Edit tour

Windows Analysis Report
JgRVqrgNs4.exe

Overview

General Information

Sample name:	JgRVqrgNs4.exe renamed because original name is a hash value
Original sample name:	e80d50169fc57630d4b0c5c53a321ccd86797779bababefff31268224f1a4163.exe
Analysis ID:	1465428
MD5:	119685d67c747bc9fe473e98d4f37f48
SHA1:	12523edc262cf3c0e37be13a2aa2e49db7043439
SHA256:	e80d50169fc57630d4b0c5c53a321ccd86797779bababefff31268224f1a4163
Tags:	exeSnakeKeylogger
Infos:

Detection

Snake Keylogger

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Snake Keylogger

.NET source code references suspicious native API functions

AI detected suspicious sample

Machine Learning detection for sample

Self deletion via cmd or bat file

Tries to detect the country of the analysis system (by using the IP)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

JgRVqrgNs4.exe (PID: 5256 cmdline: "C:\Users\user\Desktop\JgRVqrgNs4.exe" MD5: 119685D67C747BC9FE473E98D4F37F48)

JgRVqrgNs4.exe (PID: 820 cmdline: "C:\Users\user\Desktop\JgRVqrgNs4.exe" MD5: 119685D67C747BC9FE473E98D4F37F48)

cmd.exe (PID: 6836 cmdline: "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\JgRVqrgNs4.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1156 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

choice.exe (PID: 1588 cmdline: choice /C Y /N /D Y /T 3 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "leftlutvar@valleycountysar.org", "Password": "DKw(r0%wpbd]", "Host": "mail.valleycountysar.org", "Port": "587"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.1485853658.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.1485853658.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000002.00000002.1485853658.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x148e3:$a1: get_encryptedPassword 0x14bd9:$a2: get_encryptedUsername 0x146ef:$a3: get_timePasswordChanged 0x147ea:$a4: get_passwordField 0x148f9:$a5: set_encryptedPassword 0x15ed0:$a7: get_logins 0x15e33:$a10: KeyLoggerEventArgs 0x15acc:$a11: KeyLoggerEventArgsEventHandler
00000002.00000002.1485853658.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x180c8:$x1: $%SMTPDV$ 0x1812e:$x2: $#TheHashHere%& 0x1976f:$x3: %FTPDV$ 0x19863:$x4: $%TelegramDv$ 0x15acc:$x5: KeyLoggerEventArgs 0x15e33:$x5: KeyLoggerEventArgs 0x19793:$m2: Clipboard Logs ID 0x1995f:$m2: Screenshot Logs ID 0x19a2b:$m2: keystroke Logs ID 0x19937:$m4: \SnakeKeylogger\
00000002.00000002.1486909813.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.1377173369.00000000042C9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1377173369.00000000042C9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.1377173369.00000000042C9000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf38f3:$a1: get_encryptedPassword 0x114323:$a1: get_encryptedPassword 0x134b43:$a1: get_encryptedPassword 0xf3be9:$a2: get_encryptedUsername 0x114619:$a2: get_encryptedUsername 0x134e39:$a2: get_encryptedUsername 0xf36ff:$a3: get_timePasswordChanged 0x11412f:$a3: get_timePasswordChanged 0x13494f:$a3: get_timePasswordChanged 0xf37fa:$a4: get_passwordField 0x11422a:$a4: get_passwordField 0x134a4a:$a4: get_passwordField 0xf3909:$a5: set_encryptedPassword 0x114339:$a5: set_encryptedPassword 0x134b59:$a5: set_encryptedPassword 0xf4ee0:$a7: get_logins 0x115910:$a7: get_logins 0x136130:$a7: get_logins 0xf4e43:$a10: KeyLoggerEventArgs 0x115873:$a10: KeyLoggerEventArgs 0x136093:$a10: KeyLoggerEventArgs
00000000.00000002.1377173369.00000000042C9000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xf70d8:$x1: $%SMTPDV$ 0x117b08:$x1: $%SMTPDV$ 0x138328:$x1: $%SMTPDV$ 0xf713e:$x2: $#TheHashHere%& 0x117b6e:$x2: $#TheHashHere%& 0x13838e:$x2: $#TheHashHere%& 0xf877f:$x3: %FTPDV$ 0x1191af:$x3: %FTPDV$ 0x1399cf:$x3: %FTPDV$ 0xf8873:$x4: $%TelegramDv$ 0x1192a3:$x4: $%TelegramDv$ 0x139ac3:$x4: $%TelegramDv$ 0xf4adc:$x5: KeyLoggerEventArgs 0xf4e43:$x5: KeyLoggerEventArgs 0x11550c:$x5: KeyLoggerEventArgs 0x115873:$x5: KeyLoggerEventArgs 0x135d2c:$x5: KeyLoggerEventArgs 0x136093:$x5: KeyLoggerEventArgs 0xf87a3:$m2: Clipboard Logs ID 0xf896f:$m2: Screenshot Logs ID 0xf8a3b:$m2: keystroke Logs ID
Process Memory Space: JgRVqrgNs4.exe PID: 5256	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: JgRVqrgNs4.exe PID: 5256	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: JgRVqrgNs4.exe PID: 5256	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xaad4b:$a1: get_encryptedPassword 0xaafa0:$a2: get_encryptedUsername 0xaab7a:$a3: get_timePasswordChanged 0xaac5c:$a4: get_passwordField 0xaad61:$a5: set_encryptedPassword 0xacb78:$a7: get_logins 0xacaf9:$a10: KeyLoggerEventArgs 0xac895:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: JgRVqrgNs4.exe PID: 5256	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xac895:$x5: KeyLoggerEventArgs 0xacaf9:$x5: KeyLoggerEventArgs 0xad578:$x5: KeyLoggerEventArgs 0xad8ac:$x5: KeyLoggerEventArgs 0xaebf1:$m2: Clipboard Logs ID 0xaecd1:$m2: Screenshot Logs ID 0xaed05:$m2: keystroke Logs ID 0xaecbd:$m4: \SnakeKeylogger\
Process Memory Space: JgRVqrgNs4.exe PID: 820	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: JgRVqrgNs4.exe PID: 820	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: JgRVqrgNs4.exe PID: 820	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x25ff3:$a1: get_encryptedPassword 0x262df:$a2: get_encryptedUsername 0x25e09:$a3: get_timePasswordChanged 0x25f04:$a4: get_passwordField 0x26009:$a5: set_encryptedPassword 0x28427:$a7: get_logins 0x2838a:$a10: KeyLoggerEventArgs 0x28023:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: JgRVqrgNs4.exe PID: 820	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x28023:$x5: KeyLoggerEventArgs 0x2838a:$x5: KeyLoggerEventArgs 0x28f54:$x5: KeyLoggerEventArgs 0x29288:$x5: KeyLoggerEventArgs 0x2a5cd:$m2: Clipboard Logs ID 0x2a6ad:$m2: Screenshot Logs ID 0x2a6e1:$m2: keystroke Logs ID 0x2a699:$m4: \SnakeKeylogger\
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.JgRVqrgNs4.exe.43c8840.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.JgRVqrgNs4.exe.43c8840.2.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.JgRVqrgNs4.exe.43c8840.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12ce3:$a1: get_encryptedPassword 0x12fd9:$a2: get_encryptedUsername 0x12aef:$a3: get_timePasswordChanged 0x12bea:$a4: get_passwordField 0x12cf9:$a5: set_encryptedPassword 0x142d0:$a7: get_logins 0x14233:$a10: KeyLoggerEventArgs 0x13ecc:$a11: KeyLoggerEventArgsEventHandler
0.2.JgRVqrgNs4.exe.43c8840.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a4eb:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1971d:$a3: \Google\Chrome\User Data\Default\Login Data 0x19b50:$a4: \Orbitum\User Data\Default\Login Data 0x1ab8f:$a5: \Kometa\User Data\Default\Login Data
0.2.JgRVqrgNs4.exe.43c8840.2.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1386f:$s1: UnHook 0x13876:$s2: SetHook 0x1387e:$s3: CallNextHook 0x1388b:$s4: _hook
0.2.JgRVqrgNs4.exe.43c8840.2.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x164c8:$x1: $%SMTPDV$ 0x1652e:$x2: $#TheHashHere%& 0x17b6f:$x3: %FTPDV$ 0x17c63:$x4: $%TelegramDv$ 0x13ecc:$x5: KeyLoggerEventArgs 0x14233:$x5: KeyLoggerEventArgs 0x17b93:$m2: Clipboard Logs ID 0x17d5f:$m2: Screenshot Logs ID 0x17e2b:$m2: keystroke Logs ID 0x17d37:$m4: \SnakeKeylogger\
0.2.JgRVqrgNs4.exe.43a7e10.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.JgRVqrgNs4.exe.43a7e10.4.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.JgRVqrgNs4.exe.43a7e10.4.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12ce3:$a1: get_encryptedPassword 0x12fd9:$a2: get_encryptedUsername 0x12aef:$a3: get_timePasswordChanged 0x12bea:$a4: get_passwordField 0x12cf9:$a5: set_encryptedPassword 0x142d0:$a7: get_logins 0x14233:$a10: KeyLoggerEventArgs 0x13ecc:$a11: KeyLoggerEventArgsEventHandler
0.2.JgRVqrgNs4.exe.43a7e10.4.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a4eb:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1971d:$a3: \Google\Chrome\User Data\Default\Login Data 0x19b50:$a4: \Orbitum\User Data\Default\Login Data 0x1ab8f:$a5: \Kometa\User Data\Default\Login Data
0.2.JgRVqrgNs4.exe.43a7e10.4.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1386f:$s1: UnHook 0x13876:$s2: SetHook 0x1387e:$s3: CallNextHook 0x1388b:$s4: _hook
0.2.JgRVqrgNs4.exe.43a7e10.4.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x164c8:$x1: $%SMTPDV$ 0x1652e:$x2: $#TheHashHere%& 0x17b6f:$x3: %FTPDV$ 0x17c63:$x4: $%TelegramDv$ 0x13ecc:$x5: KeyLoggerEventArgs 0x14233:$x5: KeyLoggerEventArgs 0x17b93:$m2: Clipboard Logs ID 0x17d5f:$m2: Screenshot Logs ID 0x17e2b:$m2: keystroke Logs ID 0x17d37:$m4: \SnakeKeylogger\
2.2.JgRVqrgNs4.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.JgRVqrgNs4.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.2.JgRVqrgNs4.exe.400000.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
2.2.JgRVqrgNs4.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14ae3:$a1: get_encryptedPassword 0x14dd9:$a2: get_encryptedUsername 0x148ef:$a3: get_timePasswordChanged 0x149ea:$a4: get_passwordField 0x14af9:$a5: set_encryptedPassword 0x160d0:$a7: get_logins 0x16033:$a10: KeyLoggerEventArgs 0x15ccc:$a11: KeyLoggerEventArgsEventHandler
2.2.JgRVqrgNs4.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c2eb:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b51d:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b950:$a4: \Orbitum\User Data\Default\Login Data 0x1c98f:$a5: \Kometa\User Data\Default\Login Data
2.2.JgRVqrgNs4.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1566f:$s1: UnHook 0x15676:$s2: SetHook 0x1567e:$s3: CallNextHook 0x1568b:$s4: _hook
2.2.JgRVqrgNs4.exe.400000.0.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x182c8:$x1: $%SMTPDV$ 0x1832e:$x2: $#TheHashHere%& 0x1996f:$x3: %FTPDV$ 0x19a63:$x4: $%TelegramDv$ 0x15ccc:$x5: KeyLoggerEventArgs 0x16033:$x5: KeyLoggerEventArgs 0x19993:$m2: Clipboard Logs ID 0x19b5f:$m2: Screenshot Logs ID 0x19c2b:$m2: keystroke Logs ID 0x19b37:$m4: \SnakeKeylogger\
0.2.JgRVqrgNs4.exe.43c8840.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.JgRVqrgNs4.exe.43c8840.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.JgRVqrgNs4.exe.43c8840.2.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.JgRVqrgNs4.exe.43c8840.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14ae3:$a1: get_encryptedPassword 0x35303:$a1: get_encryptedPassword 0x14dd9:$a2: get_encryptedUsername 0x355f9:$a2: get_encryptedUsername 0x148ef:$a3: get_timePasswordChanged 0x3510f:$a3: get_timePasswordChanged 0x149ea:$a4: get_passwordField 0x3520a:$a4: get_passwordField 0x14af9:$a5: set_encryptedPassword 0x35319:$a5: set_encryptedPassword 0x160d0:$a7: get_logins 0x368f0:$a7: get_logins 0x16033:$a10: KeyLoggerEventArgs 0x36853:$a10: KeyLoggerEventArgs 0x15ccc:$a11: KeyLoggerEventArgsEventHandler 0x364ec:$a11: KeyLoggerEventArgsEventHandler
0.2.JgRVqrgNs4.exe.43c8840.2.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c2eb:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3cb0b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b51d:$a3: \Google\Chrome\User Data\Default\Login Data 0x3bd3d:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b950:$a4: \Orbitum\User Data\Default\Login Data 0x3c170:$a4: \Orbitum\User Data\Default\Login Data 0x1c98f:$a5: \Kometa\User Data\Default\Login Data 0x3d1af:$a5: \Kometa\User Data\Default\Login Data
0.2.JgRVqrgNs4.exe.43c8840.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1566f:$s1: UnHook 0x35e8f:$s1: UnHook 0x15676:$s2: SetHook 0x35e96:$s2: SetHook 0x1567e:$s3: CallNextHook 0x35e9e:$s3: CallNextHook 0x1568b:$s4: _hook 0x35eab:$s4: _hook
0.2.JgRVqrgNs4.exe.43c8840.2.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x182c8:$x1: $%SMTPDV$ 0x38ae8:$x1: $%SMTPDV$ 0x1832e:$x2: $#TheHashHere%& 0x38b4e:$x2: $#TheHashHere%& 0x1996f:$x3: %FTPDV$ 0x3a18f:$x3: %FTPDV$ 0x19a63:$x4: $%TelegramDv$ 0x3a283:$x4: $%TelegramDv$ 0x15ccc:$x5: KeyLoggerEventArgs 0x16033:$x5: KeyLoggerEventArgs 0x364ec:$x5: KeyLoggerEventArgs 0x36853:$x5: KeyLoggerEventArgs 0x19993:$m2: Clipboard Logs ID 0x19b5f:$m2: Screenshot Logs ID 0x19c2b:$m2: keystroke Logs ID 0x3a1b3:$m2: Clipboard Logs ID 0x3a37f:$m2: Screenshot Logs ID 0x3a44b:$m2: keystroke Logs ID 0x19b37:$m4: \SnakeKeylogger\ 0x3a357:$m4: \SnakeKeylogger\
0.2.JgRVqrgNs4.exe.43a7e10.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.JgRVqrgNs4.exe.43a7e10.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.JgRVqrgNs4.exe.43a7e10.4.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.JgRVqrgNs4.exe.43a7e10.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14ae3:$a1: get_encryptedPassword 0x35513:$a1: get_encryptedPassword 0x55d33:$a1: get_encryptedPassword 0x14dd9:$a2: get_encryptedUsername 0x35809:$a2: get_encryptedUsername 0x56029:$a2: get_encryptedUsername 0x148ef:$a3: get_timePasswordChanged 0x3531f:$a3: get_timePasswordChanged 0x55b3f:$a3: get_timePasswordChanged 0x149ea:$a4: get_passwordField 0x3541a:$a4: get_passwordField 0x55c3a:$a4: get_passwordField 0x14af9:$a5: set_encryptedPassword 0x35529:$a5: set_encryptedPassword 0x55d49:$a5: set_encryptedPassword 0x160d0:$a7: get_logins 0x36b00:$a7: get_logins 0x57320:$a7: get_logins 0x16033:$a10: KeyLoggerEventArgs 0x36a63:$a10: KeyLoggerEventArgs 0x57283:$a10: KeyLoggerEventArgs
0.2.JgRVqrgNs4.exe.43a7e10.4.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c2eb:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3cd1b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x5d53b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b51d:$a3: \Google\Chrome\User Data\Default\Login Data 0x3bf4d:$a3: \Google\Chrome\User Data\Default\Login Data 0x5c76d:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b950:$a4: \Orbitum\User Data\Default\Login Data 0x3c380:$a4: \Orbitum\User Data\Default\Login Data 0x5cba0:$a4: \Orbitum\User Data\Default\Login Data 0x1c98f:$a5: \Kometa\User Data\Default\Login Data 0x3d3bf:$a5: \Kometa\User Data\Default\Login Data 0x5dbdf:$a5: \Kometa\User Data\Default\Login Data
0.2.JgRVqrgNs4.exe.43a7e10.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1566f:$s1: UnHook 0x3609f:$s1: UnHook 0x568bf:$s1: UnHook 0x15676:$s2: SetHook 0x360a6:$s2: SetHook 0x568c6:$s2: SetHook 0x1567e:$s3: CallNextHook 0x360ae:$s3: CallNextHook 0x568ce:$s3: CallNextHook 0x1568b:$s4: _hook 0x360bb:$s4: _hook 0x568db:$s4: _hook
0.2.JgRVqrgNs4.exe.43a7e10.4.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x182c8:$x1: $%SMTPDV$ 0x38cf8:$x1: $%SMTPDV$ 0x59518:$x1: $%SMTPDV$ 0x1832e:$x2: $#TheHashHere%& 0x38d5e:$x2: $#TheHashHere%& 0x5957e:$x2: $#TheHashHere%& 0x1996f:$x3: %FTPDV$ 0x3a39f:$x3: %FTPDV$ 0x5abbf:$x3: %FTPDV$ 0x19a63:$x4: $%TelegramDv$ 0x3a493:$x4: $%TelegramDv$ 0x5acb3:$x4: $%TelegramDv$ 0x15ccc:$x5: KeyLoggerEventArgs 0x16033:$x5: KeyLoggerEventArgs 0x366fc:$x5: KeyLoggerEventArgs 0x36a63:$x5: KeyLoggerEventArgs 0x56f1c:$x5: KeyLoggerEventArgs 0x57283:$x5: KeyLoggerEventArgs 0x19993:$m2: Clipboard Logs ID 0x19b5f:$m2: Screenshot Logs ID 0x19c2b:$m2: keystroke Logs ID
0.2.JgRVqrgNs4.exe.4317d70.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.JgRVqrgNs4.exe.4317d70.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.JgRVqrgNs4.exe.4317d70.3.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.JgRVqrgNs4.exe.4317d70.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xa4b83:$a1: get_encryptedPassword 0xc55b3:$a1: get_encryptedPassword 0xe5dd3:$a1: get_encryptedPassword 0xa4e79:$a2: get_encryptedUsername 0xc58a9:$a2: get_encryptedUsername 0xe60c9:$a2: get_encryptedUsername 0xa498f:$a3: get_timePasswordChanged 0xc53bf:$a3: get_timePasswordChanged 0xe5bdf:$a3: get_timePasswordChanged 0xa4a8a:$a4: get_passwordField 0xc54ba:$a4: get_passwordField 0xe5cda:$a4: get_passwordField 0xa4b99:$a5: set_encryptedPassword 0xc55c9:$a5: set_encryptedPassword 0xe5de9:$a5: set_encryptedPassword 0xa6170:$a7: get_logins 0xc6ba0:$a7: get_logins 0xe73c0:$a7: get_logins 0xa60d3:$a10: KeyLoggerEventArgs 0xc6b03:$a10: KeyLoggerEventArgs 0xe7323:$a10: KeyLoggerEventArgs
0.2.JgRVqrgNs4.exe.4317d70.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0xa570f:$s1: UnHook 0xc613f:$s1: UnHook 0xe695f:$s1: UnHook 0xa5716:$s2: SetHook 0xc6146:$s2: SetHook 0xe6966:$s2: SetHook 0xa571e:$s3: CallNextHook 0xc614e:$s3: CallNextHook 0xe696e:$s3: CallNextHook 0xa572b:$s4: _hook 0xc615b:$s4: _hook 0xe697b:$s4: _hook
0.2.JgRVqrgNs4.exe.4317d70.3.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xa8368:$x1: $%SMTPDV$ 0xc8d98:$x1: $%SMTPDV$ 0xe95b8:$x1: $%SMTPDV$ 0xa83ce:$x2: $#TheHashHere%& 0xc8dfe:$x2: $#TheHashHere%& 0xe961e:$x2: $#TheHashHere%& 0xa9a0f:$x3: %FTPDV$ 0xca43f:$x3: %FTPDV$ 0xeac5f:$x3: %FTPDV$ 0xa9b03:$x4: $%TelegramDv$ 0xca533:$x4: $%TelegramDv$ 0xead53:$x4: $%TelegramDv$ 0xa5d6c:$x5: KeyLoggerEventArgs 0xa60d3:$x5: KeyLoggerEventArgs 0xc679c:$x5: KeyLoggerEventArgs 0xc6b03:$x5: KeyLoggerEventArgs 0xe6fbc:$x5: KeyLoggerEventArgs 0xe7323:$x5: KeyLoggerEventArgs 0xa9a33:$m2: Clipboard Logs ID 0xa9bff:$m2: Screenshot Logs ID 0xa9ccb:$m2: keystroke Logs ID
Click to see the 34 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000002.00000002.1486909813.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "leftlutvar@valleycountysar.org", "Password": "DKw(r0%wpbd]", "Host": "mail.valleycountysar.org", "Port": "587"}

Multi AV Scanner detection for submitted file

Source: JgRVqrgNs4.exe

ReversingLabs: Detection: 71%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: JgRVqrgNs4.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: JgRVqrgNs4.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49704 version: TLS 1.0

Source: JgRVqrgNs4.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: C:\Users\GT350\source\repos\UpdatedRunpe\UpdatedRunpe\obj\x86\Debug\AQipUvwTwkLZyiCs.pdb source: JgRVqrgNs4.exe, 00000000.00000002.1377002113.00000000032C1000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000000.00000002.1378885112.0000000005C30000.00000004.08000000.00040000.00000000.sdmp

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 2.2.JgRVqrgNs4.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JgRVqrgNs4.exe.43c8840.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JgRVqrgNs4.exe.43a7e10.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JgRVqrgNs4.exe.4317d70.3.raw.unpack, type: UNPACKEDPE

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org

Source: Joe Sandbox View	IP Address: 193.122.6.168 193.122.6.168
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49704 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: JgRVqrgNs4.exe, 00000000.00000002.1377173369.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1485853658.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://103.130.147.85
Source: JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003147000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.000000000313A000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003190000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.00000000030A7000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.000000000319F000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003155000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003163000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003147000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.00000000030EA000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.000000000313A000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003190000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.00000000030A7000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.000000000309B000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.000000000319F000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003155000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003163000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: JgRVqrgNs4.exe, 00000000.00000002.1377173369.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1485853658.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003147000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.000000000313A000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003190000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.00000000030BF000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.000000000319F000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003155000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003163000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003147000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.00000000030EA000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.000000000313A000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003190000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.00000000030A7000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.000000000319F000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003155000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003163000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: JgRVqrgNs4.exe, 00000000.00000002.1377173369.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.00000000030A7000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1485853658.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003163000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33
Source: JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003147000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.00000000030EA000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.000000000313A000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003190000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.000000000319F000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003155000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003163000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33$

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.JgRVqrgNs4.exe.43c8840.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.JgRVqrgNs4.exe.43c8840.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.JgRVqrgNs4.exe.43c8840.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.JgRVqrgNs4.exe.43c8840.2.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.JgRVqrgNs4.exe.43a7e10.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.JgRVqrgNs4.exe.43a7e10.4.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.JgRVqrgNs4.exe.43a7e10.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.JgRVqrgNs4.exe.43a7e10.4.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 2.2.JgRVqrgNs4.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 2.2.JgRVqrgNs4.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.JgRVqrgNs4.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 2.2.JgRVqrgNs4.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.JgRVqrgNs4.exe.43c8840.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.JgRVqrgNs4.exe.43c8840.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.JgRVqrgNs4.exe.43c8840.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.JgRVqrgNs4.exe.43c8840.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.JgRVqrgNs4.exe.43a7e10.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.JgRVqrgNs4.exe.43a7e10.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.JgRVqrgNs4.exe.43a7e10.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.JgRVqrgNs4.exe.43a7e10.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.JgRVqrgNs4.exe.4317d70.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.JgRVqrgNs4.exe.4317d70.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.JgRVqrgNs4.exe.4317d70.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000002.00000002.1485853658.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000002.00000002.1485853658.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.1377173369.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1377173369.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: JgRVqrgNs4.exe PID: 5256, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: JgRVqrgNs4.exe PID: 5256, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: JgRVqrgNs4.exe PID: 820, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: JgRVqrgNs4.exe PID: 820, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen

Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Code function: 0_2_01A5D3DC	0_2_01A5D3DC
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Code function: 2_2_02EAB388	2_2_02EAB388
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Code function: 2_2_02EAC1F0	2_2_02EAC1F0
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Code function: 2_2_02EA6178	2_2_02EA6178
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Code function: 2_2_02EAC7B2	2_2_02EAC7B2
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Code function: 2_2_02EAC4D0	2_2_02EAC4D0
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Code function: 2_2_02EACA92	2_2_02EACA92
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Code function: 2_2_02EA4B31	2_2_02EA4B31
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Code function: 2_2_02EA68E0	2_2_02EA68E0
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Code function: 2_2_02EA98B8	2_2_02EA98B8
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Code function: 2_2_02EABF10	2_2_02EABF10
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Code function: 2_2_02EABC32	2_2_02EABC32
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Code function: 2_2_02EA35D8	2_2_02EA35D8
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Code function: 2_2_02EAB552	2_2_02EAB552

Source: JgRVqrgNs4.exe, 00000000.00000002.1378591343.00000000059B0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameExample.dll0 vs JgRVqrgNs4.exe
Source: JgRVqrgNs4.exe, 00000000.00000002.1377002113.00000000032C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAQipUvwTwkLZyiCs.dll: vs JgRVqrgNs4.exe
Source: JgRVqrgNs4.exe, 00000000.00000002.1377002113.00000000032C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs JgRVqrgNs4.exe
Source: JgRVqrgNs4.exe, 00000000.00000002.1377002113.00000000032C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameriched20.dllp( vs JgRVqrgNs4.exe
Source: JgRVqrgNs4.exe, 00000000.00000002.1377002113.00000000032C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs JgRVqrgNs4.exe
Source: JgRVqrgNs4.exe, 00000000.00000002.1377002113.00000000032C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q,\\StringFileInfo\\000004B0\\OriginalFilename vs JgRVqrgNs4.exe
Source: JgRVqrgNs4.exe, 00000000.00000002.1376304264.000000000146E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs JgRVqrgNs4.exe
Source: JgRVqrgNs4.exe, 00000000.00000000.1369688903.0000000000EF2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameGoMonopoly.exe. vs JgRVqrgNs4.exe
Source: JgRVqrgNs4.exe, 00000000.00000002.1377173369.00000000042C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameExample.dll0 vs JgRVqrgNs4.exe
Source: JgRVqrgNs4.exe, 00000000.00000002.1377173369.00000000042C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs JgRVqrgNs4.exe
Source: JgRVqrgNs4.exe, 00000000.00000002.1378885112.0000000005C30000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameAQipUvwTwkLZyiCs.dll: vs JgRVqrgNs4.exe
Source: JgRVqrgNs4.exe, 00000002.00000002.1485853658.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs JgRVqrgNs4.exe
Source: JgRVqrgNs4.exe	Binary or memory string: OriginalFilenameGoMonopoly.exe. vs JgRVqrgNs4.exe

Source: JgRVqrgNs4.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.JgRVqrgNs4.exe.43c8840.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.JgRVqrgNs4.exe.43c8840.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.JgRVqrgNs4.exe.43c8840.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.JgRVqrgNs4.exe.43c8840.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.JgRVqrgNs4.exe.43a7e10.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.JgRVqrgNs4.exe.43a7e10.4.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.JgRVqrgNs4.exe.43a7e10.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.JgRVqrgNs4.exe.43a7e10.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 2.2.JgRVqrgNs4.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 2.2.JgRVqrgNs4.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.JgRVqrgNs4.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 2.2.JgRVqrgNs4.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.JgRVqrgNs4.exe.43c8840.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.JgRVqrgNs4.exe.43c8840.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.JgRVqrgNs4.exe.43c8840.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.JgRVqrgNs4.exe.43c8840.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.JgRVqrgNs4.exe.43a7e10.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.JgRVqrgNs4.exe.43a7e10.4.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.JgRVqrgNs4.exe.43a7e10.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.JgRVqrgNs4.exe.43a7e10.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.JgRVqrgNs4.exe.4317d70.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.JgRVqrgNs4.exe.4317d70.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.JgRVqrgNs4.exe.4317d70.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000002.00000002.1485853658.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000002.00000002.1485853658.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.1377173369.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1377173369.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: JgRVqrgNs4.exe PID: 5256, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: JgRVqrgNs4.exe PID: 5256, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: JgRVqrgNs4.exe PID: 820, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: JgRVqrgNs4.exe PID: 820, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger

Source: 0.2.JgRVqrgNs4.exe.43c8840.2.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.JgRVqrgNs4.exe.43c8840.2.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.JgRVqrgNs4.exe.43c8840.2.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.JgRVqrgNs4.exe.43c8840.2.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.JgRVqrgNs4.exe.43a7e10.4.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.JgRVqrgNs4.exe.43a7e10.4.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.JgRVqrgNs4.exe.43a7e10.4.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.JgRVqrgNs4.exe.43a7e10.4.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.JgRVqrgNs4.exe.4317d70.3.raw.unpack, DarkListView.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.JgRVqrgNs4.exe.59b0000.5.raw.unpack, DarkListView.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.JgRVqrgNs4.exe.4317d70.3.raw.unpack, DarkComboBox.cs	Base64 encoded string: 'Uwm+UuKGd614I69RzLI93aXq8M4plP4Fl8XGnAA54HkS/0jMOBsYAdDU3ufQvFFjYZJP0JeYZcnDYanLTNfb9IJuC/u1be1KdJkORevGYuzVlkHzJtU9FNAhjxyJAuY/'
Source: 0.2.JgRVqrgNs4.exe.59b0000.5.raw.unpack, DarkComboBox.cs	Base64 encoded string: 'Uwm+UuKGd614I69RzLI93aXq8M4plP4Fl8XGnAA54HkS/0jMOBsYAdDU3ufQvFFjYZJP0JeYZcnDYanLTNfb9IJuC/u1be1KdJkORevGYuzVlkHzJtU9FNAhjxyJAuY/'

Source: classification engine

Classification label: mal96.troj.evad.winEXE@8/1@2/2

Source: C:\Users\user\Desktop\JgRVqrgNs4.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\JgRVqrgNs4.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1156:120:WilError_03

Source: JgRVqrgNs4.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: JgRVqrgNs4.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\JgRVqrgNs4.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\JgRVqrgNs4.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: JgRVqrgNs4.exe

ReversingLabs: Detection: 71%

Source: unknown	Process created: C:\Users\user\Desktop\JgRVqrgNs4.exe "C:\Users\user\Desktop\JgRVqrgNs4.exe"
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process created: C:\Users\user\Desktop\JgRVqrgNs4.exe "C:\Users\user\Desktop\JgRVqrgNs4.exe"
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\JgRVqrgNs4.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /C Y /N /D Y /T 3
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process created: C:\Users\user\Desktop\JgRVqrgNs4.exe "C:\Users\user\Desktop\JgRVqrgNs4.exe"	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\JgRVqrgNs4.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /C Y /N /D Y /T 3	Jump to behavior

Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\JgRVqrgNs4.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\JgRVqrgNs4.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: JgRVqrgNs4.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: JgRVqrgNs4.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Source: JgRVqrgNs4.exe

Static PE information: 0xB30A4D71 [Mon Mar 9 04:00:49 2065 UTC]

Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Code function: 0_2_064EC5BD push FFFFFF8Bh; iretd	0_2_064EC5BF
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Code function: 0_2_064E7112 push eax; retf	0_2_064E7119
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Code function: 2_2_02EA9770 push esp; ret	2_2_02EA9771

Source: JgRVqrgNs4.exe

Static PE information: section name: .text entropy: 7.161229069281804

Hooking and other Techniques for Hiding and Protection

Self deletion via cmd or bat file

Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process created: "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\JgRVqrgNs4.exe"
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process created: "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\JgRVqrgNs4.exe"			Jump to behavior

Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Memory allocated: 1690000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Memory allocated: 32C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Memory allocated: 3210000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Memory allocated: 2DF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Memory allocated: 2FE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Memory allocated: 2DF0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 599531	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 598953	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 598719	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 598610	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 598485	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 597872	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 597765	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 597641	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 597532	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 597407	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 597282	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 597172	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 597032	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 596907	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 596782	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 596657	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 596532	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 596420	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 596312	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 596188	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 596063	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 595953	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 595829	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 595704	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 595579	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 595454	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 595344	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 595094	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 594875	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 594766	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 594641	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 594532	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 594407	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 594282	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 594172	Jump to behavior

Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Window / User API: threadDelayed 1379			Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Window / User API: threadDelayed 8449			Jump to behavior

Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6956	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -24903104499507879s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 2980	Thread sleep count: 1379 > 30	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 2980	Thread sleep count: 8449 > 30	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -599641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -599531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -599422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -599313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -599188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -599063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -598953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -598844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -598719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -598610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -598485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -598360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -598235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -598110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -597985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -597872s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -597765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -597641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -597532s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -597407s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -597282s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -597172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -597032s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -596907s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -596782s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -596657s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -596532s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -596420s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -596312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -596188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -596063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -595953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -595829s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -595704s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -595579s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -595454s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -595344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -595235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -595094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -594985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -594875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -594766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -594641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -594532s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -594407s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -594282s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe TID: 6372	Thread sleep time: -594172s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 599531	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 598953	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 598719	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 598610	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 598485	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 597872	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 597765	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 597641	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 597532	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 597407	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 597282	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 597172	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 597032	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 596907	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 596782	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 596657	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 596532	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 596420	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 596312	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 596188	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 596063	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 595953	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 595829	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 595704	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 595579	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 595454	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 595344	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 595094	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 594875	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 594766	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 594641	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 594532	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 594407	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 594282	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Thread delayed: delay time: 594172	Jump to behavior

Source: JgRVqrgNs4.exe, 00000002.00000002.1488700064.000000000686A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\e
Source: JgRVqrgNs4.exe, 00000002.00000002.1486135493.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllm

Source: C:\Users\user\Desktop\JgRVqrgNs4.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\JgRVqrgNs4.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\JgRVqrgNs4.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: JgRVqrgNs4.exe, UiaCoreTypesApi.cs	Reference to suspicious API methods: LoadLibraryHelper.SecureLoadLibraryEx("UIAutomationCore.dll", IntPtr.Zero, UnsafeNativeMethods.LoadLibraryFlags.LOAD_LIBRARY_SEARCH_SYSTEM32)
Source: JgRVqrgNs4.exe, UiaCoreTypesApi.cs	Reference to suspicious API methods: UnsafeNativeMethods.GetProcAddressNoThrow(new HandleRef(null, intPtr), "SynchronizedInputPattern_StartListening")
Source: 0.2.JgRVqrgNs4.exe.33199bc.1.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs	Reference to suspicious API methods: ReadProcessMemory(processInformation.ProcessHandle, num3 + 8, ref buffer, 4, ref bytesRead)

Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process created: C:\Users\user\Desktop\JgRVqrgNs4.exe "C:\Users\user\Desktop\JgRVqrgNs4.exe"	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\JgRVqrgNs4.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /C Y /N /D Y /T 3	Jump to behavior

Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Queries volume information: C:\Users\user\Desktop\JgRVqrgNs4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Queries volume information: C:\Users\user\Desktop\JgRVqrgNs4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\JgRVqrgNs4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\JgRVqrgNs4.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 0.2.JgRVqrgNs4.exe.43c8840.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JgRVqrgNs4.exe.43a7e10.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.JgRVqrgNs4.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JgRVqrgNs4.exe.43c8840.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JgRVqrgNs4.exe.43a7e10.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JgRVqrgNs4.exe.4317d70.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1485853658.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1486909813.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1377173369.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: JgRVqrgNs4.exe PID: 5256, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: JgRVqrgNs4.exe PID: 820, type: MEMORYSTR

Source: Yara match	File source: 0.2.JgRVqrgNs4.exe.43c8840.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JgRVqrgNs4.exe.43a7e10.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.JgRVqrgNs4.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JgRVqrgNs4.exe.43c8840.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JgRVqrgNs4.exe.43a7e10.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JgRVqrgNs4.exe.4317d70.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1485853658.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1377173369.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: JgRVqrgNs4.exe PID: 5256, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: JgRVqrgNs4.exe PID: 820, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 0.2.JgRVqrgNs4.exe.43c8840.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JgRVqrgNs4.exe.43a7e10.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.JgRVqrgNs4.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JgRVqrgNs4.exe.43c8840.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JgRVqrgNs4.exe.43a7e10.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JgRVqrgNs4.exe.4317d70.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1485853658.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1486909813.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1377173369.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: JgRVqrgNs4.exe PID: 5256, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: JgRVqrgNs4.exe PID: 820, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	11 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	12 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 File Deletion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
JgRVqrgNs4.exe	71%	ReversingLabs	ByteCode-MSIL.Spyware.Snakekeylogger
JgRVqrgNs4.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://checkip.dyndns.com	0%	Avira URL Cloud	safe
https://reallyfreegeoip.org/xml/8.46.123.33$	0%	Avira URL Cloud	safe
http://103.130.147.85	0%	Avira URL Cloud	safe
http://checkip.dyndns.org/q	0%	Avira URL Cloud	safe
http://checkip.dyndns.org/	0%	Avira URL Cloud	safe
https://reallyfreegeoip.org/xml/	0%	Avira URL Cloud	safe
https://reallyfreegeoip.org/xml/8.46.123.33	0%	Avira URL Cloud	safe
http://checkip.dyndns.org	0%	Avira URL Cloud	safe
http://reallyfreegeoip.org	0%	Avira URL Cloud	safe
https://reallyfreegeoip.org	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	188.114.96.3	true	true	unknown
checkip.dyndns.com	193.122.6.168	true	false	unknown
checkip.dyndns.org	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/8.46.123.33	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://reallyfreegeoip.org	JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003147000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.00000000030EA000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.000000000313A000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003190000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.00000000030A7000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.000000000319F000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003155000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003163000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org	JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003147000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.00000000030EA000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.000000000313A000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003190000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.00000000030A7000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.000000000309B000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.000000000319F000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003155000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003163000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.com	JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003147000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.000000000313A000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003190000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.00000000030A7000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.000000000319F000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003155000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003163000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/8.46.123.33$	JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003147000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.00000000030EA000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.000000000313A000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003190000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.000000000319F000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003155000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003163000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://103.130.147.85	JgRVqrgNs4.exe, 00000000.00000002.1377173369.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1485853658.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org/q	JgRVqrgNs4.exe, 00000000.00000002.1377173369.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1485853658.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://reallyfreegeoip.org	JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003147000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.000000000313A000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003190000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.00000000030BF000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.000000000319F000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003155000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.0000000003163000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/	JgRVqrgNs4.exe, 00000000.00000002.1377173369.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1486909813.00000000030A7000.00000004.00000800.00020000.00000000.sdmp, JgRVqrgNs4.exe, 00000002.00000002.1485853658.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.122.6.168	checkip.dyndns.com	United States		31898	ORACLE-BMC-31898US	false
188.114.96.3	reallyfreegeoip.org	European Union		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1465428
Start date and time:	2024-07-01 16:26:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	JgRVqrgNs4.exe renamed because original name is a hash value
Original Sample Name:	e80d50169fc57630d4b0c5c53a321ccd86797779bababefff31268224f1a4163.exe
Detection:	MAL
Classification:	mal96.troj.evad.winEXE@8/1@2/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 66 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target JgRVqrgNs4.exe, PID 820 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: JgRVqrgNs4.exe

Simulations

Behavior and APIs

Time	Type	Description
10:27:19	API Interceptor	73x Sleep call for process: JgRVqrgNs4.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.122.6.168	H3fwQALXDX.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	MT Marine Tiger.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	vsl particulars packing list.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	new order.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	z1MB267382625AE.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Prouduct list Specifictions.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	LAQ-PO088PDF.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	IMG_0071191023.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	checkip.dyndns.org/
	new purchase order.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	SecuriteInfo.com.Win64.PWSX-gen.18963.11831.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
188.114.96.3	QUOTATION_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	filetransfer.io/data-package/mHgyHEv5/download
	file.exe	Get hash	malicious	FormBook	Browse	www.cavetta.org.mt/yhnb/
	http://johnlewisfr.com	Get hash	malicious	Unknown	Browse	johnlewisfr.com/
	cL7A9wGE3w.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	445798cm.nyashka.top/ProviderEternalLinephpRequestSecurePacketprocessauthwordpress.php
	http://www.youkonew.anakembok.de/	Get hash	malicious	HTMLPhisher	Browse	www.youkonew.anakembok.de/cdn-cgi/challenge-platform/h/g/jsd/r/89b98144d9c843b7
	hnCn8gE6NH.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	yenot.top/providerlowAuthApibigloadprotectflower.php
	288292021 ABB.exe	Get hash	malicious	FormBook	Browse	www.oc7o0.top/2zff/?Hp=4L8xoD0W4Zo4sy87CvwWXXlmZfhaBYNiZZOBxyE5jHDJEgkxN8cq+PG6NIXzy1XRCqQIvL5VyJCknvUNNLKk6zzmBcbZOQR3Nr9VCMayuUBptQdoGcq8y485hKv0f5POEUdLprTAYpXY&5H=CtUlKhgP42a
	eiqj38BeRo.rtf	Get hash	malicious	FormBook	Browse	www.liposuctionclinics2.today/btrd/?OR-TJfQ=g2Awi9g0RhXmDXdNu5BlCrpPGRTrEfCXfESYZTVa1wMirmNXITW5szlP5E4EhRYb22U+Mw==&2dc=kvXd-rKHCF
	Purchase Order -JJ023639-PDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	filetransfer.io/data-package/9a4iHwft/download
	Techno_PO LV12406-00311.xla.xlsx	Get hash	malicious	Unknown	Browse	qr-in.com/cpGHnqq

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	H3fwQALXDX.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	oHchwlxMNG.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	zkB0qfWSJk.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	file.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	scan copy.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	f3c462280fd1964d68c76ff6889bd3c766fa7140c07962dda32c0cb488188695_payload.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	vsl particulars packing list.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	MT Marine Tiger.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	Order Details.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	new order.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
checkip.dyndns.com	H3fwQALXDX.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	oHchwlxMNG.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	zkB0qfWSJk.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	file.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	scan copy.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	f3c462280fd1964d68c76ff6889bd3c766fa7140c07962dda32c0cb488188695_payload.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	vsl particulars packing list.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	MT Marine Tiger.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	Order Details.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	new order.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	H3fwQALXDX.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	zkB0qfWSJk.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	file.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	f3c462280fd1964d68c76ff6889bd3c766fa7140c07962dda32c0cb488188695_payload.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	MT Marine Tiger.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	new order.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	MT Marine Tiger.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	vsl particulars packing list.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	new order.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	LETTER OF AUTHORIZATION.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
CLOUDFLARENETUS	https://ovexpv.clicks.mlsend.com/ty/cl/eyJ2Ijoie1wiYVwiOjk3MTY5NyxcImxcIjoxMjU2NjAyNTc1MjMzMzY2MzUsXCJyXCI6MTI1NjYwMjkyMTk2NTk4OTEyfSIsInMiOiJjMDRkNjQ0MTU5NWJmNWU5In0	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://wazzootech.co/cgi-ssl/	Get hash	malicious	Unknown	Browse	1.1.1.1
	rQoutation.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	F46VBJ6Yvy.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Arch0000000000.msi	Get hash	malicious	Metamorfo	Browse	104.21.76.57
	H3fwQALXDX.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	8w5wHh755H.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	gB49zgUhr8.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	AdhP1WMUi5.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://webmail1.stormsedge.net/owa/service.svc/s/GetFileAttachment?id=AQMkAGMwMmFiOTE0LWQ5NzktNGE0Zi1iMGM1LTk0MmMzOTFkOWFiZQBGAAADlc4kQ%2BohlEKrqrljxlKVCAcAdJc2TJHT4kmUv1nAYVqHPQAAAgENAAAAdJc2TJHT4kmUv1nAYVqHPQAIOoZlWwAAAAESABAAXD0T7tDHs0qNRd1q6RSkXg%3D%3D&X-OWA-CANARY=sGBeAWNDQUKlLbLOAT0gQCqn7N7UmdwIRGBfhrj-axh_Ij0BMl3fKgjckXCzGSCTl-2kH-3ilbs.	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	1.1.1.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	H3fwQALXDX.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	oHchwlxMNG.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	zkB0qfWSJk.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	YBzCUPEvkm.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	YBzCUPEvkm.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	scan copy.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	f3c462280fd1964d68c76ff6889bd3c766fa7140c07962dda32c0cb488188695_payload.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	vsl particulars packing list.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	MT Marine Tiger.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3

Process:	C:\Users\user\Desktop\JgRVqrgNs4.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.149905623090227
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	JgRVqrgNs4.exe
File size:	550'400 bytes
MD5:	119685d67c747bc9fe473e98d4f37f48
SHA1:	12523edc262cf3c0e37be13a2aa2e49db7043439
SHA256:	e80d50169fc57630d4b0c5c53a321ccd86797779bababefff31268224f1a4163
SHA512:	bcf5fd9f4eb4d62529f16afea7315197e1779493646b0c2db9ee4bda7cb965122fa77d80476f07af4b52afe48f18e0b8a1a8f8ea67b6e55b17ccdd2fdd080723
SSDEEP:	12288:fn3Kpgo/C7vHH2cJ1JkRA4R06mgJuqsJv/v+MLuSn:vnvHXJkRFRzJ4v/BLB
TLSH:	0EC4CF1D73E4419BD9AA9BF938F39E420179BFA63412E60E13E3864D08F3706D81D65B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...qM................0..\...........{... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x487b8e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xB30A4D71 [Mon Mar 9 04:00:49 2065 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x87b34	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x88000	0x5a6	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x85b94	0x85c00	298fced749b41a5412066f37356c9089	False	0.5712050963785047	data	7.161229069281804	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x88000	0x5a6	0x600	132a37b5442e964e380a204121be0dc2	False	0.4212239583333333	data	4.073970029987344	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x8a000	0xc	0x200	47ed0f319ea66e35ecfe856d11836d76	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x880a0	0x31c	data			0.4334170854271357
RT_MANIFEST	0x883bc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 1, 2024 16:27:17.749023914 CEST	49701	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:17.753897905 CEST	80	49701	193.122.6.168	192.168.2.7
Jul 1, 2024 16:27:17.753958941 CEST	49701	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:17.754148960 CEST	49701	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:17.758932114 CEST	80	49701	193.122.6.168	192.168.2.7
Jul 1, 2024 16:27:18.407052040 CEST	80	49701	193.122.6.168	192.168.2.7
Jul 1, 2024 16:27:18.410988092 CEST	49701	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:18.415880919 CEST	80	49701	193.122.6.168	192.168.2.7
Jul 1, 2024 16:27:18.600079060 CEST	80	49701	193.122.6.168	192.168.2.7
Jul 1, 2024 16:27:18.641064882 CEST	49701	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:18.651335001 CEST	49704	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:18.651366949 CEST	443	49704	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:18.651662111 CEST	49704	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:18.655704021 CEST	49704	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:18.655716896 CEST	443	49704	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:19.139259100 CEST	443	49704	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:19.139388084 CEST	49704	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:19.145838022 CEST	49704	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:19.145849943 CEST	443	49704	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:19.146178007 CEST	443	49704	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:19.187942982 CEST	49704	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:19.190063953 CEST	49704	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:19.232512951 CEST	443	49704	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:19.909313917 CEST	443	49704	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:19.909420967 CEST	443	49704	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:19.909535885 CEST	49704	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:19.914907932 CEST	49704	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:19.918437004 CEST	49701	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:19.923198938 CEST	80	49701	193.122.6.168	192.168.2.7
Jul 1, 2024 16:27:20.116552114 CEST	80	49701	193.122.6.168	192.168.2.7
Jul 1, 2024 16:27:20.119369030 CEST	49706	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:20.119391918 CEST	443	49706	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:20.119507074 CEST	49706	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:20.119761944 CEST	49706	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:20.119779110 CEST	443	49706	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:20.156677008 CEST	49701	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:20.500365019 CEST	80	49701	193.122.6.168	192.168.2.7
Jul 1, 2024 16:27:20.500447989 CEST	49701	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:20.620917082 CEST	443	49706	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:20.623509884 CEST	49706	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:20.623536110 CEST	443	49706	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:20.777756929 CEST	443	49706	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:20.777862072 CEST	443	49706	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:20.778079987 CEST	49706	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:20.778436899 CEST	49706	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:20.781563044 CEST	49701	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:20.782875061 CEST	49707	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:20.786781073 CEST	80	49701	193.122.6.168	192.168.2.7
Jul 1, 2024 16:27:20.786859035 CEST	49701	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:20.787712097 CEST	80	49707	193.122.6.168	192.168.2.7
Jul 1, 2024 16:27:20.787883043 CEST	49707	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:20.788005114 CEST	49707	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:20.792773008 CEST	80	49707	193.122.6.168	192.168.2.7
Jul 1, 2024 16:27:21.429789066 CEST	80	49707	193.122.6.168	192.168.2.7
Jul 1, 2024 16:27:21.431523085 CEST	49708	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:21.431571960 CEST	443	49708	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:21.431937933 CEST	49708	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:21.431937933 CEST	49708	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:21.431972027 CEST	443	49708	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:21.484934092 CEST	49707	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:21.931307077 CEST	443	49708	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:21.933226109 CEST	49708	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:21.933259010 CEST	443	49708	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:22.074081898 CEST	443	49708	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:22.074181080 CEST	443	49708	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:22.074248075 CEST	49708	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:22.074687004 CEST	49708	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:22.078532934 CEST	49709	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:22.083766937 CEST	80	49709	193.122.6.168	192.168.2.7
Jul 1, 2024 16:27:22.083882093 CEST	49709	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:22.083980083 CEST	49709	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:22.089807034 CEST	80	49709	193.122.6.168	192.168.2.7
Jul 1, 2024 16:27:22.719938993 CEST	80	49709	193.122.6.168	192.168.2.7
Jul 1, 2024 16:27:22.721339941 CEST	49711	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:22.721375942 CEST	443	49711	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:22.721440077 CEST	49711	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:22.722146034 CEST	49711	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:22.722161055 CEST	443	49711	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:22.766055107 CEST	49709	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:23.192269087 CEST	443	49711	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:23.194022894 CEST	49711	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:23.194047928 CEST	443	49711	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:23.352309942 CEST	443	49711	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:23.352866888 CEST	443	49711	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:23.352951050 CEST	49711	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:23.353338003 CEST	49711	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:23.356386900 CEST	49709	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:23.357362032 CEST	49713	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:23.361665964 CEST	80	49709	193.122.6.168	192.168.2.7
Jul 1, 2024 16:27:23.361720085 CEST	49709	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:23.362240076 CEST	80	49713	193.122.6.168	192.168.2.7
Jul 1, 2024 16:27:23.362421036 CEST	49713	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:23.362526894 CEST	49713	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:23.367858887 CEST	80	49713	193.122.6.168	192.168.2.7
Jul 1, 2024 16:27:24.004183054 CEST	80	49713	193.122.6.168	192.168.2.7
Jul 1, 2024 16:27:24.005345106 CEST	49714	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:24.005383015 CEST	443	49714	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:24.005438089 CEST	49714	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:24.005702972 CEST	49714	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:24.005713940 CEST	443	49714	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:24.047305107 CEST	49713	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:24.502330065 CEST	443	49714	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:24.503998995 CEST	49714	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:24.504024029 CEST	443	49714	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:24.629815102 CEST	443	49714	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:24.629913092 CEST	443	49714	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:24.630198956 CEST	49714	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:24.630517006 CEST	49714	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:24.633723974 CEST	49713	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:24.634850979 CEST	49715	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:24.638813019 CEST	80	49713	193.122.6.168	192.168.2.7
Jul 1, 2024 16:27:24.638879061 CEST	49713	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:24.639674902 CEST	80	49715	193.122.6.168	192.168.2.7
Jul 1, 2024 16:27:24.639792919 CEST	49715	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:24.639812946 CEST	49715	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:24.644577026 CEST	80	49715	193.122.6.168	192.168.2.7
Jul 1, 2024 16:27:25.297102928 CEST	80	49715	193.122.6.168	192.168.2.7
Jul 1, 2024 16:27:25.298486948 CEST	49716	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:25.298531055 CEST	443	49716	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:25.298634052 CEST	49716	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:25.298986912 CEST	49716	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:25.298999071 CEST	443	49716	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:25.344398022 CEST	49715	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:25.793502092 CEST	443	49716	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:25.795159101 CEST	49716	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:25.795183897 CEST	443	49716	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:26.056556940 CEST	443	49716	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:26.056680918 CEST	443	49716	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:26.056756020 CEST	49716	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:26.057279110 CEST	49716	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:26.060345888 CEST	49715	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:26.061463118 CEST	49717	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:26.065500021 CEST	80	49715	193.122.6.168	192.168.2.7
Jul 1, 2024 16:27:26.065579891 CEST	49715	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:26.066286087 CEST	80	49717	193.122.6.168	192.168.2.7
Jul 1, 2024 16:27:26.066364050 CEST	49717	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:26.066482067 CEST	49717	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:26.071269989 CEST	80	49717	193.122.6.168	192.168.2.7
Jul 1, 2024 16:27:26.712627888 CEST	80	49717	193.122.6.168	192.168.2.7
Jul 1, 2024 16:27:26.714205027 CEST	49718	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:26.714258909 CEST	443	49718	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:26.714327097 CEST	49718	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:26.714601994 CEST	49718	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:26.714615107 CEST	443	49718	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:26.766097069 CEST	49717	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:27.184307098 CEST	443	49718	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:27.185966015 CEST	49718	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:27.185982943 CEST	443	49718	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:27.317867994 CEST	443	49718	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:27.317975044 CEST	443	49718	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:27.318033934 CEST	49718	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:27.318602085 CEST	49718	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:27.321865082 CEST	49717	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:27.323010921 CEST	49719	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:27.328260899 CEST	80	49717	193.122.6.168	192.168.2.7
Jul 1, 2024 16:27:27.328351974 CEST	49717	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:27.329581976 CEST	80	49719	193.122.6.168	192.168.2.7
Jul 1, 2024 16:27:27.329663038 CEST	49719	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:27.329763889 CEST	49719	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:27.334646940 CEST	80	49719	193.122.6.168	192.168.2.7
Jul 1, 2024 16:27:27.971240044 CEST	80	49719	193.122.6.168	192.168.2.7
Jul 1, 2024 16:27:27.972436905 CEST	49720	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:27.972470999 CEST	443	49720	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:27.972532988 CEST	49720	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:27.972773075 CEST	49720	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:27.972790956 CEST	443	49720	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:28.016128063 CEST	49719	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:28.465984106 CEST	443	49720	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:28.467835903 CEST	49720	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:28.467859030 CEST	443	49720	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:28.602966070 CEST	443	49720	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:28.603076935 CEST	443	49720	188.114.96.3	192.168.2.7
Jul 1, 2024 16:27:28.603142977 CEST	49720	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:28.603647947 CEST	49720	443	192.168.2.7	188.114.96.3
Jul 1, 2024 16:27:28.702553988 CEST	49719	80	192.168.2.7	193.122.6.168
Jul 1, 2024 16:27:28.702630997 CEST	49707	80	192.168.2.7	193.122.6.168

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 1, 2024 16:27:17.733555079 CEST	63338	53	192.168.2.7	1.1.1.1
Jul 1, 2024 16:27:17.741656065 CEST	53	63338	1.1.1.1	192.168.2.7
Jul 1, 2024 16:27:18.641859055 CEST	60038	53	192.168.2.7	1.1.1.1
Jul 1, 2024 16:27:18.650626898 CEST	53	60038	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 1, 2024 16:27:17.733555079 CEST	192.168.2.7	1.1.1.1	0xa6	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 16:27:18.641859055 CEST	192.168.2.7	1.1.1.1	0x43c9	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 1, 2024 16:27:17.741656065 CEST	1.1.1.1	192.168.2.7	0xa6	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 1, 2024 16:27:17.741656065 CEST	1.1.1.1	192.168.2.7	0xa6	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 1, 2024 16:27:17.741656065 CEST	1.1.1.1	192.168.2.7	0xa6	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 1, 2024 16:27:17.741656065 CEST	1.1.1.1	192.168.2.7	0xa6	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 1, 2024 16:27:17.741656065 CEST	1.1.1.1	192.168.2.7	0xa6	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 1, 2024 16:27:17.741656065 CEST	1.1.1.1	192.168.2.7	0xa6	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 1, 2024 16:27:18.650626898 CEST	1.1.1.1	192.168.2.7	0x43c9	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 1, 2024 16:27:18.650626898 CEST	1.1.1.1	192.168.2.7	0x43c9	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49701	193.122.6.168	80	820	C:\Users\user\Desktop\JgRVqrgNs4.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:27:17.754148960 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 1, 2024 16:27:18.407052040 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 14:27:18 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 5d9839f2970dfb9d826f98db011cc9df Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 1, 2024 16:27:18.410988092 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jul 1, 2024 16:27:18.600079060 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 14:27:18 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 7ae5e7f4c72d61fb7f13ef27b31a90e5 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 1, 2024 16:27:19.918437004 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jul 1, 2024 16:27:20.116552114 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 14:27:20 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 351d4ab76a28e5376a4bde54bc6ec850 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 1, 2024 16:27:20.500365019 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 14:27:20 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 351d4ab76a28e5376a4bde54bc6ec850 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49707	193.122.6.168	80	820	C:\Users\user\Desktop\JgRVqrgNs4.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:27:20.788005114 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jul 1, 2024 16:27:21.429789066 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 14:27:21 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 77d29dd182cd27784de654db1fc32034 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49709	193.122.6.168	80	820	C:\Users\user\Desktop\JgRVqrgNs4.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:27:22.083980083 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 1, 2024 16:27:22.719938993 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 14:27:22 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 3955f0d1058549d297d499ab366c5013 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49713	193.122.6.168	80	820	C:\Users\user\Desktop\JgRVqrgNs4.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:27:23.362526894 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 1, 2024 16:27:24.004183054 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 14:27:23 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 456e767dcdb100faadd15e7d8c5ba826 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49715	193.122.6.168	80	820	C:\Users\user\Desktop\JgRVqrgNs4.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:27:24.639812946 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 1, 2024 16:27:25.297102928 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 14:27:25 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 363dd02243a785f1dac0b4fe8e240604 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49717	193.122.6.168	80	820	C:\Users\user\Desktop\JgRVqrgNs4.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:27:26.066482067 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 1, 2024 16:27:26.712627888 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 14:27:26 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: be1ef0f1877bac0906d687dc4250c969 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49719	193.122.6.168	80	820	C:\Users\user\Desktop\JgRVqrgNs4.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:27:27.329763889 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 1, 2024 16:27:27.971240044 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 14:27:27 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c1b4b2e9f54a9b4f31fac38fe10d54b0 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49704	188.114.96.3	443	820	C:\Users\user\Desktop\JgRVqrgNs4.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 14:27:19 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-07-01 14:27:19 UTC	696	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 14:27:19 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: EXPIRED Last-Modified: Sun, 30 Jun 2024 14:23:56 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dHQ21l8gSKqNxmkJFfMFHHyEOAyLNR12oQNGfj4Tf8xWHLjKIcfguaMjcxEMteCR%2BSXKlR2ibpBIgS4%2F3XrNwyDzEFRr9sFB43JDJLrfhpeuwOT5PaWHybcSFmHC2VgOTYHvc68b"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89c7137d4b490f7c-EWR alt-svc: h3=":443"; ma=86400
2024-07-01 14:27:19 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-01 14:27:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49706	188.114.96.3	443	820	C:\Users\user\Desktop\JgRVqrgNs4.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 14:27:20 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-07-01 14:27:20 UTC	704	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 14:27:20 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 1 Last-Modified: Mon, 01 Jul 2024 14:27:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Alow6w5Jo2wYMNQ%2B%2FP8IgZ9oI8d7Hl3P5kz54PCr0utHEZR23ATLiFfetH3kJMUaSgnpoZcATopNlOgaBqBamPUT5kVb1ol4skrlF54%2FLx2adK8cnZTV%2Bc7y2KNP7U2MoMLzvgkt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89c71386787e32e8-EWR alt-svc: h3=":443"; ma=86400
2024-07-01 14:27:20 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-01 14:27:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49708	188.114.96.3	443	820	C:\Users\user\Desktop\JgRVqrgNs4.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 14:27:21 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-07-01 14:27:22 UTC	700	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 14:27:22 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 3 Last-Modified: Mon, 01 Jul 2024 14:27:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kiXTT3OPwoJdF2mqdQyWzzM75mWOClCSnJSzzWtL1UgyNMOkn3RNFM8Jza29OIHAyvxVobqk2TSM2oEHIAYlGUAC4E%2FYRtiVkIbgEs6K194AKiocLHG%2F9LCjAzlb2efUsCAuQHES"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89c7138e8c188c36-EWR alt-svc: h3=":443"; ma=86400
2024-07-01 14:27:22 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-01 14:27:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49711	188.114.96.3	443	820	C:\Users\user\Desktop\JgRVqrgNs4.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 14:27:23 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-07-01 14:27:23 UTC	702	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 14:27:23 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 4 Last-Modified: Mon, 01 Jul 2024 14:27:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ypmbiyxEFM2D8NtTSj41COdt%2Fgsg5oRPshCN3xGXsKt4Kp6gmmPiAqfFeqA%2Fvl0DAVslUFEIfqE8LsWwIfuie6sFsjh8JqNZMXEUTMI8l9oBykGiC01Ww%2BFJqg9G66VE0SKHqMbu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89c713969e646a5e-EWR alt-svc: h3=":443"; ma=86400
2024-07-01 14:27:23 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-01 14:27:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49714	188.114.96.3	443	820	C:\Users\user\Desktop\JgRVqrgNs4.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 14:27:24 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-07-01 14:27:24 UTC	704	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 14:27:24 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 5 Last-Modified: Mon, 01 Jul 2024 14:27:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SZ8Wf7NoIjUYJ3jLF7z3cmeu9WSXj3%2Fx64GwNd7RhMjOqgvzdUaNeaMjgYN9eTjZQZYl%2FmUfK4%2Ffb1bXxYK4GYREbM9EYtEvA%2FnKKyoxfAZlMHCnCfO34wJDatTbuASRaMnKnSfz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89c7139e8c9c72c2-EWR alt-svc: h3=":443"; ma=86400
2024-07-01 14:27:24 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-01 14:27:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49716	188.114.96.3	443	820	C:\Users\user\Desktop\JgRVqrgNs4.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 14:27:25 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-07-01 14:27:26 UTC	710	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 14:27:25 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 6 Last-Modified: Mon, 01 Jul 2024 14:27:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BlLiZ02GDCnG2ZWEbNVt4%2BzNDJhG%2Fh%2BA5nYfvX%2ByaAiqqsk6wIPJ7dOETFri8Ygt8NimpepaXOmnLs%2F2FxquG8uzkfj2NYE%2BL5VAZFDAAQvwWGwCpAM%2BlWeXXbw56J2WVMni8iER"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89c713a6cc72c44f-EWR alt-svc: h3=":443"; ma=86400
2024-07-01 14:27:26 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-01 14:27:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49718	188.114.96.3	443	820	C:\Users\user\Desktop\JgRVqrgNs4.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 14:27:27 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-07-01 14:27:27 UTC	708	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 14:27:27 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 8 Last-Modified: Mon, 01 Jul 2024 14:27:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0xU8ijb0hR8UcNlvhI%2FrGUDtjo38zq1M2qzvwBNr6jkeKG1nY14v1IwnY4sA4qtXFcfbMybISfOVxvSJcol5%2FL6ZYzBWQeTaIfyZ%2B%2FVrbqSE%2FIZxNDQPs6hIDVBkF4%2BpCnHbN8Ja"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89c713af5d480f88-EWR alt-svc: h3=":443"; ma=86400
2024-07-01 14:27:27 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-01 14:27:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49720	188.114.96.3	443	820	C:\Users\user\Desktop\JgRVqrgNs4.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 14:27:28 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-07-01 14:27:28 UTC	704	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 14:27:28 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 9 Last-Modified: Mon, 01 Jul 2024 14:27:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SOlVXcecvHOHV0glJwHdL1xwpOq3xf3nSh8RsCVzln7Ug8i05JYpuc1JafjYjRGGIVqj%2F0%2BlfACBoWLzE%2FRkNwf0WudSwpX3ymMsA2bxb0DXKmuE6eIia%2BTnP8LZgUMdIUJ4V47X"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89c713b75e097cb4-EWR alt-svc: h3=":443"; ma=86400
2024-07-01 14:27:28 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-01 14:27:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	10:27:15
Start date:	01/07/2024
Path:	C:\Users\user\Desktop\JgRVqrgNs4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\JgRVqrgNs4.exe"
Imagebase:	0xef0000
File size:	550'400 bytes
MD5 hash:	119685D67C747BC9FE473E98D4F37F48
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1377173369.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.1377173369.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.1377173369.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.1377173369.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:27:16
Start date:	01/07/2024
Path:	C:\Users\user\Desktop\JgRVqrgNs4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\JgRVqrgNs4.exe"
Imagebase:	0xc50000
File size:	550'400 bytes
MD5 hash:	119685D67C747BC9FE473E98D4F37F48
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.1485853658.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000002.00000002.1485853658.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000002.00000002.1485853658.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000002.00000002.1485853658.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000002.00000002.1486909813.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:27:28
Start date:	01/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\JgRVqrgNs4.exe"
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:27:28
Start date:	01/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:27:29
Start date:	01/07/2024
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /C Y /N /D Y /T 3
Imagebase:	0xdd0000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	60
Total number of Limit Nodes:	10

Executed Functions

Function 01A5A690 Relevance: 1.7, APIs: 1, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 01A5A8E6

Memory Dump Source

Source File: 00000000.00000002.1376773905.0000000001A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a50000_JgRVqrgNs4.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 77740ebe8284fd03fd154bd204b0dd7e67bcc0b2e4f8ee0059975fe71215d917
Instruction ID: 7adf509720f26525497b2ae55c426ddf03e8973a0a06e0105d72105855903b04
Opcode Fuzzy Hash: 77740ebe8284fd03fd154bd204b0dd7e67bcc0b2e4f8ee0059975fe71215d917
Instruction Fuzzy Hash: 637168B0A04B058FE764DF29D55075ABBF1FF88210F108A2ED84ADBB50DB35E845CBA1

Function 01A5CB58 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,01A5CB26,?,?,?,?,?), ref: 01A5CBE7

Memory Dump Source

Source File: 00000000.00000002.1376773905.0000000001A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a50000_JgRVqrgNs4.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a8256d2995a451a8a3f48c76d1f0103ec9203399762d9c13cd1706d9d1c44df6
Instruction ID: 77aa25d17945eef6bb6ddab14e681491f6104cd802ecbf606102319976db273e
Opcode Fuzzy Hash: a8256d2995a451a8a3f48c76d1f0103ec9203399762d9c13cd1706d9d1c44df6
Instruction Fuzzy Hash: E821D4B5D00219AFDB10CFAAD884ADEFBF9EB48220F14841AE914E3350D375A944CF65

Function 01A5BDE0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,01A5CB26,?,?,?,?,?), ref: 01A5CBE7

Memory Dump Source

Source File: 00000000.00000002.1376773905.0000000001A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a50000_JgRVqrgNs4.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7eb0a948c455e26a3d83c5d7d35712059fcea653eca1c4f7463483dae09c3fc8
Instruction ID: 2c8b590d8727b7ff8b996d1a1b36c65bdfacb78756b74f974865b8c29f345ae9
Opcode Fuzzy Hash: 7eb0a948c455e26a3d83c5d7d35712059fcea653eca1c4f7463483dae09c3fc8
Instruction Fuzzy Hash: F721D4B5D04308AFDB10CFAAD884ADEBBF8FB48220F14801AE914A7350D375A944DFA5

Function 01A5A100 Relevance: 1.6, APIs: 1, Instructions: 62
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,01A5A961,00000800,00000000,00000000), ref: 01A5AB72

Memory Dump Source

Source File: 00000000.00000002.1376773905.0000000001A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a50000_JgRVqrgNs4.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: eeb9a0916e8171b1ed2e9f81074badc6e5a6ab60d8fccc6433d1da75d261f00c
Instruction ID: e671999e04c3ba39afe69c855f7d955fb142bee9d5a4337e6631b04da9dccbfb
Opcode Fuzzy Hash: eeb9a0916e8171b1ed2e9f81074badc6e5a6ab60d8fccc6433d1da75d261f00c
Instruction Fuzzy Hash: 652159B6D043489FDB10CFAAC844ADEBBF5AB48220F15851ED919A7211C3745545CFA5

Function 01A5AB00 Relevance: 1.6, APIs: 1, Instructions: 56
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,01A5A961,00000800,00000000,00000000), ref: 01A5AB72

Memory Dump Source

Source File: 00000000.00000002.1376773905.0000000001A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a50000_JgRVqrgNs4.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 09b9fbac9508c60281c9a9fd684fa97ddb0316b616721ec9599b357e137a910f
Instruction ID: c397021fc2b5e7c53d0a8ed569972d8dc8b596f101e409ff32fdb32846badfab
Opcode Fuzzy Hash: 09b9fbac9508c60281c9a9fd684fa97ddb0316b616721ec9599b357e137a910f
Instruction Fuzzy Hash: 6E11F2B6D002499FDB20CF9AD844A9EBBF5AB48310F11852AE919A7600C379A945CFA5

Function 01A5A118 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,01A5A961,00000800,00000000,00000000), ref: 01A5AB72

Memory Dump Source

Source File: 00000000.00000002.1376773905.0000000001A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a50000_JgRVqrgNs4.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d7732bdf98777a2e599f0134fa06a110f5df7a60a0cda6693adf2f9a824c0e87
Instruction ID: 27c33fa133d9a71158cbf780c15d03900917c1ba0f060aabcae81eabfdc2efc6
Opcode Fuzzy Hash: d7732bdf98777a2e599f0134fa06a110f5df7a60a0cda6693adf2f9a824c0e87
Instruction Fuzzy Hash: A81133B6D043089FDB20CF9AD844A9EFBF5AB48210F10852AE919A7200C375A904CFA5

Function 064E2364 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,064E2EE9,?,?), ref: 064E3090

Memory Dump Source

Source File: 00000000.00000002.1379164513.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64e0000_JgRVqrgNs4.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 61aa0752b938b16d0d121b9abb2dd7cc73206463bf8735986942edc9789242c4
Instruction ID: 53b21beaac4f81de5ac9aa573ac0703a56ccfd3677cac65742f5c61f9d8c0b35
Opcode Fuzzy Hash: 61aa0752b938b16d0d121b9abb2dd7cc73206463bf8735986942edc9789242c4
Instruction Fuzzy Hash: 5A1125B5C007499FDB21DF9AD444BEEBBF4EB48320F20841AE958A7340D379A944CFA5

Function 064E3030 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,064E2EE9,?,?), ref: 064E3090

Memory Dump Source

Source File: 00000000.00000002.1379164513.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64e0000_JgRVqrgNs4.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 405e40a2c1853ab95870003df72c0f3550aa32ab92da2773795bc7a6179d0999
Instruction ID: 517bbb1bfbaf7b98701b0a8392248db5c7b2c7ad1ef7a539027384ce48d7383e
Opcode Fuzzy Hash: 405e40a2c1853ab95870003df72c0f3550aa32ab92da2773795bc7a6179d0999
Instruction Fuzzy Hash: B71125B6C003098FDB21CF99D545BDEBBF4AF48324F21841AD558A7740D339A544CFA5

Function 01A5A880 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 01A5A8E6

Memory Dump Source

Source File: 00000000.00000002.1376773905.0000000001A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a50000_JgRVqrgNs4.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 4b04cbc27ef458c4cca0831b84cb32ed7138e97b5a331a10787addc5c8eba178
Instruction ID: 128b218b31d40c59532a38a48a9087848a1b81617e0a561ddf2f7590dc7100db
Opcode Fuzzy Hash: 4b04cbc27ef458c4cca0831b84cb32ed7138e97b5a331a10787addc5c8eba178
Instruction Fuzzy Hash: 1A1102B6D002498FDB10CF9AD444ADEFBF4EF88210F10851AD819A7600C375A545CFA5

Function 064EAC20 Relevance: 1.5, APIs: 1, Instructions: 47
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 064EAC85

Memory Dump Source

Source File: 00000000.00000002.1379164513.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64e0000_JgRVqrgNs4.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: f7a489caf24cc0581c6ce7d1541b1768e3730ba330da42f7a1ef605fcdc890cf
Instruction ID: 421b0809d78ee427baa4ab0042e65cbd0d04ff383fc441ce5eaa2e580e310b50
Opcode Fuzzy Hash: f7a489caf24cc0581c6ce7d1541b1768e3730ba330da42f7a1ef605fcdc890cf
Instruction Fuzzy Hash: 1611D6B58003499FDB21CF9AD945BDEFBF8FB48324F10841AE558A7640C375A584CFA5

Function 064E8BF4 Relevance: 1.5, APIs: 1, Instructions: 47
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 064EAC85

Memory Dump Source

Source File: 00000000.00000002.1379164513.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64e0000_JgRVqrgNs4.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 20e6a709d1965dbe081820d949db0326cfae266e6d61da362c59efa350afa906
Instruction ID: 605ed6efc37a6abae28c2caa536174dfe699ab54f0ade4420fda792d31248819
Opcode Fuzzy Hash: 20e6a709d1965dbe081820d949db0326cfae266e6d61da362c59efa350afa906
Instruction Fuzzy Hash: F011F5B59003589FDB10CF9AD985BDEFBF8FB48314F10841AE518A7600C375A984CFA5

Function 0164D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376592844.000000000164D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0164D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_164d000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f85f4c8201c4fcb40ca05d9d580ee4abfdc142922f84495d86b070a724c1fc36
Instruction ID: fa47577633b7c4313dc3dc68400008714eec8bd54276886e4717ee9ce517f0c3
Opcode Fuzzy Hash: f85f4c8201c4fcb40ca05d9d580ee4abfdc142922f84495d86b070a724c1fc36
Instruction Fuzzy Hash: C021F271A04300EFDB25DFA4D9C4B16BBA5FB94B14F20C56DE90A4B396C33AD447CA62

Function 0164D1EC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376592844.000000000164D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0164D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_164d000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 312484c99fd47ab42fd72a87b6a999246f1e6810f7a784c8b235fdb3c04c4e55
Instruction ID: c587cda3d7265c2966e609217f8b36ee73a38602a4f4cf84fea9b9200ea0acdc
Opcode Fuzzy Hash: 312484c99fd47ab42fd72a87b6a999246f1e6810f7a784c8b235fdb3c04c4e55
Instruction Fuzzy Hash: 6F21F271A04300EFDB15DFA4D9C0B17BBA5FB94324F20C56DEA0A4B392C336D846CAA1

Function 0164D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376592844.000000000164D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0164D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_164d000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e020fc52024e7c20771691695641137c464337d5c785334117d46b726f4046fe
Instruction ID: 84ded695545e2dce13b0dcab404170ff7a75cf552c8544f6240dd7260a08790e
Opcode Fuzzy Hash: e020fc52024e7c20771691695641137c464337d5c785334117d46b726f4046fe
Instruction Fuzzy Hash: 6211BB75904280CFCB16CF54D9C4B15BBA2FB84714F24C6AAD8094B796C33AD40ACBA2

Function 0164D1E7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376592844.000000000164D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0164D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_164d000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e020fc52024e7c20771691695641137c464337d5c785334117d46b726f4046fe
Instruction ID: 0117b0988ec8defd852b0cbe7f58813ba7fcfd9497b1793dc153bd0c0338411b
Opcode Fuzzy Hash: e020fc52024e7c20771691695641137c464337d5c785334117d46b726f4046fe
Instruction Fuzzy Hash: 9D11DD75904280DFCB12CF54D9C4B16BFA2FB84324F24C6A9D9094B796C33AD40ACFA1

Non-executed Functions

Function 01A5D3DC Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376773905.0000000001A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a50000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cce3f1410e959ce650d7c90161897095effa803d8353dd21d6263ff2c103ce4
Instruction ID: ae68b3f533dbe14341f5a41136d403e88671db73a6f713524ca31afe4d7acb17
Opcode Fuzzy Hash: 2cce3f1410e959ce650d7c90161897095effa803d8353dd21d6263ff2c103ce4
Instruction Fuzzy Hash: 6AA1A432E0020ACFCF45DFB4C5405DEBBB2FF85300B15856AE906AB221DB31E945CB90

Analysis Process: JgRVqrgNs4.exePID: 820, Parent PID: 5256COMMON

Executed Functions

Function 02EA68E0 Relevance: 5.3, Strings: 4, Instructions: 331COMMON

Download Yara Rule

Strings

(oq, xrefs: 02EA69DA
(oq, xrefs: 02EA69E8
,q, xrefs: 02EA6A52
,q, xrefs: 02EA6A60

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID: (oq$(oq$,q$,q
API String ID: 0-620556200
Opcode ID: efee9c99ed6c1306994e60530d9cfb402a16941aca1dc1a73c1ceacdc385ed21
Instruction ID: 74d52dbc575ba0b3643e99082debf52e185a9e02bd25beb5ef5385a5c1ec8413
Opcode Fuzzy Hash: efee9c99ed6c1306994e60530d9cfb402a16941aca1dc1a73c1ceacdc385ed21
Instruction Fuzzy Hash: F4D10D70A40119DFDF14CFA9C9A4AEDBBB6FF8A308F59D065E415AB261D730E841CB50

Function 02EA98B8 Relevance: 3.4, Strings: 2, Instructions: 854COMMON

Download Yara Rule

Strings

4'q, xrefs: 02EAA2D3
(oq, xrefs: 02EA9CD8

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID: (oq$4'q
API String ID: 0-1336004174
Opcode ID: 1761ab7f8c0443804ab4adaaf40ad2a4c4794a1656cb2cb9761e76e54a50ee44
Instruction ID: d7ff2772a482987bd14fa7b77111df41e9224a3b6eda9a34f7e1f29dc9085e03
Opcode Fuzzy Hash: 1761ab7f8c0443804ab4adaaf40ad2a4c4794a1656cb2cb9761e76e54a50ee44
Instruction Fuzzy Hash: 8E726970A40209DFCB14CFA8C9A4AAEBBF2BF89304F15D569E8059B365D731F855CB60

Function 02EA6178 Relevance: 3.1, Strings: 2, Instructions: 564COMMON

Download Yara Rule

Strings

Hq, xrefs: 02EA656E
(oq, xrefs: 02EA66A2

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID: (oq$Hq
API String ID: 0-2917151738
Opcode ID: ed0f017fb9f1c72d5ecd59e7eb977a083be389eabba2a71844a2c1c90fa6bb97
Instruction ID: 1d30539fe541d8d7afda19785d02276d9fe71e21c5c2b6a230fa847051dbcd18
Opcode Fuzzy Hash: ed0f017fb9f1c72d5ecd59e7eb977a083be389eabba2a71844a2c1c90fa6bb97
Instruction Fuzzy Hash: 83226B70A002199FDB14DF69D864BAEBBBAFFC9304F189469E5059B394DB34AC41CB90

Function 02EAB388 Relevance: 2.8, Strings: 2, Instructions: 349COMMON

Download Yara Rule

Strings

PHq, xrefs: 02EAB7A7
PHq, xrefs: 02EAB7B8

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: a18ea223c0b8594875e3836cae494036a03a63d995bb366d181b2e56fd7471a4
Instruction ID: 4f49363550a0eb8ac7a8d3f08b01df380fc7c1e3ebc76abacc96605c36a3f601
Opcode Fuzzy Hash: a18ea223c0b8594875e3836cae494036a03a63d995bb366d181b2e56fd7471a4
Instruction Fuzzy Hash: FFE1E675A40218CFDB14DFA9C994A9DBBB2FF98318F15D069E819AF361DB30A841CF50

Function 02EAC7B2 Relevance: 2.7, Strings: 2, Instructions: 191COMMON

Download Yara Rule

Strings

PHq, xrefs: 02EACA18
PHq, xrefs: 02EACA07

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: e348a1d6e0cb77c9407ae4a23d610f825d391aa54d86d776d04d0cb741bcde5d
Instruction ID: 6d77f7f7a4c269ef9e3c942b46ad642961985d30a72d470effab2e504dd14340
Opcode Fuzzy Hash: e348a1d6e0cb77c9407ae4a23d610f825d391aa54d86d776d04d0cb741bcde5d
Instruction Fuzzy Hash: 54819474E002189FDB14DFA9D994B9DBBF2BF88314F24E06AE409AB365DB709941CF50

Function 02EAC1F0 Relevance: 2.7, Strings: 2, Instructions: 189COMMON

Download Yara Rule

Strings

PHq, xrefs: 02EAC447
PHq, xrefs: 02EAC458

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 051268b70e0317d47f17b376b8f22ab7627c6363054dcb5eb0315297f2d23320
Instruction ID: 4cae0b9ae523c424e0a5d7588f0c4df911205e7ccf1a3e0cae44d1abaf5249a3
Opcode Fuzzy Hash: 051268b70e0317d47f17b376b8f22ab7627c6363054dcb5eb0315297f2d23320
Instruction Fuzzy Hash: 8A91D974E00218CFDB14DFA9D994A9DBBF2BF88304F24E06AE409AB355DB709945CF54

Function 02EACA92 Relevance: 2.7, Strings: 2, Instructions: 189COMMON

Download Yara Rule

Strings

PHq, xrefs: 02EACCE7
PHq, xrefs: 02EACCF8

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 5bc35c22830d1894bba6d4053475b291a6bd0c4c5065602a2206ad5d6362b7ac
Instruction ID: 4f40d037b5df16ba2e1e3680530117998c780cd4fdbc1142bbc543b80f05b922
Opcode Fuzzy Hash: 5bc35c22830d1894bba6d4053475b291a6bd0c4c5065602a2206ad5d6362b7ac
Instruction Fuzzy Hash: 9881D974E01218DFDB14DFA9D894A9DBBF2BF88304F24E06AD819AB365DB709841CF50

Function 02EAC4D0 Relevance: 2.7, Strings: 2, Instructions: 186COMMON

Download Yara Rule

Strings

PHq, xrefs: 02EAC727
PHq, xrefs: 02EAC738

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 23fa8afda09f05c96eb259ff63b14187f577512ec6094f3f5d28b995f3f7c1cb
Instruction ID: f2503b0e89267dae52d039f52c1fec5c0e8a0b464e99718be1e61f97b8d69427
Opcode Fuzzy Hash: 23fa8afda09f05c96eb259ff63b14187f577512ec6094f3f5d28b995f3f7c1cb
Instruction Fuzzy Hash: FE81B574E40218DFDB14DFA9D994A9DBBF2BF88304F24E06AE409AB365DB709941CF50

Function 02EABF10 Relevance: 2.7, Strings: 2, Instructions: 186COMMON

Download Yara Rule

Strings

PHq, xrefs: 02EAC167
PHq, xrefs: 02EAC178

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 544d607d4b6faf60900acfe77ead551cfb8bd8ff7f2a4ce8dbab0d7c1dac59cd
Instruction ID: 684ad7cc4ee07e166c3ba20819bd27420709f7448443ae23b045c1e39425c635
Opcode Fuzzy Hash: 544d607d4b6faf60900acfe77ead551cfb8bd8ff7f2a4ce8dbab0d7c1dac59cd
Instruction Fuzzy Hash: 2681B774E00218DFDB14DFA9D994A9DBBF2BF88304F24E06AE419AB355DB70A941CF50

Function 02EA4B31 Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

PHq, xrefs: 02EA4D99
PHq, xrefs: 02EA4D88

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 55cf59cffdc499c57f7334acad643cc5c356d50da21206d93c46e08db719c591
Instruction ID: 3385516c2128baa9684fabb881aefb699a090a885503702ecdfd05859394868e
Opcode Fuzzy Hash: 55cf59cffdc499c57f7334acad643cc5c356d50da21206d93c46e08db719c591
Instruction Fuzzy Hash: 5181B274E00218DFEB14DFA9D994A9DBBF2BF88304F14D069E819AB365DB70A941CF50

Function 02EABC32 Relevance: 2.7, Strings: 2, Instructions: 184COMMON

Download Yara Rule

Strings

PHq, xrefs: 02EABE98
PHq, xrefs: 02EABE87

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 814f5037cf1a058f8217b96444138d2aba50afc59b7e16db1cf2fc6f507a8121
Instruction ID: 649a3a65242bad1e83d160a34746853f7e1d997e0a967cc2729f97b9da6c716b
Opcode Fuzzy Hash: 814f5037cf1a058f8217b96444138d2aba50afc59b7e16db1cf2fc6f507a8121
Instruction Fuzzy Hash: 6B81A274E00218DFEB14DFAAD994A9DBBF2BF88304F14D069E409AB365DB70A941CF51

Function 02EAB552 Relevance: 2.7, Strings: 2, Instructions: 152COMMON

Download Yara Rule

Strings

PHq, xrefs: 02EAB7A7
PHq, xrefs: 02EAB7B8

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: b970fad31c00ae08da26d85c6ae4d2174971278b4ba9097e9aaf1e48485d22c9
Instruction ID: 24f4ba2e7e800579ba231a060499bab72ff7db69da010e2ac95ddd665c68dc73
Opcode Fuzzy Hash: b970fad31c00ae08da26d85c6ae4d2174971278b4ba9097e9aaf1e48485d22c9
Instruction Fuzzy Hash: ED61B674E002089FEB14DFAAD994A9EFBF2BF88304F14D069E419AB365DB745941CF50

Function 02EA6EC8 Relevance: 10.4, Strings: 8, Instructions: 450COMMON

Download Yara Rule

Strings

(oq, xrefs: 02EA6EF6
(oq, xrefs: 02EA73D7
(oq, xrefs: 02EA6FDD
(oq, xrefs: 02EA6FB1
,q, xrefs: 02EA7368
(oq, xrefs: 02EA707A
(oq, xrefs: 02EA73C7
,q, xrefs: 02EA7358

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID: (oq$(oq$(oq$(oq$(oq$(oq$,q$,q
API String ID: 0-2212926057
Opcode ID: 091e37a1f4f0f8140ca3197996fc145d5ec5197f42de4e79644e60ac87358d00
Instruction ID: e055e1ab8238609c7a521ebc63f08e5df3a90dba90e11abb13780f0c838c23b0
Opcode Fuzzy Hash: 091e37a1f4f0f8140ca3197996fc145d5ec5197f42de4e79644e60ac87358d00
Instruction Fuzzy Hash: 37123B30A402099FCB25CF69D894A9EBBF2FF89318F159569E8499F261D730FD41CB60

Function 02EA6EB8 Relevance: 5.3, Strings: 4, Instructions: 273COMMON

Download Yara Rule

Strings

(oq, xrefs: 02EA6EF6
(oq, xrefs: 02EA6FDD
(oq, xrefs: 02EA6FB1
(oq, xrefs: 02EA707A

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID: (oq$(oq$(oq$(oq
API String ID: 0-3853041632
Opcode ID: abe3d4bb64e4e4b3e3a77cf8246667ec94387cda7b8cc575d7a9967fd420e650
Instruction ID: fe189c477414c983be847a042e4d140e49ac1497ee04b247a7696944eba06ec0
Opcode Fuzzy Hash: abe3d4bb64e4e4b3e3a77cf8246667ec94387cda7b8cc575d7a9967fd420e650
Instruction Fuzzy Hash: D7C13A30A402099FCB14CF69D894AAEFBF2BF88318F15D559E855AB265D731FC41CBA0

Function 02EA7850 Relevance: 3.2, Strings: 2, Instructions: 690COMMON

Download Yara Rule

Strings

$q, xrefs: 02EA8397
$q, xrefs: 02EA8374

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID: $q$$q
API String ID: 0-3126353813
Opcode ID: 87abd582c7f13c1569b8745791ebdf6d71e3a96c2e6ee73dea480eb8fe7c78f6
Instruction ID: 402a8149dd30ba50d3739be6d31dbb037827cc710852c9236bff55604df568f3
Opcode Fuzzy Hash: 87abd582c7f13c1569b8745791ebdf6d71e3a96c2e6ee73dea480eb8fe7c78f6
Instruction Fuzzy Hash: 46520D74A002198FEB64DBA4C864BDEBB72EF84300F1081AEC10A6B7A5DF355E45DF65

Function 02EA5700 Relevance: 2.8, Strings: 2, Instructions: 323COMMON

Download Yara Rule

Strings

Hq, xrefs: 02EA581E
Hq, xrefs: 02EA57EB

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID: Hq$Hq
API String ID: 0-925789375
Opcode ID: c1deab3a9b92563e47835fb682b365f61c8a89a95aec7261f970cbbb76a7eddf
Instruction ID: e235a90d17da3be1832d44d686902e9a1914cf38ffb69ca5a7bd1f151fb399d3
Opcode Fuzzy Hash: c1deab3a9b92563e47835fb682b365f61c8a89a95aec7261f970cbbb76a7eddf
Instruction Fuzzy Hash: A0B1AF31B442159FDB259F24D8A4BAA7BA2BBC8358F599429E806CF390DF74EC01C791

Function 02EA8858 Relevance: 2.8, Strings: 2, Instructions: 322COMMON

Download Yara Rule

Strings

4'q, xrefs: 02EA8897
4'q, xrefs: 02EA8871

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID: 4'q$4'q
API String ID: 0-1467158625
Opcode ID: 6124b5536a4dda9e7ae05d6ef422dcadfed38c45b1e57e1f850df51a10679515
Instruction ID: b6249cf805cff4552ae83c6aed7787d04b7d9163f1d429dee5bf1926b68e897e
Opcode Fuzzy Hash: 6124b5536a4dda9e7ae05d6ef422dcadfed38c45b1e57e1f850df51a10679515
Instruction Fuzzy Hash: 95B184703822018FDB18DE29C579BB976A6EF84748F15A079E506CF3A1EF25EC41CB52

Function 02EA5C60 Relevance: 2.7, Strings: 2, Instructions: 230COMMON

Download Yara Rule

Strings

,q, xrefs: 02EA5D40
,q, xrefs: 02EA5D36

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID: ,q$,q
API String ID: 0-1667412543
Opcode ID: a6cf2c04aa999799a6807b749347f1132a2c15e8b54c10f297ada42afe08e5a5
Instruction ID: 023f6834cf770f0be498f84cfd664d73b1b3917a9e5bef4999b52c15eb60ccf7
Opcode Fuzzy Hash: a6cf2c04aa999799a6807b749347f1132a2c15e8b54c10f297ada42afe08e5a5
Instruction Fuzzy Hash: 0B818E34F40105CFCB14CF69C8A8AAAB7B2BF89208B95D069D406DF365DB31F841CB91

Function 02EA3480 Relevance: 2.6, Strings: 2, Instructions: 112COMMON

Download Yara Rule

Strings

Xq, xrefs: 02EA348D
Xq, xrefs: 02EA34B6

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID: Xq$Xq
API String ID: 0-1556399337
Opcode ID: 6b015008ed608b5b1b1ee400c3f948f4b0af9d137cff3974051eb4a0baa4bb6d
Instruction ID: e5d9a0e884935977baacb5d7bca03e1e576139f12c02b36363118d060a9037f9
Opcode Fuzzy Hash: 6b015008ed608b5b1b1ee400c3f948f4b0af9d137cff3974051eb4a0baa4bb6d
Instruction Fuzzy Hash: BF31D731B403254BDB2956A998753BE77EAABC4215F18907DE806CB380DFB4DC05C6A1

Function 02EA0C8F Relevance: 1.7, Strings: 1, Instructions: 418COMMON

Download Yara Rule

Strings

LRq, xrefs: 02EA0E80

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: 4108c1fa0d53b5f9b9acb5996159ba11b9f1498a729e66ae2bfa706a44aec658
Instruction ID: 12e343fabfdfe7c9b654510b8c015b5cda28ce3a3d56d354731f4aa1f51fd6b3
Opcode Fuzzy Hash: 4108c1fa0d53b5f9b9acb5996159ba11b9f1498a729e66ae2bfa706a44aec658
Instruction Fuzzy Hash: 4522A978910219DFCB94EF64E895ADDBBB2FF88301F1095A6E409AB358EB306D45CF50

Function 02EA0CA0 Relevance: 1.7, Strings: 1, Instructions: 410COMMON

Download Yara Rule

Strings

LRq, xrefs: 02EA0E80

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: 40237dda060e81600756ff2f6d99d63d5f1f41dee0fc974587d14bf1137b49ea
Instruction ID: 185d29fcad2654b49b95e59435973ce4f9cc2292d713d97b37ba2f052d577445
Opcode Fuzzy Hash: 40237dda060e81600756ff2f6d99d63d5f1f41dee0fc974587d14bf1137b49ea
Instruction Fuzzy Hash: 2D22AA78910219DFCB94EF64E894ADDBBB6FF88301F1095A6E409AB358EB305D45CF50

Function 02EAA6C0 Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

(oq, xrefs: 02EAA839

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID: (oq
API String ID: 0-1999159160
Opcode ID: fb751ddf26ffd5c84562855822fa820eae7d133c7e4d389cff31c6b7263dc172
Instruction ID: 3507d1bf75108360e667c6200a22d4c0f243070f320a7faa84b75a52eca4f023
Opcode Fuzzy Hash: fb751ddf26ffd5c84562855822fa820eae7d133c7e4d389cff31c6b7263dc172
Instruction Fuzzy Hash: A741AF35B102049FDB189B69D9696AE7BF7BFC8611F148469E506DB390DF31AC02CB90

Function 02EAA878 Relevance: .4, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f1f20c6aac4d9b8c072bbbbbd9286c020ad2f78bd66bd0ec3507ea13e2835be
Instruction ID: 59347d7f7dd808d5d3108c0dcc0b0642ca4047e33e3d1fbfb3a3a199672b15e6
Opcode Fuzzy Hash: 8f1f20c6aac4d9b8c072bbbbbd9286c020ad2f78bd66bd0ec3507ea13e2835be
Instruction Fuzzy Hash: CBF14D71A806158FDB04DF69C998A9DBBF2FF88314B16D0A9E419AF361CB35EC41CB50

Function 02EA7498 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6669a7c06a2aac04b1e148aa6353b26b98f6698dc0fe0dcdce394bbe34d5c728
Instruction ID: 74a9e11b2b7e0d15705a752c29a3ec21087c948213a3994695d1ea9718364492
Opcode Fuzzy Hash: 6669a7c06a2aac04b1e148aa6353b26b98f6698dc0fe0dcdce394bbe34d5c728
Instruction Fuzzy Hash: FB710B347402058FCB14DF2DC8A8BADBBE6AF89659B1994A5E805CF3B1DB70EC41CB51

Function 02EAD3C2 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4046ee8fc53ad7ce4f54db55efa8e38d4c9ee6aa6322cc23f2c3d84ed1b409a
Instruction ID: 50ef01852154a7ac55157bcae1b4984d0c3a300056c94eb15981a6f8e9fb086a
Opcode Fuzzy Hash: d4046ee8fc53ad7ce4f54db55efa8e38d4c9ee6aa6322cc23f2c3d84ed1b409a
Instruction Fuzzy Hash: 8B51A4789323969FD3987F20A9AE1AABF60FB9F3177457D24B05F865089F301055CB60

Function 02EAD3D0 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f7b95fff7cbf7449b02082e0c8576e775f89f7f3d6097fecc1019c536d1f63a
Instruction ID: 583a9768320a36621d9920bbc1314423f46db774631b615bb67ec0301c5afb6c
Opcode Fuzzy Hash: 2f7b95fff7cbf7449b02082e0c8576e775f89f7f3d6097fecc1019c536d1f63a
Instruction Fuzzy Hash: EE5192789323968F93987F20A9AE1BABFA4FB9F3177457D24B15F865089F301054CB60

Function 02EA3951 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24517be821a3004e19a00d0d5cf7aca137a1fa4f70632be8ba7d3b06f0583ba6
Instruction ID: 5c789696c3c82ceae03b3cbbaabda3c9dc4413c3cdd43f8b2aece494e9e8130a
Opcode Fuzzy Hash: 24517be821a3004e19a00d0d5cf7aca137a1fa4f70632be8ba7d3b06f0583ba6
Instruction Fuzzy Hash: 74518274E01208DFCB18EFA9D59499DBBB2FF89300B209469E809AB364DB35AD41CF50

Function 02EACD70 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fe75b2be7dc958b752d54d7d3a943207cbadc64d98f1a9d3edce4389cc877cd
Instruction ID: 1f74b786e389c12e1cbcdc8abf4b3d6bce3a8713354598a9e4ee33643cee9635
Opcode Fuzzy Hash: 4fe75b2be7dc958b752d54d7d3a943207cbadc64d98f1a9d3edce4389cc877cd
Instruction Fuzzy Hash: 15519474E01208DFDB44DFA9D994A9DBBF2FF89300F24916AE419AB364DB31A901CF54

Function 02EA3960 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30e57c0977fcc3a773106c4b8c80c626f37e7e213b5fe01c07f01f405ad87ef9
Instruction ID: c9645306ae0d86dde3640419bbd2dcef055b2b8bead2e44adf47e58ebd868249
Opcode Fuzzy Hash: 30e57c0977fcc3a773106c4b8c80c626f37e7e213b5fe01c07f01f405ad87ef9
Instruction Fuzzy Hash: 2D517274E01308DFDB08EFA9D59499DBBB6FF89310B209469E809AB364DB35AD41CF50

Function 02EA9AC3 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 962d61fd5750e76835031db7d52a246dcb927497520297461163fa743c742dac
Instruction ID: 568a9b7b257cc68385c3ad9a2ca899e2e4c1ef5f53f447494ec6666395755418
Opcode Fuzzy Hash: 962d61fd5750e76835031db7d52a246dcb927497520297461163fa743c742dac
Instruction Fuzzy Hash: 7C417931A44249DFCF15CFA9C8A4BDEBBB2EF89314F009156E815AF296D335E910CB94

Function 02EA4E20 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e90c7c35249e5c3a94abd17769f76409fa8a3e34593bc1bcd43baa40527ec42
Instruction ID: 7d585244624cb2fe0f5882071b6ee337ac741f1694455ed5dcb81514fae22edf
Opcode Fuzzy Hash: 9e90c7c35249e5c3a94abd17769f76409fa8a3e34593bc1bcd43baa40527ec42
Instruction Fuzzy Hash: AA316D3560410AAFCB459F65D894AAF3FA7FB88205F009069F9198F294CB75DC61CBA0

Function 02EAD70F Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34c301b820d51478d6f4ee8ef095e5df9a68830f54e7679878e809405e1e91f4
Instruction ID: 006e0e0eaa490b61817e29f1a3c49a37ffd1256b241c48f4b6b78023f4a40e8b
Opcode Fuzzy Hash: 34c301b820d51478d6f4ee8ef095e5df9a68830f54e7679878e809405e1e91f4
Instruction Fuzzy Hash: 2D314675D412088FCF08EFB8E855AEEBBB1FB8A305F10A53AD40577290DB39A945CB54

Function 02EA7730 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a45e05a298be1b31c1db3587183a8e4e8bc1f356983d49a3b401aff345fb63ed
Instruction ID: 9149f791a2bf941140de772bce7da401c2b0309a4fef9f0c30022039a863cf7d
Opcode Fuzzy Hash: a45e05a298be1b31c1db3587183a8e4e8bc1f356983d49a3b401aff345fb63ed
Instruction Fuzzy Hash: FE2128317402204BDB25963998A5BBDAA96AFC461DB18D039E806CF384EF35EC42D7C0

Function 02EA7740 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 882e5f8e5bf16301d39917e924e5b3105e25bc5c62df654d7f9ee4e779c69808
Instruction ID: e49a39d69d8198a74be7fd6e1e6b0364cc5b9e4be9bdcc0740132cf59b78c09c
Opcode Fuzzy Hash: 882e5f8e5bf16301d39917e924e5b3105e25bc5c62df654d7f9ee4e779c69808
Instruction Fuzzy Hash: E321C5317802204BDB19963A98A47BEAA97AFC865DF14D039E806CF794DF35EC42D790

Function 02EAA869 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8089a7a639ffe673b268c80845bac7817c484ccf1a383858115650b5ffe6c074
Instruction ID: 60ff37697ab56f5135eaf5bba294fd7ded75b29b828efaf2daeccafd4bcb8d4a
Opcode Fuzzy Hash: 8089a7a639ffe673b268c80845bac7817c484ccf1a383858115650b5ffe6c074
Instruction Fuzzy Hash: D2319170A406058FCB04CF69C894AAEBBB3FFC8714B15C169E515AB3A5DB35EC02CB90

Function 02EA20B8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe8e8d1b061d5a666a0b76b0aa55808eda9538a3d24aafdd02ac09798d16adb9
Instruction ID: 67019fd52d305abb5ced4a9b7694775115fbe14542ff3a8574a7f04039ce95b9
Opcode Fuzzy Hash: fe8e8d1b061d5a666a0b76b0aa55808eda9538a3d24aafdd02ac09798d16adb9
Instruction Fuzzy Hash: 8621C775A00205AFCB14DB28C850AAE3BA5EB99354F51C519DD099F258EB31FE46CB90

Function 02EAD611 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8c0a875b907ae37bd883b24316a62aff28435b174b2946e408157992646de8d
Instruction ID: 62fe98da3c2c7fe19a1d5286376fa771d22e037e4dbcf49b1c4aeda27ec57831
Opcode Fuzzy Hash: f8c0a875b907ae37bd883b24316a62aff28435b174b2946e408157992646de8d
Instruction Fuzzy Hash: 42212731C10619DECF11EFA8D8546ECFBB4FF4A305F11962AD404B7254EB34AA9ACB40

Function 02EA5AC8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b14e964c1a729287164dd12f2950b1f9157c840dc4f44c20eb5d129003c40ff
Instruction ID: 17b902fb916cf5fb366452c4458662139729cc5ccabed9d01c0fd8c17bcf0cbb
Opcode Fuzzy Hash: 3b14e964c1a729287164dd12f2950b1f9157c840dc4f44c20eb5d129003c40ff
Instruction Fuzzy Hash: A421C335B416118FC7299B69D8B466ABBA2FFC87567448169E906CF354CF30EC02CBC0

Function 02EA4E11 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0329b62b078a6179b5b8e1d82336e3615f23fa8e322a9cf204108f79a2ad050a
Instruction ID: 1d11d0c01fb87c720b43810e32d1e9dd7a89956dbee1e4467449fc4beee5ddaa
Opcode Fuzzy Hash: 0329b62b078a6179b5b8e1d82336e3615f23fa8e322a9cf204108f79a2ad050a
Instruction Fuzzy Hash: 1E2193356441099FCB54AF64D8657AB3BA6FBC8314F508469F9058F384CB74DC55CBE0

Function 02EAD720 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 798f38e975cbdf63d59b4f0594f12a033d9e1dab598a30110b01b9b959068167
Instruction ID: 7663fb901dbdf990a1a3b28065b7db49920d25c8935d02dca40cf50ad2306aea
Opcode Fuzzy Hash: 798f38e975cbdf63d59b4f0594f12a033d9e1dab598a30110b01b9b959068167
Instruction Fuzzy Hash: 5121D6749012098BCF18DFB4D951AEEBBB2FB89301F10A439D40577354DB3AAD41CB65

Function 02EA5AB8 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa83f4173220685aeb17bff84634de2270982436d26f5de9db2e3773f9249bb6
Instruction ID: 1b24e1b115431d737808734c220ef20dd2e8ec4afb9326a0da38a63e3df0f6f8
Opcode Fuzzy Hash: aa83f4173220685aeb17bff84634de2270982436d26f5de9db2e3773f9249bb6
Instruction Fuzzy Hash: 66110631B01A118FC7199A2AD8B466EBBA6FFC465574980A9E406CF350CF20EC02C7C0

Function 02EAA6B0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a6a1702ac077539be342d5df462f3a9594858a40791d62a9a6f2b564e8aca19
Instruction ID: 45dfc6841a287efb10c1e2bfefd06ecabbd33d7075179921b4d5d5575c11fb88
Opcode Fuzzy Hash: 4a6a1702ac077539be342d5df462f3a9594858a40791d62a9a6f2b564e8aca19
Instruction Fuzzy Hash: 65113D36B102089BDB148F69D959BEEBBB6BB8C221F148165F511A7390DB71AC10CB90

Function 02EA1FB8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f092548958059903aeaca3d08acb93c068d450f14c682bfb706c18c9560e5b5e
Instruction ID: f483ba666cf84714cbcb9fbe04269a228a1658d629f1d56c1ae1b29e923ea76b
Opcode Fuzzy Hash: f092548958059903aeaca3d08acb93c068d450f14c682bfb706c18c9560e5b5e
Instruction Fuzzy Hash: C921A274C1060D8FCB84EFA9D9556EEBFF1FB49300F10526AE905B6214EB305A85CFA5

Function 02EA5670 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33df56b5288d47788e2165d110ac159c50194519090fb895154b6756130154a1
Instruction ID: 5b1ddb630b85909edbcaf98312e261c0c5ccafa0262b0d0b19cbca26650b1d05
Opcode Fuzzy Hash: 33df56b5288d47788e2165d110ac159c50194519090fb895154b6756130154a1
Instruction Fuzzy Hash: C801D672B001196B8B459E599814AEF7FABDBC8662B54C02AF605DB340DF71DC11CBA0

Function 02EA565F Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd763bb69e48b50342eff78593fef65b42c119f5d64e58592b20f56dcc191e3e
Instruction ID: 9130318b0314f2785812494d3d417693eb3b15e2ffbcc5cd410c180d62191f62
Opcode Fuzzy Hash: dd763bb69e48b50342eff78593fef65b42c119f5d64e58592b20f56dcc191e3e
Instruction Fuzzy Hash: 1E01DB32A042096FCB068E559C14ADF7FB6EFC9351B15C06AF514CB240DB35D811CBA1

Function 02EA2068 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86099f2191e6a12a8c7bf8fcbb8c50457ad2c257948b28baee5bcd8a12875d4c
Instruction ID: 9d5eb3c13df66f8774ce7b1bd887412e28521355816ed05332c5a428655f2a1b
Opcode Fuzzy Hash: 86099f2191e6a12a8c7bf8fcbb8c50457ad2c257948b28baee5bcd8a12875d4c
Instruction Fuzzy Hash: 68E08636D2062D53C710A7A5DC156FEBF38EFC1222F954726D810B7144EB71665C82B5

Function 02EA2078 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78b0f1583a6c16bd227ef2947ece468b307561d1da0057e1caa1ee5e837a9114
Instruction ID: 57fcb7b713a7cc3cda5ba3b18cc872e01c18247b14ea8750140405754ef26a03
Opcode Fuzzy Hash: 78b0f1583a6c16bd227ef2947ece468b307561d1da0057e1caa1ee5e837a9114
Instruction Fuzzy Hash: 84D02B31D2032A43CB00E7A5DC044EFFB38EEC1322B918322D41033000FB312658C2E1

Function 02EA82B8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: 66c27518a2e46619ec344eca29910282735d7e78fda9e05fac5c77f4056c513e
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: 3EC08C7328C1282EA234A08F7C54EF3BB8CC3C13B8A214137F95CEB301A842AC8041F4

Function 02EAA76D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b97cf391407cd93757431c943665a80df660a9d96b25afbe881129510f9ae808
Instruction ID: ef726864141f3bbbc42583335c37e523fbc34b2bf35f28be2c4a64631737d377
Opcode Fuzzy Hash: b97cf391407cd93757431c943665a80df660a9d96b25afbe881129510f9ae808
Instruction Fuzzy Hash: 3BD0677AB110089FDB049F99E8419DDBBB6FBDC221B548116F915A3264C6319921DB90

Function 02EA5F00 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8b8b0fb136d1f11bbadd807ab82b677b00c32360cda7d6b45831c94d5cedd52
Instruction ID: f3d5e0d2508c21f486dfc0b3fbcf1f162105f2080cd0c9319421b05c7375bb36
Opcode Fuzzy Hash: e8b8b0fb136d1f11bbadd807ab82b677b00c32360cda7d6b45831c94d5cedd52
Instruction Fuzzy Hash: 6AD0973DC1C30407D322F730FE620803B32BAC0409BC808DAA6000EB1AE738480E4776

Function 02EA5F10 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf197420084989ec45f5d3972d12c7dbb0f04d49b3fcc9fb6932789161c53ac5
Instruction ID: 3b50ea44d40d809839a7488b731055a85a8889d59597daa87bdd368fb14bdc68
Opcode Fuzzy Hash: bf197420084989ec45f5d3972d12c7dbb0f04d49b3fcc9fb6932789161c53ac5
Instruction Fuzzy Hash: BBC0123491830E47D555F771F955595376BB6C0510F404910B2090D619DF78584A4AB6

Non-executed Functions

Function 02EA21A8 Relevance: 5.2, Strings: 4, Instructions: 196COMMON

Download Yara Rule

Strings

Xq, xrefs: 02EA231F
Xq, xrefs: 02EA22A0
Xq, xrefs: 02EA236C
Xq, xrefs: 02EA2266

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID: Xq$Xq$Xq$Xq
API String ID: 0-3965792415
Opcode ID: f65048ecfcc6cadee3362e4301fa3165b46b41c6deaf935c6c73e5cba7de2d91
Instruction ID: 8aced7137e4f018d423869b8233c75e36529786be2fb8e079eb63272a984c9e0
Opcode Fuzzy Hash: f65048ecfcc6cadee3362e4301fa3165b46b41c6deaf935c6c73e5cba7de2d91
Instruction Fuzzy Hash: 0171D330E4031A8FDF659BA4C8603EEBBB5BF89304F14D56AD919BB240DB309D45CBA1

Function 02EA60E8 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;q, xrefs: 02EA60FE
\;q, xrefs: 02EA60F4
\;q, xrefs: 02EA6126
\;q, xrefs: 02EA611A

Memory Dump Source

Source File: 00000002.00000002.1486806886.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ea0000_JgRVqrgNs4.jbxd

Similarity

API ID:
String ID: \;q$\;q$\;q$\;q
API String ID: 0-2933265366
Opcode ID: 3bc779a09e8954460da4abffd058b2cd9ec687f2e4b3f888fb07dff8920bafcb
Instruction ID: 7b809d630ebf144bb799fe72364c7c3bedf6e766fa4a4c832cf1a18314bc720b
Opcode Fuzzy Hash: 3bc779a09e8954460da4abffd058b2cd9ec687f2e4b3f888fb07dff8920bafcb
Instruction Fuzzy Hash: 60017531F801158FCF249A2DC464A557BEAAF9666871D9169E40ACF372DA31EC42C7A0

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report JgRVqrgNs4.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\JgRVqrgNs4.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
JgRVqrgNs4.exe

Function 01A5A690 Relevance: 1.7, APIs: 1, Instructions: 194
COMMON

Function 01A5CB58 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 01A5BDE0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 01A5A100 Relevance: 1.6, APIs: 1, Instructions: 62
libraryCOMMON

Function 01A5AB00 Relevance: 1.6, APIs: 1, Instructions: 56
libraryCOMMON

Function 01A5A118 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Function 064E2364 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Function 064E3030 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Function 01A5A880 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 064EAC20 Relevance: 1.5, APIs: 1, Instructions: 47
windowCOMMON

Function 064E8BF4 Relevance: 1.5, APIs: 1, Instructions: 47
windowCOMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre