243110aff2214ceecb789caa1d06f08acea219b28db216b965
Instruction ID: 32b49476057f09298e7db1bcc3c17152e835aeffbd0ec07b2ce607b8fab0c7a9
Opcode Fuzzy Hash: 2c5180ac6f416f243110aff2214ceecb789caa1d06f08acea219b28db216b965
Instruction Fuzzy Hash: 2051ACB4D00258DFDB20CFAAD884ADEBBF1BB09310F20912AE818B7350DB749985DF55

Function 00FB18E8 Relevance: 1.6, APIs: 1, Instructions: 103
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MapViewOfFile.KERNELBASE(?,?,?,?,?), ref: 00FB199C

Memory Dump Source

Source File: 00000001.00000002.1631056349.0000000000FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fb0000_file.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 435e1f49c2825b12d7beb019777da757f0d1237984a28cabe493de30ca27db93
Instruction ID: 9ecbd9c409b474d532e1b3e4ce8115aff45d59e609fb948feb2bb5d020fa015f
Opcode Fuzzy Hash: 435e1f49c2825b12d7beb019777da757f0d1237984a28cabe493de30ca27db93
Instruction Fuzzy Hash: 7E4156B9D002589FCB10CFA9D984A9EFBB1BB1A310F20946AE814B7310D375A945CF64

Function 00FB2EB8 Relevance: 1.6, APIs: 1, Instructions: 101
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 00FB2F66

Memory Dump Source

Source File: 00000001.00000002.1631056349.0000000000FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fb0000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: de3255c5e6404fe3b60f60dae488948ab9850300296e42e218f4dd662fc24217
Instruction ID: ae08df13dcc32738edd33a5622cd1074ed4a9cdd7161d01d1313833de887bd0f
Opcode Fuzzy Hash: de3255c5e6404fe3b60f60dae488948ab9850300296e42e218f4dd662fc24217
Instruction Fuzzy Hash: 7C4199B9D042589FCB10CFAAD584ADEFBB0BB09310F10906AE814B7310D375A945CF65

Function 00FB18F0 Relevance: 1.6, APIs: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE(?,?,?,?,?), ref: 00FB199C

Memory Dump Source

Source File: 00000001.00000002.1631056349.0000000000FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fb0000_file.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: d94f45c1013ba8ccd3d4554ef05041b12638f27702518729810b036c3e2a8101
Instruction ID: 5caac9f283f9730a38d121905f6e81f3cf62badaeb1f7deba3889da9d17ebf2a
Opcode Fuzzy Hash: d94f45c1013ba8ccd3d4554ef05041b12638f27702518729810b036c3e2a8101
Instruction Fuzzy Hash: C13155B9D002589FCF10CFA9D984ADEFBB1BB19310F20902AE818B7310D375A945CF64

Function 00FB0678 Relevance: 1.6, APIs: 1, Instructions: 100memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 00FB2F66

Memory Dump Source

Source File: 00000001.00000002.1631056349.0000000000FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fb0000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 42670ed6f54f09ad07f641d73338d0aece90a9e1a4e4b414e3415ba69d893508
Instruction ID: eb9205bcba3e922c7118bd7d9ca64732c05d11e55c30d5591edcf80402b47eee
Opcode Fuzzy Hash: 42670ed6f54f09ad07f641d73338d0aece90a9e1a4e4b414e3415ba69d893508
Instruction Fuzzy Hash: 2C4179B9D042589FCB10CFAAD584AEEFBF5BB19310F10906AE814B7310D375A945CF65

Function 00FB13A8 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

K32GetModuleInformation.KERNEL32(?,?,?,?), ref: 00FB1456

Memory Dump Source

Source File: 00000001.00000002.1631056349.0000000000FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fb0000_file.jbxd

Similarity

API ID: InformationModule
String ID:
API String ID: 3425974696-0
Opcode ID: 160385456e4342da758c890ba7e307c58b3edf065e18761afe891f970f9a0414
Instruction ID: c99e50f220a6b326c8680fd9965714f062140d231383d9cd1fc258f553c822e6
Opcode Fuzzy Hash: 160385456e4342da758c890ba7e307c58b3edf065e18761afe891f970f9a0414
Instruction Fuzzy Hash: E24199B5D002589FCB10CFAAD584ADEFBF1BB59310F24906AE815B7310D375A945CF64

Function 00FB13B0 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

K32GetModuleInformation.KERNEL32(?,?,?,?), ref: 00FB1456

Memory Dump Source

Source File: 00000001.00000002.1631056349.0000000000FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fb0000_file.jbxd

Similarity

API ID: InformationModule
String ID:
API String ID: 3425974696-0
Opcode ID: 482eab6f6a3df8d75c35e32fff157e2f5d58a55f90a786161084eba27dbac894
Instruction ID: 2ff506146b640b7920ff93013baba7a3f7de3691011303359240979ee392dcd2
Opcode Fuzzy Hash: 482eab6f6a3df8d75c35e32fff157e2f5d58a55f90a786161084eba27dbac894
Instruction Fuzzy Hash: B33166B9D042589FCB10CFAAD984ADEFBF5BB19310F20906AE814B7310D375AA45CF65

Analysis Process: MSBuild.exePID: 5396, Parent PID: 1992COMMON

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	17.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Show Legend

Hide Nodes/Edges

Executed Functions

Function 059C0C28 Relevance: .8, Instructions: 784
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1690511315.00000000059C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29f13b1d9514834198137e3e95afdffca7f78513196197d5305430461195cca9
Instruction ID: 5bfb53c27ec6e3a6c6679329019ba6b40fb4c45adf74a30a4221fb15c4fcaf03
Opcode Fuzzy Hash: 29f13b1d9514834198137e3e95afdffca7f78513196197d5305430461195cca9
Instruction Fuzzy Hash: 976253B06002009FDB48DF59C85975ABAE6EFC4308F64C56CD0099F392DBBADD0B9B95

Function 059C0C38 Relevance: .8, Instructions: 780
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1690511315.00000000059C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75992a4c76bea7816a9d6f0dd462e6f742a4c1c36705212765f0fbfe0af6522a
Instruction ID: 7051f5ac9f751b59489580359e282017cdd24818d1b71e2f1ee6d0eefa20ad32
Opcode Fuzzy Hash: 75992a4c76bea7816a9d6f0dd462e6f742a4c1c36705212765f0fbfe0af6522a
Instruction Fuzzy Hash: 096242B06002009FDB48DF59C85975ABAE6EFC4308F64C46CD0099F392DBBADD0B9B95

Function 059C0410 Relevance: .4, Instructions: 412COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1690511315.00000000059C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd0f78b39b7ea140d2dcefd07127e1d4b316c7eb1dfe85e66a103c71d96c9354
Instruction ID: d7167c0be312dc3b1dd7e3734c6fd7a2bdf8b10448e5fe23f569b1788b37e73a
Opcode Fuzzy Hash: dd0f78b39b7ea140d2dcefd07127e1d4b316c7eb1dfe85e66a103c71d96c9354
Instruction Fuzzy Hash: 42F18C31A00249DFDB14DF69D888BAEBBF6FF88300F148569E405AB261DB35DD45CB91

Function 059C5C88 Relevance: .4, Instructions: 408COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1690511315.00000000059C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6116ac9e614385f2367ef94f9e24710d787865862c2e2344bfc82485bf6eb34f
Instruction ID: 4ef813773d8ef3bf140698541c6b159506d1f3d0594eea714c85582aa8a0ad99
Opcode Fuzzy Hash: 6116ac9e614385f2367ef94f9e24710d787865862c2e2344bfc82485bf6eb34f
Instruction Fuzzy Hash: 07E1B470B002058FDB58EB78C8506AEBBB6EFC9310F20856DD406AB395EF74AD46CB51

Function 00F327B8 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTokenInformation.KERNELBASE(?,?,?,?,?), ref: 00F3283F

Memory Dump Source

Source File: 00000002.00000002.1689227681.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f30000_MSBuild.jbxd

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: aa3188868e801a6f22ad0ddcd0c1b5ab4dd0ac852adc6141d2a8cc983d444afb
Instruction ID: 65281e1acbf87221848ddf43c2faacedcc48f72665b7dfccbd25aabdda0fc088
Opcode Fuzzy Hash: aa3188868e801a6f22ad0ddcd0c1b5ab4dd0ac852adc6141d2a8cc983d444afb
Instruction Fuzzy Hash: C321E3B5C012499FCB10CF9AD885ADEBBF5FF48320F10852AE918A7250D3789945CFA1

Function 00F327C0 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTokenInformation.KERNELBASE(?,?,?,?,?), ref: 00F3283F

Memory Dump Source

Source File: 00000002.00000002.1689227681.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f30000_MSBuild.jbxd

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: 73af95b7ba4fa0ba2eee472b77b3d003c70652e73b3e1c10731eca851e168534
Instruction ID: 81a8b8b74d249a4d235154a17636bde7ae6f744c70a72f963c2b164c3a1f4a5b
Opcode Fuzzy Hash: 73af95b7ba4fa0ba2eee472b77b3d003c70652e73b3e1c10731eca851e168534
Instruction Fuzzy Hash: 3721D0B5D002499FCB10CF9AD984ADEBBF5FF48320F10852AE918A7350D778A945CBA5

Function 00F32889 Relevance: 1.3, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE(?), ref: 00F328EF

Memory Dump Source

Source File: 00000002.00000002.1689227681.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f30000_MSBuild.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 592d372c1597356777b47cb3b63a9086cb1dedc69bb9680ad4fe9ff4e27bb3cc
Instruction ID: 4efefc6270d430aff004327f02ce6e574f6a4eef812b92defbcbf5cb6bce3c89
Opcode Fuzzy Hash: 592d372c1597356777b47cb3b63a9086cb1dedc69bb9680ad4fe9ff4e27bb3cc
Instruction Fuzzy Hash: 2B1146B58002498FCB10CFAAD444BEEBFF0AF48320F24845AD458A7241D778A944CFA1

Function 00F32890 Relevance: 1.3, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE(?), ref: 00F328EF

Memory Dump Source

Source File: 00000002.00000002.1689227681.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f30000_MSBuild.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 30b6d3b7098eb6a68f5882a51399f2f278f4a09f73b1239c5b5e7a2884d3c6a8
Instruction ID: cf81c811f7d7a53df79e1c7954a0447624a0dae9b49cfcac0541167df90c5632
Opcode Fuzzy Hash: 30b6d3b7098eb6a68f5882a51399f2f278f4a09f73b1239c5b5e7a2884d3c6a8
Instruction Fuzzy Hash: 9C1122B18002498FCB20DF9AD545BEEBBF4EF88320F20846AD518A7340D778A944CFA5

Function 059C38B4 Relevance: .8, Instructions: 832
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1690511315.00000000059C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0169c82a2b4151b06a725abbed25432b20c9b74fcff3f320b852ebd42bec3116
Instruction ID: 520a63b460b3de9e31d640fd7bee6a543be62e355861e356a1fb23734392cbee
Opcode Fuzzy Hash: 0169c82a2b4151b06a725abbed25432b20c9b74fcff3f320b852ebd42bec3116
Instruction Fuzzy Hash: FA62D374F021059FEB58EB68D8A176EB7B6FBCD310F50846AD409E778ACE345C029B51

Function 059C2558 Relevance: .8, Instructions: 817
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1690511315.00000000059C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a73fc0bf5ade78bc4a5a2754de8decfc9d889ce65925d67ec2b247d714ef912b
Instruction ID: 00579ed74562fb9036a5ff74440a1d59ac6b4dd6d8cc1dba30d4bf7df403d174
Opcode Fuzzy Hash: a73fc0bf5ade78bc4a5a2754de8decfc9d889ce65925d67ec2b247d714ef912b
Instruction Fuzzy Hash: 75424174B01214ABEB54A67DCC2472F79AFEFE9720F108029A805E77D9CD6C9C0297A5

Function 059C5668 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1690511315.00000000059C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab5732a39205b533d9a4b024e1d80c3087999dbac29031987f75021d497516df
Instruction ID: 530587b81769f8075b81330e591610c569a4a0e8a95a8c2d022aa8e22e987101
Opcode Fuzzy Hash: ab5732a39205b533d9a4b024e1d80c3087999dbac29031987f75021d497516df
Instruction Fuzzy Hash: 44814470F012029BDB54EB78D95076EB6E6EB8D310F618479D905E7789EE34EC02CB61

Function 059C5990 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1690511315.00000000059C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecf6be4e2d7873aa3110bbdb61f6c7283fc1f8103c3ff44392bdeb34ee99d4d2
Instruction ID: 770007039a02bfdad5b66ef875764f2ed4a11075bd174d21dca575f795941bda
Opcode Fuzzy Hash: ecf6be4e2d7873aa3110bbdb61f6c7283fc1f8103c3ff44392bdeb34ee99d4d2
Instruction Fuzzy Hash: 1071D174701201AFDB18EB28C891B3FBBA7EFD4300F518469D9059B799DB38BC029795

Function 059C597F Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1690511315.00000000059C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dd4230d7dcf70a6913949170be43b12d9496f61c570c91139bb55262cef7599
Instruction ID: 408e49f30cdb1ee3d56103ae9f627d4994cdd69d84995d83159b08aa4b0da6a7
Opcode Fuzzy Hash: 8dd4230d7dcf70a6913949170be43b12d9496f61c570c91139bb55262cef7599
Instruction Fuzzy Hash: B471BF74701201AFDB18EB68C891B3FBBA7EFD4300F118469D9459B799DB38BC029795

Function 059C2548 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1690511315.00000000059C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fd294c43a420356de9132c200aa18c1a73fe135e0ef7c489b16f61a2d983a57
Instruction ID: 4190ab1c70b94d4d58656da7ef3ea1e844ecd01a41233798fdba11c3deec60cf
Opcode Fuzzy Hash: 6fd294c43a420356de9132c200aa18c1a73fe135e0ef7c489b16f61a2d983a57
Instruction Fuzzy Hash: 01518E74B012049FEB14A7B9D85476F7AEBEFA9710F104029E80AE73C5DE389C028795

Function 059C1998 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1690511315.00000000059C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23863ffdb92f56c23059787d4a867991cf5dd33c4ca22cf23359012f7f7c9cd7
Instruction ID: ee11743aabdd4d949bd7a23c4d5e68c4a185e327930b376144bf9d387fee3e3d
Opcode Fuzzy Hash: 23863ffdb92f56c23059787d4a867991cf5dd33c4ca22cf23359012f7f7c9cd7
Instruction Fuzzy Hash: 095147B0E00318CFCB14CFA9D985BAEBBF9BF88310F14812AE415A7255DB749841CF95

Function 059C198C Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1690511315.00000000059C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0f9c2cae52d4ea73c1bd22285d37537dc585a5e2566e15e17a330369e6f74c1
Instruction ID: 126ba3eec3f545f38a927d735a83d05c1791d4cd9e24fabe6b1cd8aa102f19e7
Opcode Fuzzy Hash: e0f9c2cae52d4ea73c1bd22285d37537dc585a5e2566e15e17a330369e6f74c1
Instruction Fuzzy Hash: 5C5146B0E002189FDB14CFA9D985B9EBBF9BF88300F14812AE405A7295EB749841CF95

Function 059C3498 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1690511315.00000000059C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba2257134ff1d25c5b1e39725effba7148d459dadd276ab602921ac7fd6be5e4
Instruction ID: 6a220b5ffbf81b6281b986a976ad641e0fcab987767655d8bdd3093a7391dea3
Opcode Fuzzy Hash: ba2257134ff1d25c5b1e39725effba7148d459dadd276ab602921ac7fd6be5e4
Instruction Fuzzy Hash: 305169B1E002599FCB14CFA9D9416AEBFF5BF88700F10C96ED419A7244D7349842CF91

Function 059C348C Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1690511315.00000000059C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76b4c29a9bb087ee699cd281c7ed28d021753b110726bbead567f141fed139b0
Instruction ID: e3de8e6877f4ed5bb959dd1526f5f0f91c27d13aa979bd9e5a996f86d897e2e2
Opcode Fuzzy Hash: 76b4c29a9bb087ee699cd281c7ed28d021753b110726bbead567f141fed139b0
Instruction Fuzzy Hash: C64146B0E002999FDB14CFA9D9817AEBFF5BB48700F10C92AE419E7254D7789846CB91

Function 059C60C8 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1690511315.00000000059C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10b822be6c66b234abcec58e0132ef4deceb927ffa668f64fb160c18a11164ae
Instruction ID: 94a0b30bd8444eef3038f698996f34bb846fe4a90055f58e7282cdf9b19ad57e
Opcode Fuzzy Hash: 10b822be6c66b234abcec58e0132ef4deceb927ffa668f64fb160c18a11164ae
Instruction Fuzzy Hash: 9F31FB31B012468FDB14E778C9516AEBBB6EF85310F20496DD405A72C1FF75AE06C7A2

Function 059C2410 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1690511315.00000000059C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5adfd70149621448a64829bd68f3aab67142cd3db92027a5bd7f27ddaa9a38ea
Instruction ID: 969ccb289437530cb48e572c8562bdc84fefa2f3b4d97f6cbe0ba95738cb9113
Opcode Fuzzy Hash: 5adfd70149621448a64829bd68f3aab67142cd3db92027a5bd7f27ddaa9a38ea
Instruction Fuzzy Hash: 8D41F2B5D012489FCF14CFAAD944ADEBFB6AF88310F10806AE405B7254DB35A945CF91

Function 059C3758 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1690511315.00000000059C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47fc2d30d717ac97dbb5e2bea5e27663822e32563baadfc9143ec66f2bdfa310
Instruction ID: 42fa169e1df60072a1a794a88ea33ccb101468900fa2a99797258dcaff93d3c9
Opcode Fuzzy Hash: 47fc2d30d717ac97dbb5e2bea5e27663822e32563baadfc9143ec66f2bdfa310
Instruction Fuzzy Hash: 91314071D0474A9FCB15CFA4C4546DEFBB2BF89300F10895AE816BB304DB70A98ACB51

Function 059C374C Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1690511315.00000000059C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac06f2487fc66a02f7ffc07d9484e2af3e1a86bc38a186b7d771462203a1d568
Instruction ID: bdc0814cd63263e1a1c042247ce6420e5e0ad9530b5259c00b1f871ed0021ca3
Opcode Fuzzy Hash: ac06f2487fc66a02f7ffc07d9484e2af3e1a86bc38a186b7d771462203a1d568
Instruction Fuzzy Hash: 3F314F71E0474A9BCB19CFA1C4541DEFBB2BF89300F10895AE915BB304DB70A98ACB51

Function 059C2404 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1690511315.00000000059C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d6dd10e3c1aa81811f3af65ea9301826c36b048d28282a12a287a817cacbd6c
Instruction ID: 0196c398828051002ed3ea6fe6abd6ce263d6594ed1a9e4b4d4233e38c73cacf
Opcode Fuzzy Hash: 3d6dd10e3c1aa81811f3af65ea9301826c36b048d28282a12a287a817cacbd6c
Instruction Fuzzy Hash: 423112B0D012489FDB14CFAAD994ADEBFFAAF88300F14806AE445B7254DB349945CF51

Function 059C3648 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1690511315.00000000059C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84a3a2c523f617757bf6aef2bc5c0ea662af785989214e69977a2c09562e8da0
Instruction ID: d1f97337bbfbc6063508b29b2efadb8528dde1055647004070277530e3a7f5c7
Opcode Fuzzy Hash: 84a3a2c523f617757bf6aef2bc5c0ea662af785989214e69977a2c09562e8da0
Instruction Fuzzy Hash: 0F3103B5D012489FCB14CFA9D984ADEBFF5AF48310F24846AE405B7240C779A905CBA1

Function 059C363D Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1690511315.00000000059C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e075d30838879203132242b9873c624523bceffe1f77665b693cbf557a7ba353
Instruction ID: ba71216cb8d1734461f14b33254163d7bcff96566d151e5f94231b7883a5a0a0
Opcode Fuzzy Hash: e075d30838879203132242b9873c624523bceffe1f77665b693cbf557a7ba353
Instruction Fuzzy Hash: 3B21F0B5D012489FDB14CFAAD995BDEBFF9AF48300F24886AE005B7340D7799945CBA0

Function 059C3859 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1690511315.00000000059C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 650279f46ad7e8e04d6cd030fdd73de8d427d900c33e2ead4486c5b7fef9068b
Instruction ID: 26d12ab3ac7e638968e9f5e80e075528edc8a6f04025277870ad33cf3b195ec2
Opcode Fuzzy Hash: 650279f46ad7e8e04d6cd030fdd73de8d427d900c33e2ead4486c5b7fef9068b
Instruction Fuzzy Hash: D7214C71E0470A8FDB14CF90C5546AEBBB2BF88300F20885DD806BB744DB74A989CB91

Function 059C4570 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1690511315.00000000059C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c69141554fbdee1746e6cbc29f54df6b5459ed158fffd1bbe268a352588e0c1
Instruction ID: 91f051d4263a8a222d97df6d3997b7c2fbed51f3ef6aaae7c8456090a399cae2
Opcode Fuzzy Hash: 1c69141554fbdee1746e6cbc29f54df6b5459ed158fffd1bbe268a352588e0c1
Instruction Fuzzy Hash: 1511C635F012149FDF60EF68D95567EBBFAEB89311F100469D80AE3345DA389D018B91

Function 059C0158 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1690511315.00000000059C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cf0887ee9a09cea3d9617e88212d5fe13d30ebc28c7026adf9fb54aa69767e5
Instruction ID: e84e0e63021c677d5a3829634201ef50f7c5b026535764c08a8d319aa3286cf8
Opcode Fuzzy Hash: 2cf0887ee9a09cea3d9617e88212d5fe13d30ebc28c7026adf9fb54aa69767e5
Instruction Fuzzy Hash: 2D0117317002048FC714DF2DD888E1AFBFAFF98220B1585AAE506CB362DB71EC018B90

Function 059C0151 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1690511315.00000000059C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93a95d64ca5cb0cb0dab44972928fc91384d11f07b0eb1565667f8b61d4cc122
Instruction ID: 6ca62329c99c6a28bec49516336cd8226972e57d63eb93650f0767060250721a
Opcode Fuzzy Hash: 93a95d64ca5cb0cb0dab44972928fc91384d11f07b0eb1565667f8b61d4cc122
Instruction Fuzzy Hash: E40117716002059FC714DF29D888E5ABBFAFF99220B1585AAE506CB362D771EC018B90

Function 05B000D8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1690550285.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b00000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b58fe64997e643e7edc7fd7054a12a8af71995b2a7e6abfad6dbb9a20ffbee89
Instruction ID: 1d5e35b2987f352fcf049685b86d94d6caa53c0ae95aea18715b0a94a87ee972
Opcode Fuzzy Hash: b58fe64997e643e7edc7fd7054a12a8af71995b2a7e6abfad6dbb9a20ffbee89
Instruction Fuzzy Hash: 47F0A47630411947CB14A2AEA41457AFB9BDFD5221764C07FDA46C7390DD71D85282A0

Function 05B00048 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1690550285.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b00000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b58fe64997e643e7edc7fd7054a12a8af71995b2a7e6abfad6dbb9a20ffbee89
Instruction ID: 95fdf4ce57054ddf289594d24d6d20cff8d995db33f0ff880b71946f0448917c
Opcode Fuzzy Hash: b58fe64997e643e7edc7fd7054a12a8af71995b2a7e6abfad6dbb9a20ffbee89
Instruction Fuzzy Hash: 03F0C23630411947CB14A2AEA41467BFBDBDFD6321B54C07FD68AC7380ED72E84283A0

Function 05B00000 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1690550285.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b00000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 754785631cf12edad46a9104adc9d16093908552a81ea8058eb9896b13f6c471
Instruction ID: dfc8059bb438df74f365673b3f03c95820b307ae718923409a052ec0e2504ccb
Opcode Fuzzy Hash: 754785631cf12edad46a9104adc9d16093908552a81ea8058eb9896b13f6c471
Instruction Fuzzy Hash: 5E012456A0E3C04FC703537489286957F718EA3110B2F85EBC0D5DB1E7E9284C09CBB2

Function 059C3401 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1690511315.00000000059C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7a1e14777e124992587c0a0f4889b83996a6fcce9c8366fbb26bcdace22ae3c
Instruction ID: 0e8f405d7a83d0a6483cab0076f6b55d5fe493ede65cca63050e40f46a91df38
Opcode Fuzzy Hash: a7a1e14777e124992587c0a0f4889b83996a6fcce9c8366fbb26bcdace22ae3c
Instruction Fuzzy Hash: 5CF06D70F012129BEB14F7B8E824A2EB6B3DBDA321F1088A5D905AB3D5DE389C01C711

Function 059C03FF Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1690511315.00000000059C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 117ab91425b82670360fd4b1129e079d20703b40517df1e0f21f0325b666f530
Instruction ID: 977a9fdce0d9d6700c9ebeb3b3c2a669f3b144f47f13a6f0a98403c8a9f343fc
Opcode Fuzzy Hash: 117ab91425b82670360fd4b1129e079d20703b40517df1e0f21f0325b666f530
Instruction Fuzzy Hash: 57F0E935300200ABD7308A29DC06F9A7BE9EB84B14F04C266F614CB2D2D7B1E8428744

Function 059C33C8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1690511315.00000000059C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39b5f67a4f9c5d24647a5f557c0d2dddfb7bb27b1822191fe080830515dd62b1
Instruction ID: 6271089ffc36d642af3b5ab55fc4bc2a321d0d3173111b4c073db339cb4c41ba
Opcode Fuzzy Hash: 39b5f67a4f9c5d24647a5f557c0d2dddfb7bb27b1822191fe080830515dd62b1
Instruction Fuzzy Hash: 17E0EDB5D012199FCB80DFADD9422DEBBF4EE09650B1085AAE959E3351D7305B01CBC1

Function 05B000B8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1690550285.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b00000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8a9a460fdd0a9349063bd47d4e6e485824bdf84d2faafc82582dd553860ef04
Instruction ID: 2c94dc5fb0589395fd034f536499d19afdf2fb650a9f6f70407eaf2d5f2b349e
Opcode Fuzzy Hash: a8a9a460fdd0a9349063bd47d4e6e485824bdf84d2faafc82582dd553860ef04
Instruction Fuzzy Hash: 29E0925660E3C40FC70763655928BA6AF754F93011B0E80F7D585CB2A3E924AC498372

Function 059C23D1 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1690511315.00000000059C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf2bd6a4f025a7ace7be7c8a2511eb99c4cc0b2832b415b604f3a7adc55b61d6
Instruction ID: cdc26a65eabb1246c767b9bb569837ce8a8fe09d4274180563b459e3edbdb1ce
Opcode Fuzzy Hash: cf2bd6a4f025a7ace7be7c8a2511eb99c4cc0b2832b415b604f3a7adc55b61d6
Instruction Fuzzy Hash: 0BD0C2302491804FC706073858106AA7F644F4B205F1901FDC8894F297C9528C018B40

Function 059C23E0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1690511315.00000000059C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e474f0a2c3346a19c3d1fcb6cdc9a7c565fd22648142982ca57c83cbf9d692d
Instruction ID: 629158adac6a842b14c9f67719ca991cbe26100d4cf4040a36052757165820a4
Opcode Fuzzy Hash: 4e474f0a2c3346a19c3d1fcb6cdc9a7c565fd22648142982ca57c83cbf9d692d
Instruction Fuzzy Hash: CFC0123130061457C7095A69980166AB79D9B8A755F114179D5098B351DE63DC028BC0

Function 059C3894 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1690511315.00000000059C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1bd6ca50eac61a345a3f6c7a30ac1fd1c7ec7ae3cba59d9e4327a7647d0f07f
Instruction ID: 12b55eb4ac4b92079899c625218193d54bf872eed41d9ad136d1af61ea8560db
Opcode Fuzzy Hash: f1bd6ca50eac61a345a3f6c7a30ac1fd1c7ec7ae3cba59d9e4327a7647d0f07f
Instruction Fuzzy Hash: 4CA0017AA4001EAB8E105A99B80A2DCBB24E68527BB4400A2E719934109A31126A8B91

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
Tactics:	Collection
Data Sources:	Logon Session: Logon Session Creation, Process: Process Access, Process: Process Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Desktop\Google Chrome.lnk

C:\Users\user\AppData\Local\Temp\TmpB1F8.tmp

C:\Users\user\AppData\Local\Temp\TmpB237.tmp

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\xte0v1np.default-release\prefs.js

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe