Edit tour

Windows Analysis Report
7vwfhMuUQg.exe

Overview

General Information

Sample name:	7vwfhMuUQg.exe renamed because original name is a hash value
Original sample name:	e2b79e37d4a34bcab883b0de55809ab1be398fee99cde2fcb0058bac413192f7.exe
Analysis ID:	1467009
MD5:	87c41e117d5bf575fc5bd9dd9386e2aa
SHA1:	1ab94afc06ca89c564f43141281051aae9494086
SHA256:	e2b79e37d4a34bcab883b0de55809ab1be398fee99cde2fcb0058bac413192f7
Tags:	exeSnakeKeylogger
Infos:

Detection

Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Snake Keylogger

.NET source code references suspicious native API functions

AI detected suspicious sample

Injects a PE file into a foreign processes

Machine Learning detection for sample

Self deletion via cmd or bat file

Tries to detect the country of the analysis system (by using the IP)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

7vwfhMuUQg.exe (PID: 5824 cmdline: "C:\Users\user\Desktop\7vwfhMuUQg.exe" MD5: 87C41E117D5BF575FC5BD9DD9386E2AA)

7vwfhMuUQg.exe (PID: 6600 cmdline: "C:\Users\user\Desktop\7vwfhMuUQg.exe" MD5: 87C41E117D5BF575FC5BD9DD9386E2AA)

cmd.exe (PID: 2740 cmdline: "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\7vwfhMuUQg.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

choice.exe (PID: 5020 cmdline: choice /C Y /N /D Y /T 3 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-usering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "leftlutvar@valleycountysar.org", "Password": "DKw(r0%wpbd]", "Host": "mail.valleycountysar.org", "Port": "587"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.3957028997.0000000000532000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.3957028997.0000000000532000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000002.00000002.3957028997.0000000000532000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14807:$a1: get_encryptedPassword 0x14afd:$a2: get_encryptedUsername 0x14613:$a3: get_timePasswordChanged 0x1470e:$a4: get_passwordField 0x1481d:$a5: set_encryptedPassword 0x15df9:$a7: get_logins 0x15d5c:$a10: KeyLoggerEventArgs 0x159f5:$a11: KeyLoggerEventArgsEventHandler
00000002.00000002.3957028997.0000000000532000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x180e4:$x1: $%SMTPDV$ 0x1814a:$x2: $#TheHashHere%& 0x1978b:$x3: %FTPDV$ 0x1987f:$x4: $%TelegramDv$ 0x159f5:$x5: KeyLoggerEventArgs 0x15d5c:$x5: KeyLoggerEventArgs 0x197af:$m2: Clipboard Logs ID 0x1997b:$m2: Screenshot Logs ID 0x19a47:$m2: keystroke Logs ID 0x19953:$m4: \SnakeKeylogger\
00000000.00000002.2110119938.0000000003889000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2110119938.0000000003889000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.2110119938.0000000003889000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf3017:$a1: get_encryptedPassword 0x113847:$a1: get_encryptedPassword 0x133e67:$a1: get_encryptedPassword 0xf330d:$a2: get_encryptedUsername 0x113b3d:$a2: get_encryptedUsername 0x13415d:$a2: get_encryptedUsername 0xf2e23:$a3: get_timePasswordChanged 0x113653:$a3: get_timePasswordChanged 0x133c73:$a3: get_timePasswordChanged 0xf2f1e:$a4: get_passwordField 0x11374e:$a4: get_passwordField 0x133d6e:$a4: get_passwordField 0xf302d:$a5: set_encryptedPassword 0x11385d:$a5: set_encryptedPassword 0x133e7d:$a5: set_encryptedPassword 0xf4609:$a7: get_logins 0x114e39:$a7: get_logins 0x135459:$a7: get_logins 0xf456c:$a10: KeyLoggerEventArgs 0x114d9c:$a10: KeyLoggerEventArgs 0x1353bc:$a10: KeyLoggerEventArgs
00000000.00000002.2110119938.0000000003889000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xf68f4:$x1: $%SMTPDV$ 0x117124:$x1: $%SMTPDV$ 0x137744:$x1: $%SMTPDV$ 0xf695a:$x2: $#TheHashHere%& 0x11718a:$x2: $#TheHashHere%& 0x1377aa:$x2: $#TheHashHere%& 0xf7f9b:$x3: %FTPDV$ 0x1187cb:$x3: %FTPDV$ 0x138deb:$x3: %FTPDV$ 0xf808f:$x4: $%TelegramDv$ 0x1188bf:$x4: $%TelegramDv$ 0x138edf:$x4: $%TelegramDv$ 0xf4205:$x5: KeyLoggerEventArgs 0xf456c:$x5: KeyLoggerEventArgs 0x114a35:$x5: KeyLoggerEventArgs 0x114d9c:$x5: KeyLoggerEventArgs 0x135055:$x5: KeyLoggerEventArgs 0x1353bc:$x5: KeyLoggerEventArgs 0xf7fbf:$m2: Clipboard Logs ID 0xf818b:$m2: Screenshot Logs ID 0xf8257:$m2: keystroke Logs ID
00000002.00000002.3958557701.0000000002591000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: 7vwfhMuUQg.exe PID: 5824	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 7vwfhMuUQg.exe PID: 5824	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: 7vwfhMuUQg.exe PID: 5824	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d99f:$a1: get_encryptedPassword 0x2dbf4:$a2: get_encryptedUsername 0x2d7ce:$a3: get_timePasswordChanged 0x2d8b0:$a4: get_passwordField 0x2d9b5:$a5: set_encryptedPassword 0x2f7c9:$a7: get_logins 0x2f74a:$a10: KeyLoggerEventArgs 0x2f4e6:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: 7vwfhMuUQg.exe PID: 5824	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x2f4e6:$x5: KeyLoggerEventArgs 0x2f74a:$x5: KeyLoggerEventArgs 0x2ff75:$x5: KeyLoggerEventArgs 0x302a9:$x5: KeyLoggerEventArgs 0x31821:$m2: Clipboard Logs ID 0x31901:$m2: Screenshot Logs ID 0x31935:$m2: keystroke Logs ID 0x318ed:$m4: \SnakeKeylogger\
Process Memory Space: 7vwfhMuUQg.exe PID: 6600	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 7vwfhMuUQg.exe PID: 6600	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: 7vwfhMuUQg.exe PID: 6600	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2c34:$a1: get_encryptedPassword 0x2f20:$a2: get_encryptedUsername 0x2a4a:$a3: get_timePasswordChanged 0x2b45:$a4: get_passwordField 0x2c4a:$a5: set_encryptedPassword 0x5065:$a7: get_logins 0x4fc8:$a10: KeyLoggerEventArgs 0x4c61:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: 7vwfhMuUQg.exe PID: 6600	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x4c61:$x5: KeyLoggerEventArgs 0x4fc8:$x5: KeyLoggerEventArgs 0x58b6:$x5: KeyLoggerEventArgs 0x5bea:$x5: KeyLoggerEventArgs 0x71ea:$m2: Clipboard Logs ID 0x72ca:$m2: Screenshot Logs ID 0x72fe:$m2: keystroke Logs ID 0x72b6:$m4: \SnakeKeylogger\
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.7vwfhMuUQg.exe.3987e40.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.7vwfhMuUQg.exe.3987e40.4.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.7vwfhMuUQg.exe.3987e40.4.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12c07:$a1: get_encryptedPassword 0x12efd:$a2: get_encryptedUsername 0x12a13:$a3: get_timePasswordChanged 0x12b0e:$a4: get_passwordField 0x12c1d:$a5: set_encryptedPassword 0x141f9:$a7: get_logins 0x1415c:$a10: KeyLoggerEventArgs 0x13df5:$a11: KeyLoggerEventArgsEventHandler
0.2.7vwfhMuUQg.exe.3987e40.4.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a46b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1969d:$a3: \Google\Chrome\User Data\Default\Login Data 0x19ad0:$a4: \Orbitum\User Data\Default\Login Data 0x1ab0f:$a5: \Kometa\User Data\Default\Login Data
0.2.7vwfhMuUQg.exe.3987e40.4.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x13791:$s1: UnHook 0x13798:$s2: SetHook 0x137a0:$s3: CallNextHook 0x137ad:$s4: _hook
0.2.7vwfhMuUQg.exe.3987e40.4.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x164e4:$x1: $%SMTPDV$ 0x1654a:$x2: $#TheHashHere%& 0x17b8b:$x3: %FTPDV$ 0x17c7f:$x4: $%TelegramDv$ 0x13df5:$x5: KeyLoggerEventArgs 0x1415c:$x5: KeyLoggerEventArgs 0x17baf:$m2: Clipboard Logs ID 0x17d7b:$m2: Screenshot Logs ID 0x17e47:$m2: keystroke Logs ID 0x17d53:$m4: \SnakeKeylogger\
2.2.7vwfhMuUQg.exe.530000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.7vwfhMuUQg.exe.530000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.2.7vwfhMuUQg.exe.530000.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
2.2.7vwfhMuUQg.exe.530000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14a07:$a1: get_encryptedPassword 0x14cfd:$a2: get_encryptedUsername 0x14813:$a3: get_timePasswordChanged 0x1490e:$a4: get_passwordField 0x14a1d:$a5: set_encryptedPassword 0x15ff9:$a7: get_logins 0x15f5c:$a10: KeyLoggerEventArgs 0x15bf5:$a11: KeyLoggerEventArgsEventHandler
2.2.7vwfhMuUQg.exe.530000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c26b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b49d:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b8d0:$a4: \Orbitum\User Data\Default\Login Data 0x1c90f:$a5: \Kometa\User Data\Default\Login Data
2.2.7vwfhMuUQg.exe.530000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x15591:$s1: UnHook 0x15598:$s2: SetHook 0x155a0:$s3: CallNextHook 0x155ad:$s4: _hook
2.2.7vwfhMuUQg.exe.530000.0.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x182e4:$x1: $%SMTPDV$ 0x1834a:$x2: $#TheHashHere%& 0x1998b:$x3: %FTPDV$ 0x19a7f:$x4: $%TelegramDv$ 0x15bf5:$x5: KeyLoggerEventArgs 0x15f5c:$x5: KeyLoggerEventArgs 0x199af:$m2: Clipboard Logs ID 0x19b7b:$m2: Screenshot Logs ID 0x19c47:$m2: keystroke Logs ID 0x19b53:$m4: \SnakeKeylogger\
0.2.7vwfhMuUQg.exe.3967610.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.7vwfhMuUQg.exe.3967610.3.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.7vwfhMuUQg.exe.3967610.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12c07:$a1: get_encryptedPassword 0x12efd:$a2: get_encryptedUsername 0x12a13:$a3: get_timePasswordChanged 0x12b0e:$a4: get_passwordField 0x12c1d:$a5: set_encryptedPassword 0x141f9:$a7: get_logins 0x1415c:$a10: KeyLoggerEventArgs 0x13df5:$a11: KeyLoggerEventArgsEventHandler
0.2.7vwfhMuUQg.exe.3967610.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a46b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1969d:$a3: \Google\Chrome\User Data\Default\Login Data 0x19ad0:$a4: \Orbitum\User Data\Default\Login Data 0x1ab0f:$a5: \Kometa\User Data\Default\Login Data
0.2.7vwfhMuUQg.exe.3967610.3.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x13791:$s1: UnHook 0x13798:$s2: SetHook 0x137a0:$s3: CallNextHook 0x137ad:$s4: _hook
0.2.7vwfhMuUQg.exe.3967610.3.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x164e4:$x1: $%SMTPDV$ 0x1654a:$x2: $#TheHashHere%& 0x17b8b:$x3: %FTPDV$ 0x17c7f:$x4: $%TelegramDv$ 0x13df5:$x5: KeyLoggerEventArgs 0x1415c:$x5: KeyLoggerEventArgs 0x17baf:$m2: Clipboard Logs ID 0x17d7b:$m2: Screenshot Logs ID 0x17e47:$m2: keystroke Logs ID 0x17d53:$m4: \SnakeKeylogger\
0.2.7vwfhMuUQg.exe.3967610.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.7vwfhMuUQg.exe.3967610.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.7vwfhMuUQg.exe.3967610.3.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.7vwfhMuUQg.exe.3967610.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14a07:$a1: get_encryptedPassword 0x35237:$a1: get_encryptedPassword 0x55857:$a1: get_encryptedPassword 0x14cfd:$a2: get_encryptedUsername 0x3552d:$a2: get_encryptedUsername 0x55b4d:$a2: get_encryptedUsername 0x14813:$a3: get_timePasswordChanged 0x35043:$a3: get_timePasswordChanged 0x55663:$a3: get_timePasswordChanged 0x1490e:$a4: get_passwordField 0x3513e:$a4: get_passwordField 0x5575e:$a4: get_passwordField 0x14a1d:$a5: set_encryptedPassword 0x3524d:$a5: set_encryptedPassword 0x5586d:$a5: set_encryptedPassword 0x15ff9:$a7: get_logins 0x36829:$a7: get_logins 0x56e49:$a7: get_logins 0x15f5c:$a10: KeyLoggerEventArgs 0x3678c:$a10: KeyLoggerEventArgs 0x56dac:$a10: KeyLoggerEventArgs
0.2.7vwfhMuUQg.exe.3967610.3.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c26b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3ca9b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x5d0bb:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b49d:$a3: \Google\Chrome\User Data\Default\Login Data 0x3bccd:$a3: \Google\Chrome\User Data\Default\Login Data 0x5c2ed:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b8d0:$a4: \Orbitum\User Data\Default\Login Data 0x3c100:$a4: \Orbitum\User Data\Default\Login Data 0x5c720:$a4: \Orbitum\User Data\Default\Login Data 0x1c90f:$a5: \Kometa\User Data\Default\Login Data 0x3d13f:$a5: \Kometa\User Data\Default\Login Data 0x5d75f:$a5: \Kometa\User Data\Default\Login Data
0.2.7vwfhMuUQg.exe.3967610.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x15591:$s1: UnHook 0x35dc1:$s1: UnHook 0x563e1:$s1: UnHook 0x15598:$s2: SetHook 0x35dc8:$s2: SetHook 0x563e8:$s2: SetHook 0x155a0:$s3: CallNextHook 0x35dd0:$s3: CallNextHook 0x563f0:$s3: CallNextHook 0x155ad:$s4: _hook 0x35ddd:$s4: _hook 0x563fd:$s4: _hook
0.2.7vwfhMuUQg.exe.3967610.3.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x182e4:$x1: $%SMTPDV$ 0x38b14:$x1: $%SMTPDV$ 0x59134:$x1: $%SMTPDV$ 0x1834a:$x2: $#TheHashHere%& 0x38b7a:$x2: $#TheHashHere%& 0x5919a:$x2: $#TheHashHere%& 0x1998b:$x3: %FTPDV$ 0x3a1bb:$x3: %FTPDV$ 0x5a7db:$x3: %FTPDV$ 0x19a7f:$x4: $%TelegramDv$ 0x3a2af:$x4: $%TelegramDv$ 0x5a8cf:$x4: $%TelegramDv$ 0x15bf5:$x5: KeyLoggerEventArgs 0x15f5c:$x5: KeyLoggerEventArgs 0x36425:$x5: KeyLoggerEventArgs 0x3678c:$x5: KeyLoggerEventArgs 0x56a45:$x5: KeyLoggerEventArgs 0x56dac:$x5: KeyLoggerEventArgs 0x199af:$m2: Clipboard Logs ID 0x19b7b:$m2: Screenshot Logs ID 0x19c47:$m2: keystroke Logs ID
0.2.7vwfhMuUQg.exe.3987e40.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.7vwfhMuUQg.exe.3987e40.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.7vwfhMuUQg.exe.3987e40.4.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.7vwfhMuUQg.exe.3987e40.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14a07:$a1: get_encryptedPassword 0x35027:$a1: get_encryptedPassword 0x14cfd:$a2: get_encryptedUsername 0x3531d:$a2: get_encryptedUsername 0x14813:$a3: get_timePasswordChanged 0x34e33:$a3: get_timePasswordChanged 0x1490e:$a4: get_passwordField 0x34f2e:$a4: get_passwordField 0x14a1d:$a5: set_encryptedPassword 0x3503d:$a5: set_encryptedPassword 0x15ff9:$a7: get_logins 0x36619:$a7: get_logins 0x15f5c:$a10: KeyLoggerEventArgs 0x3657c:$a10: KeyLoggerEventArgs 0x15bf5:$a11: KeyLoggerEventArgsEventHandler 0x36215:$a11: KeyLoggerEventArgsEventHandler
0.2.7vwfhMuUQg.exe.3987e40.4.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c26b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3c88b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b49d:$a3: \Google\Chrome\User Data\Default\Login Data 0x3babd:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b8d0:$a4: \Orbitum\User Data\Default\Login Data 0x3bef0:$a4: \Orbitum\User Data\Default\Login Data 0x1c90f:$a5: \Kometa\User Data\Default\Login Data 0x3cf2f:$a5: \Kometa\User Data\Default\Login Data
0.2.7vwfhMuUQg.exe.3987e40.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x15591:$s1: UnHook 0x35bb1:$s1: UnHook 0x15598:$s2: SetHook 0x35bb8:$s2: SetHook 0x155a0:$s3: CallNextHook 0x35bc0:$s3: CallNextHook 0x155ad:$s4: _hook 0x35bcd:$s4: _hook
0.2.7vwfhMuUQg.exe.3987e40.4.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x182e4:$x1: $%SMTPDV$ 0x38904:$x1: $%SMTPDV$ 0x1834a:$x2: $#TheHashHere%& 0x3896a:$x2: $#TheHashHere%& 0x1998b:$x3: %FTPDV$ 0x39fab:$x3: %FTPDV$ 0x19a7f:$x4: $%TelegramDv$ 0x3a09f:$x4: $%TelegramDv$ 0x15bf5:$x5: KeyLoggerEventArgs 0x15f5c:$x5: KeyLoggerEventArgs 0x36215:$x5: KeyLoggerEventArgs 0x3657c:$x5: KeyLoggerEventArgs 0x199af:$m2: Clipboard Logs ID 0x19b7b:$m2: Screenshot Logs ID 0x19c47:$m2: keystroke Logs ID 0x39fcf:$m2: Clipboard Logs ID 0x3a19b:$m2: Screenshot Logs ID 0x3a267:$m2: keystroke Logs ID 0x19b53:$m4: \SnakeKeylogger\ 0x3a173:$m4: \SnakeKeylogger\
0.2.7vwfhMuUQg.exe.38d7b70.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.7vwfhMuUQg.exe.38d7b70.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.7vwfhMuUQg.exe.38d7b70.2.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.7vwfhMuUQg.exe.38d7b70.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xa44a7:$a1: get_encryptedPassword 0xc4cd7:$a1: get_encryptedPassword 0xe52f7:$a1: get_encryptedPassword 0xa479d:$a2: get_encryptedUsername 0xc4fcd:$a2: get_encryptedUsername 0xe55ed:$a2: get_encryptedUsername 0xa42b3:$a3: get_timePasswordChanged 0xc4ae3:$a3: get_timePasswordChanged 0xe5103:$a3: get_timePasswordChanged 0xa43ae:$a4: get_passwordField 0xc4bde:$a4: get_passwordField 0xe51fe:$a4: get_passwordField 0xa44bd:$a5: set_encryptedPassword 0xc4ced:$a5: set_encryptedPassword 0xe530d:$a5: set_encryptedPassword 0xa5a99:$a7: get_logins 0xc62c9:$a7: get_logins 0xe68e9:$a7: get_logins 0xa59fc:$a10: KeyLoggerEventArgs 0xc622c:$a10: KeyLoggerEventArgs 0xe684c:$a10: KeyLoggerEventArgs
0.2.7vwfhMuUQg.exe.38d7b70.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0xa5031:$s1: UnHook 0xc5861:$s1: UnHook 0xe5e81:$s1: UnHook 0xa5038:$s2: SetHook 0xc5868:$s2: SetHook 0xe5e88:$s2: SetHook 0xa5040:$s3: CallNextHook 0xc5870:$s3: CallNextHook 0xe5e90:$s3: CallNextHook 0xa504d:$s4: _hook 0xc587d:$s4: _hook 0xe5e9d:$s4: _hook
0.2.7vwfhMuUQg.exe.38d7b70.2.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xa7d84:$x1: $%SMTPDV$ 0xc85b4:$x1: $%SMTPDV$ 0xe8bd4:$x1: $%SMTPDV$ 0xa7dea:$x2: $#TheHashHere%& 0xc861a:$x2: $#TheHashHere%& 0xe8c3a:$x2: $#TheHashHere%& 0xa942b:$x3: %FTPDV$ 0xc9c5b:$x3: %FTPDV$ 0xea27b:$x3: %FTPDV$ 0xa951f:$x4: $%TelegramDv$ 0xc9d4f:$x4: $%TelegramDv$ 0xea36f:$x4: $%TelegramDv$ 0xa5695:$x5: KeyLoggerEventArgs 0xa59fc:$x5: KeyLoggerEventArgs 0xc5ec5:$x5: KeyLoggerEventArgs 0xc622c:$x5: KeyLoggerEventArgs 0xe64e5:$x5: KeyLoggerEventArgs 0xe684c:$x5: KeyLoggerEventArgs 0xa944f:$m2: Clipboard Logs ID 0xa961b:$m2: Screenshot Logs ID 0xa96e7:$m2: keystroke Logs ID
Click to see the 34 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000002.00000002.3957028997.0000000000532000.00000040.00000400.00020000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "leftlutvar@valleycountysar.org", "Password": "DKw(r0%wpbd]", "Host": "mail.valleycountysar.org", "Port": "587"}

Multi AV Scanner detection for submitted file

Source: 7vwfhMuUQg.exe

ReversingLabs: Detection: 75%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 7vwfhMuUQg.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: 7vwfhMuUQg.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49711 version: TLS 1.0

Source: 7vwfhMuUQg.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: C:\Users\GT350\source\repos\UpdatedRunpe\UpdatedRunpe\obj\x86\Debug\AQipUvwTwkLZyiCs.pdb source: 7vwfhMuUQg.exe, 00000000.00000002.2111466516.00000000052A0000.00000004.08000000.00040000.00000000.sdmp, 7vwfhMuUQg.exe, 00000000.00000002.2109952565.0000000002881000.00000004.00000800.00020000.00000000.sdmp

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 2.2.7vwfhMuUQg.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7vwfhMuUQg.exe.3967610.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7vwfhMuUQg.exe.3987e40.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7vwfhMuUQg.exe.38d7b70.2.raw.unpack, type: UNPACKEDPE

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 132.226.247.73 132.226.247.73

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49711 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: 7vwfhMuUQg.exe, 00000000.00000002.2110119938.0000000003889000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3957028997.0000000000532000.00000040.00000400.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3958557701.0000000002591000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.130.147.85
Source: 7vwfhMuUQg.exe, 00000002.00000002.3958557701.0000000002656000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: 7vwfhMuUQg.exe, 00000002.00000002.3958557701.0000000002643000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3958557701.0000000002694000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3958557701.00000000026F4000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3958557701.0000000002656000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3958557701.0000000002715000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3958557701.00000000026E8000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3958557701.00000000026FF000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3958557701.000000000270A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: 7vwfhMuUQg.exe, 00000002.00000002.3958557701.0000000002591000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: 7vwfhMuUQg.exe, 00000000.00000002.2110119938.0000000003889000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3957028997.0000000000532000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: 7vwfhMuUQg.exe, 00000002.00000002.3958557701.0000000002671000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: 7vwfhMuUQg.exe, 00000002.00000002.3958557701.0000000002591000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 7vwfhMuUQg.exe, 00000002.00000002.3958557701.0000000002694000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3958557701.00000000026F4000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3958557701.0000000002656000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3958557701.0000000002715000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3958557701.00000000026E8000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3958557701.00000000026FF000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3958557701.000000000270A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: 7vwfhMuUQg.exe, 00000000.00000002.2110119938.0000000003889000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3957028997.0000000000532000.00000040.00000400.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3958557701.0000000002656000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: 7vwfhMuUQg.exe, 00000002.00000002.3958557701.000000000270A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33
Source: 7vwfhMuUQg.exe, 00000002.00000002.3958557701.0000000002694000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3958557701.00000000026F4000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3958557701.0000000002715000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3958557701.00000000026E8000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3958557701.00000000026FF000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3958557701.000000000270A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33$

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.7vwfhMuUQg.exe.3987e40.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.7vwfhMuUQg.exe.3987e40.4.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.7vwfhMuUQg.exe.3987e40.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.7vwfhMuUQg.exe.3987e40.4.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 2.2.7vwfhMuUQg.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 2.2.7vwfhMuUQg.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.7vwfhMuUQg.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 2.2.7vwfhMuUQg.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.7vwfhMuUQg.exe.3967610.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.7vwfhMuUQg.exe.3967610.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.7vwfhMuUQg.exe.3967610.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.7vwfhMuUQg.exe.3967610.3.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.7vwfhMuUQg.exe.3967610.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.7vwfhMuUQg.exe.3967610.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.7vwfhMuUQg.exe.3967610.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.7vwfhMuUQg.exe.3967610.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.7vwfhMuUQg.exe.3987e40.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.7vwfhMuUQg.exe.3987e40.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.7vwfhMuUQg.exe.3987e40.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.7vwfhMuUQg.exe.3987e40.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.7vwfhMuUQg.exe.38d7b70.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.7vwfhMuUQg.exe.38d7b70.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.7vwfhMuUQg.exe.38d7b70.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000002.00000002.3957028997.0000000000532000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000002.00000002.3957028997.0000000000532000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.2110119938.0000000003889000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.2110119938.0000000003889000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: 7vwfhMuUQg.exe PID: 5824, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: 7vwfhMuUQg.exe PID: 5824, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: 7vwfhMuUQg.exe PID: 6600, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: 7vwfhMuUQg.exe PID: 6600, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen

Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Code function: 0_2_00E82560	0_2_00E82560
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Code function: 0_2_00E8D3DC	0_2_00E8D3DC
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Code function: 0_2_04D9A6D0	0_2_04D9A6D0
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Code function: 0_2_04D9B8E0	0_2_04D9B8E0
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Code function: 0_2_04D90040	0_2_04D90040
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Code function: 0_2_04D90007	0_2_04D90007
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Code function: 0_2_04D9B8D0	0_2_04D9B8D0
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Code function: 2_2_00A0C1F0	2_2_00A0C1F0
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Code function: 2_2_00A06168	2_2_00A06168
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Code function: 2_2_00A0B388	2_2_00A0B388
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Code function: 2_2_00A0C4D0	2_2_00A0C4D0
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Code function: 2_2_00A0C7B1	2_2_00A0C7B1
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Code function: 2_2_00A06790	2_2_00A06790
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Code function: 2_2_00A098B8	2_2_00A098B8
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Code function: 2_2_00A0CA91	2_2_00A0CA91
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Code function: 2_2_00A04B31	2_2_00A04B31
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Code function: 2_2_00A0BC32	2_2_00A0BC32
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Code function: 2_2_00A0BF10	2_2_00A0BF10
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Code function: 2_2_00A035C8	2_2_00A035C8
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Code function: 2_2_00A0B552	2_2_00A0B552

Source: 7vwfhMuUQg.exe, 00000000.00000002.2110119938.0000000003889000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameExample.dll0 vs 7vwfhMuUQg.exe
Source: 7vwfhMuUQg.exe, 00000000.00000002.2110119938.0000000003889000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs 7vwfhMuUQg.exe
Source: 7vwfhMuUQg.exe, 00000000.00000002.2111466516.00000000052A0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameAQipUvwTwkLZyiCs.dll: vs 7vwfhMuUQg.exe
Source: 7vwfhMuUQg.exe, 00000000.00000002.2110970570.0000000005130000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameExample.dll0 vs 7vwfhMuUQg.exe
Source: 7vwfhMuUQg.exe, 00000000.00000002.2108217620.000000000091E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 7vwfhMuUQg.exe
Source: 7vwfhMuUQg.exe, 00000000.00000000.2094010559.0000000000472000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameHumbling.exe. vs 7vwfhMuUQg.exe
Source: 7vwfhMuUQg.exe, 00000000.00000002.2109952565.0000000002881000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAQipUvwTwkLZyiCs.dll: vs 7vwfhMuUQg.exe
Source: 7vwfhMuUQg.exe, 00000000.00000002.2109952565.0000000002881000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs 7vwfhMuUQg.exe
Source: 7vwfhMuUQg.exe, 00000000.00000002.2109952565.0000000002881000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameriched20.dllp( vs 7vwfhMuUQg.exe
Source: 7vwfhMuUQg.exe, 00000000.00000002.2109952565.0000000002881000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs 7vwfhMuUQg.exe
Source: 7vwfhMuUQg.exe, 00000000.00000002.2109952565.0000000002881000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q,\\StringFileInfo\\000004B0\\OriginalFilename vs 7vwfhMuUQg.exe
Source: 7vwfhMuUQg.exe, 00000002.00000002.3957028997.0000000000532000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs 7vwfhMuUQg.exe
Source: 7vwfhMuUQg.exe	Binary or memory string: OriginalFilenameHumbling.exe. vs 7vwfhMuUQg.exe

Source: 7vwfhMuUQg.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.7vwfhMuUQg.exe.3987e40.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.7vwfhMuUQg.exe.3987e40.4.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.7vwfhMuUQg.exe.3987e40.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.7vwfhMuUQg.exe.3987e40.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 2.2.7vwfhMuUQg.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 2.2.7vwfhMuUQg.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.7vwfhMuUQg.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 2.2.7vwfhMuUQg.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.7vwfhMuUQg.exe.3967610.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.7vwfhMuUQg.exe.3967610.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.7vwfhMuUQg.exe.3967610.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.7vwfhMuUQg.exe.3967610.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.7vwfhMuUQg.exe.3967610.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.7vwfhMuUQg.exe.3967610.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.7vwfhMuUQg.exe.3967610.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.7vwfhMuUQg.exe.3967610.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.7vwfhMuUQg.exe.3987e40.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.7vwfhMuUQg.exe.3987e40.4.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.7vwfhMuUQg.exe.3987e40.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.7vwfhMuUQg.exe.3987e40.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.7vwfhMuUQg.exe.38d7b70.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.7vwfhMuUQg.exe.38d7b70.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.7vwfhMuUQg.exe.38d7b70.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000002.00000002.3957028997.0000000000532000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000002.00000002.3957028997.0000000000532000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.2110119938.0000000003889000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.2110119938.0000000003889000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: 7vwfhMuUQg.exe PID: 5824, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: 7vwfhMuUQg.exe PID: 5824, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: 7vwfhMuUQg.exe PID: 6600, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: 7vwfhMuUQg.exe PID: 6600, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger

Source: 0.2.7vwfhMuUQg.exe.3987e40.4.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.7vwfhMuUQg.exe.3987e40.4.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.7vwfhMuUQg.exe.3987e40.4.raw.unpack, -R.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.7vwfhMuUQg.exe.3987e40.4.raw.unpack, -R.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.7vwfhMuUQg.exe.3967610.3.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.7vwfhMuUQg.exe.3967610.3.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.7vwfhMuUQg.exe.3967610.3.raw.unpack, -R.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.7vwfhMuUQg.exe.3967610.3.raw.unpack, -R.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.7vwfhMuUQg.exe.5130000.5.raw.unpack, DarkListView.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.7vwfhMuUQg.exe.38d7b70.2.raw.unpack, DarkListView.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.7vwfhMuUQg.exe.5130000.5.raw.unpack, DarkComboBox.cs	Base64 encoded string: 'Uwm+UuKGd614I69RzLI93aXq8M4plP4Fl8XGnAA54HkS/0jMOBsYAdDU3ufQvFFjYZJP0JeYZcnDYanLTNfb9IJuC/u1be1KdJkORevGYuzVlkHzJtU9FNAhjxyJAuY/'
Source: 0.2.7vwfhMuUQg.exe.38d7b70.2.raw.unpack, DarkComboBox.cs	Base64 encoded string: 'Uwm+UuKGd614I69RzLI93aXq8M4plP4Fl8XGnAA54HkS/0jMOBsYAdDU3ufQvFFjYZJP0JeYZcnDYanLTNfb9IJuC/u1be1KdJkORevGYuzVlkHzJtU9FNAhjxyJAuY/'

Source: classification engine

Classification label: mal100.troj.evad.winEXE@8/1@2/2

Source: C:\Users\user\Desktop\7vwfhMuUQg.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\7vwfhMuUQg.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1472:120:WilError_03

Source: 7vwfhMuUQg.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 7vwfhMuUQg.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\7vwfhMuUQg.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\7vwfhMuUQg.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 7vwfhMuUQg.exe

ReversingLabs: Detection: 75%

Source: unknown	Process created: C:\Users\user\Desktop\7vwfhMuUQg.exe "C:\Users\user\Desktop\7vwfhMuUQg.exe"
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process created: C:\Users\user\Desktop\7vwfhMuUQg.exe "C:\Users\user\Desktop\7vwfhMuUQg.exe"
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\7vwfhMuUQg.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /C Y /N /D Y /T 3
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process created: C:\Users\user\Desktop\7vwfhMuUQg.exe "C:\Users\user\Desktop\7vwfhMuUQg.exe"	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\7vwfhMuUQg.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /C Y /N /D Y /T 3	Jump to behavior

Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\7vwfhMuUQg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\7vwfhMuUQg.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 7vwfhMuUQg.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 7vwfhMuUQg.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Source: 7vwfhMuUQg.exe

Static PE information: 0xDA8CE5FE [Mon Mar 11 06:36:46 2086 UTC]

Source: C:\Users\user\Desktop\7vwfhMuUQg.exe

Code function: 0_2_04D91C51 push esp; retf

0_2_04D91C52

Source: 7vwfhMuUQg.exe

Static PE information: section name: .text entropy: 7.315190041992545

Hooking and other Techniques for Hiding and Protection

Self deletion via cmd or bat file

Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process created: "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\7vwfhMuUQg.exe"
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process created: "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\7vwfhMuUQg.exe"			Jump to behavior

Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Memory allocated: E80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Memory allocated: 2880000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Memory allocated: 2640000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Memory allocated: A00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Memory allocated: 2590000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Memory allocated: 22E0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Thread delayed: delay time: 600000	Jump to behavior

Source: C:\Users\user\Desktop\7vwfhMuUQg.exe TID: 5716	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe TID: 5720	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe TID: 6816	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe TID: 3052	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe TID: 5720	Thread sleep time: -600000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Thread delayed: delay time: 600000	Jump to behavior

Source: 7vwfhMuUQg.exe, 00000002.00000002.3957576144.00000000008C7000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\7vwfhMuUQg.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\7vwfhMuUQg.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\7vwfhMuUQg.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 0.2.7vwfhMuUQg.exe.52a0000.6.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 0.2.7vwfhMuUQg.exe.52a0000.6.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 0.2.7vwfhMuUQg.exe.52a0000.6.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs	Reference to suspicious API methods: ReadProcessMemory(processInformation.ProcessHandle, num3 + 8, ref buffer, 4, ref bytesRead)

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\7vwfhMuUQg.exe

Memory written: C:\Users\user\Desktop\7vwfhMuUQg.exe base: 530000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process created: C:\Users\user\Desktop\7vwfhMuUQg.exe "C:\Users\user\Desktop\7vwfhMuUQg.exe"	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\7vwfhMuUQg.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /C Y /N /D Y /T 3	Jump to behavior

Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Queries volume information: C:\Users\user\Desktop\7vwfhMuUQg.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Queries volume information: C:\Users\user\Desktop\7vwfhMuUQg.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7vwfhMuUQg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\7vwfhMuUQg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 0.2.7vwfhMuUQg.exe.3987e40.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.7vwfhMuUQg.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7vwfhMuUQg.exe.3967610.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7vwfhMuUQg.exe.3967610.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7vwfhMuUQg.exe.3987e40.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7vwfhMuUQg.exe.38d7b70.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3957028997.0000000000532000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2110119938.0000000003889000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3958557701.0000000002591000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7vwfhMuUQg.exe PID: 5824, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7vwfhMuUQg.exe PID: 6600, type: MEMORYSTR

Source: Yara match	File source: 0.2.7vwfhMuUQg.exe.3987e40.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.7vwfhMuUQg.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7vwfhMuUQg.exe.3967610.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7vwfhMuUQg.exe.3967610.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7vwfhMuUQg.exe.3987e40.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7vwfhMuUQg.exe.38d7b70.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3957028997.0000000000532000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2110119938.0000000003889000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7vwfhMuUQg.exe PID: 5824, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7vwfhMuUQg.exe PID: 6600, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 0.2.7vwfhMuUQg.exe.3987e40.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.7vwfhMuUQg.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7vwfhMuUQg.exe.3967610.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7vwfhMuUQg.exe.3967610.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7vwfhMuUQg.exe.3987e40.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7vwfhMuUQg.exe.38d7b70.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3957028997.0000000000532000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2110119938.0000000003889000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3958557701.0000000002591000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7vwfhMuUQg.exe PID: 5824, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7vwfhMuUQg.exe PID: 6600, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	111 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	11 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Obfuscated Files or Information	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 File Deletion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
7vwfhMuUQg.exe	75%	ReversingLabs	ByteCode-MSIL.Trojan.SnakeLogger
7vwfhMuUQg.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://checkip.dyndns.org	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://checkip.dyndns.org/q	0%	URL Reputation	safe
https://reallyfreegeoip.org	0%	Avira URL Cloud	safe
https://reallyfreegeoip.org/xml/	0%	Avira URL Cloud	safe
http://checkip.dyndns.com	0%	Avira URL Cloud	safe
https://reallyfreegeoip.org/xml/8.46.123.33$	0%	Avira URL Cloud	safe
http://reallyfreegeoip.org	0%	Avira URL Cloud	safe
https://reallyfreegeoip.org/xml/8.46.123.33	0%	Avira URL Cloud	safe
http://checkip.dyndns.org/	0%	Avira URL Cloud	safe
http://103.130.147.85	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	188.114.96.3	true	true	unknown
checkip.dyndns.com	132.226.247.73	true	false	unknown
checkip.dyndns.org	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/8.46.123.33	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://reallyfreegeoip.org	7vwfhMuUQg.exe, 00000002.00000002.3958557701.0000000002694000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3958557701.00000000026F4000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3958557701.0000000002656000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3958557701.0000000002715000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3958557701.00000000026E8000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3958557701.00000000026FF000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3958557701.000000000270A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org	7vwfhMuUQg.exe, 00000002.00000002.3958557701.0000000002643000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3958557701.0000000002694000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3958557701.00000000026F4000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3958557701.0000000002656000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3958557701.0000000002715000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3958557701.00000000026E8000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3958557701.00000000026FF000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3958557701.000000000270A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.com	7vwfhMuUQg.exe, 00000002.00000002.3958557701.0000000002656000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/8.46.123.33$	7vwfhMuUQg.exe, 00000002.00000002.3958557701.0000000002694000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3958557701.00000000026F4000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3958557701.0000000002715000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3958557701.00000000026E8000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3958557701.00000000026FF000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3958557701.000000000270A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	7vwfhMuUQg.exe, 00000002.00000002.3958557701.0000000002591000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://103.130.147.85	7vwfhMuUQg.exe, 00000000.00000002.2110119938.0000000003889000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3957028997.0000000000532000.00000040.00000400.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3958557701.0000000002591000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org/q	7vwfhMuUQg.exe, 00000000.00000002.2110119938.0000000003889000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3957028997.0000000000532000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://reallyfreegeoip.org	7vwfhMuUQg.exe, 00000002.00000002.3958557701.0000000002671000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/	7vwfhMuUQg.exe, 00000000.00000002.2110119938.0000000003889000.00000004.00000800.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3957028997.0000000000532000.00000040.00000400.00020000.00000000.sdmp, 7vwfhMuUQg.exe, 00000002.00000002.3958557701.0000000002656000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.96.3	reallyfreegeoip.org	European Union		13335	CLOUDFLARENETUS	true
132.226.247.73	checkip.dyndns.com	United States		16989	UTMEMUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467009
Start date and time:	2024-07-03 16:30:43 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	7vwfhMuUQg.exe renamed because original name is a hash value
Original Sample Name:	e2b79e37d4a34bcab883b0de55809ab1be398fee99cde2fcb0058bac413192f7.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@8/1@2/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 75 Number of non-executed functions: 4
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 7vwfhMuUQg.exe, PID 6600 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: 7vwfhMuUQg.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	9098393827383039.exe	Get hash	malicious	FormBook	Browse	www.coinwab.com/kqqj/
	SOA 020724.exe	Get hash	malicious	FormBook	Browse	www.ad14.fun/az6h/?Vn=Ydx4qJJ0n&3jJlx=2tWzkzncG4ra8DBegJJBToW7oB13AdJXZ1KkbDLW+Ah9MGsNEQDOdLre6u2t4zOJ63yLnsPJ97sPnqMxsSzbOxuABFq0Im2Ecm9EQ8GOdhogxDCvRrrALITlDFg7ZHNgcXHQPxMcHnGf
	Adjunto confirmacion de pedido.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.coinwab.com/kqqj/
	aAEsSBx24sxHhRz.exe	Get hash	malicious	FormBook	Browse	www.camperelektrikde.shop/dy13/?GdIHAFZ=8bNdgr3QvPw6/pDIZNt+55DvjzemDI0RO+pYD3qlulbIe6f7Sn3K06Z4F4Tg3hK83Y0/&BhU=5jl0ddZhNnYlOrV0
	http://sp.26skins.com/steamstore/category/adventure_rpg/?snr=1_5_9__12	Get hash	malicious	Unknown	Browse	sp.26skins.com/favicon.ico
	30Fqen2Bu3.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/TbaYPT0S/download
	30Fqen2Bu3.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/TbaYPT0S/download
	Vg46FzGtNo.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	000366cm.nyashka.top/phpflowergenerator.php
	QUOTATION_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	filetransfer.io/data-package/mHgyHEv5/download
	file.exe	Get hash	malicious	FormBook	Browse	www.cavetta.org.mt/yhnb/
132.226.247.73	k8TljgjfDl.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	project plan.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	MT_01452_03607PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	checkip.dyndns.org/
	oHchwlxMNG.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	vsl particulars packing list.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Order Details.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	itinerary_1719382117.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Halkbank_Ekstre_20240625_082306_910668.bat.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	242010.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	j6OUc3S2uP.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	1mXbuDDPbF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.97.3
	k8TljgjfDl.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	IMG_0178520003023PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.97.3
	MT_01452_03607PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.97.3
	PETUNJUK-PENGISIAN DAN PENGIRIMAN KONFIRMASI EDITED.xlsx.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	whiteee.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	whiteee.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	Details.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
checkip.dyndns.com	j6OUc3S2uP.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	1mXbuDDPbF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	193.122.130.0
	k8TljgjfDl.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	project plan.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	IMG_0178520003023PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	158.101.44.242
	MT_01452_03607PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	132.226.247.73
	payment.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	PETUNJUK-PENGISIAN DAN PENGIRIMAN KONFIRMASI EDITED.xlsx.scr.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	whiteee.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	http://booking.extnnehotteir.com/admin/o2shi1bka89	Get hash	malicious	Unknown	Browse	188.114.96.3
	j6OUc3S2uP.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	MUdeeReQ5R.exe	Get hash	malicious	FormBook	Browse	172.67.147.144
	q86onx3LvU.exe	Get hash	malicious	PureLog Stealer	Browse	104.21.10.178
	Vertex Business Services_SKM_C950633210_650106.pdf	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	6Ek4nfs2y1.exe	Get hash	malicious	PhoenixKeylogger, PureLog Stealer	Browse	104.21.10.178
	9098393827383039.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	https://www.filemail.com/t/RuKZYfeB	Get hash	malicious	HTMLPhisher	Browse	172.64.41.3
	kZa81nzREg.exe	Get hash	malicious	AgentTesla	Browse	172.67.196.55
UTMEMUS	j6OUc3S2uP.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	k8TljgjfDl.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	project plan.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	MT_01452_03607PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	132.226.247.73
	lista de cotizaciones.xlam.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	Details.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	oHchwlxMNG.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	scan copy.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	CDMZxujRpn.elf	Get hash	malicious	Mirai	Browse	132.192.25.142

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	j6OUc3S2uP.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	kZa81nzREg.exe	Get hash	malicious	AgentTesla	Browse	188.114.96.3
	ptKNiAaGus.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	beK7HmoXro.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	1mXbuDDPbF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.96.3
	k8TljgjfDl.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	IMG_0178520003023PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.96.3
	MT_01452_03607PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.96.3
	fin.746.msi	Get hash	malicious	Unknown	Browse	188.114.96.3

Process:	C:\Users\user\Desktop\7vwfhMuUQg.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.304137350958184
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	7vwfhMuUQg.exe
File size:	532'992 bytes
MD5:	87c41e117d5bf575fc5bd9dd9386e2aa
SHA1:	1ab94afc06ca89c564f43141281051aae9494086
SHA256:	e2b79e37d4a34bcab883b0de55809ab1be398fee99cde2fcb0058bac413192f7
SHA512:	16c43e53f8d613d18bea8470917f023618d86bde991d175434fd2171f025dfea33901faca8e2667379e81a318cc1db29637bd9880192607d5fea860e3afa29a3
SSDEEP:	6144:sTVFZInd6Xcfg9UZndhc7KFCEBbDlRPBUYLvyvvRFBZrrfXB0JaTc0ApziCbI:s5kndmHuxV/JUJDBZrSJaTopzi8I
TLSH:	9CB4C03837A415B4D4368AFAA4E2403DAA7179A274E2C65165CF1FDD39CAFC08D8721F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.............~6... ...@....@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x48367e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xDA8CE5FE [Mon Mar 11 06:36:46 2086 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x83628	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x84000	0x59e	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x86000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x81684	0x81800	6711f849ea7e834450e5a2f41aa91796	False	0.5435380972490348	data	7.315190041992545	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x84000	0x59e	0x600	a7dcf28809e6e4005982d016358a971d	False	0.4186197916666667	data	4.052104303958992	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x86000	0xc	0x200	29bcd969129e4c4ee9ee0bc83c473a4c	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x840a0	0x314	data			0.434010152284264
RT_MANIFEST	0x843b4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 16:31:32.784348965 CEST	49710	80	192.168.2.6	132.226.247.73
Jul 3, 2024 16:31:32.789459944 CEST	80	49710	132.226.247.73	192.168.2.6
Jul 3, 2024 16:31:32.789587975 CEST	49710	80	192.168.2.6	132.226.247.73
Jul 3, 2024 16:31:32.789782047 CEST	49710	80	192.168.2.6	132.226.247.73
Jul 3, 2024 16:31:32.795543909 CEST	80	49710	132.226.247.73	192.168.2.6
Jul 3, 2024 16:31:33.459002972 CEST	80	49710	132.226.247.73	192.168.2.6
Jul 3, 2024 16:31:33.468163967 CEST	49710	80	192.168.2.6	132.226.247.73
Jul 3, 2024 16:31:33.474805117 CEST	80	49710	132.226.247.73	192.168.2.6
Jul 3, 2024 16:31:33.674504995 CEST	80	49710	132.226.247.73	192.168.2.6
Jul 3, 2024 16:31:33.719679117 CEST	49710	80	192.168.2.6	132.226.247.73
Jul 3, 2024 16:31:33.782370090 CEST	49711	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:33.782413960 CEST	443	49711	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:33.782479048 CEST	49711	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:33.832643986 CEST	49711	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:33.832659006 CEST	443	49711	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:34.303502083 CEST	443	49711	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:34.303622961 CEST	49711	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:34.330873966 CEST	49711	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:34.330904007 CEST	443	49711	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:34.331284046 CEST	443	49711	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:34.375957966 CEST	49711	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:34.446244955 CEST	49711	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:34.492502928 CEST	443	49711	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:34.553364992 CEST	443	49711	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:34.553463936 CEST	443	49711	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:34.553534985 CEST	49711	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:34.581573009 CEST	49711	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:34.585611105 CEST	49710	80	192.168.2.6	132.226.247.73
Jul 3, 2024 16:31:34.590533972 CEST	80	49710	132.226.247.73	192.168.2.6
Jul 3, 2024 16:31:34.790329933 CEST	80	49710	132.226.247.73	192.168.2.6
Jul 3, 2024 16:31:34.797132969 CEST	49714	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:34.797240019 CEST	443	49714	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:34.797353029 CEST	49714	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:34.797646999 CEST	49714	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:34.797683001 CEST	443	49714	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:34.844717979 CEST	49710	80	192.168.2.6	132.226.247.73
Jul 3, 2024 16:31:35.261044025 CEST	443	49714	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:35.266724110 CEST	49714	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:35.266771078 CEST	443	49714	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:35.394371033 CEST	443	49714	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:35.394474983 CEST	443	49714	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:35.394524097 CEST	49714	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:35.402394056 CEST	49714	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:35.453120947 CEST	49710	80	192.168.2.6	132.226.247.73
Jul 3, 2024 16:31:35.457989931 CEST	80	49710	132.226.247.73	192.168.2.6
Jul 3, 2024 16:31:35.657546997 CEST	80	49710	132.226.247.73	192.168.2.6
Jul 3, 2024 16:31:35.658399105 CEST	49715	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:35.658449888 CEST	443	49715	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:35.658524990 CEST	49715	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:35.658848047 CEST	49715	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:35.658866882 CEST	443	49715	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:35.704044104 CEST	49710	80	192.168.2.6	132.226.247.73
Jul 3, 2024 16:31:36.136040926 CEST	443	49715	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:36.137861013 CEST	49715	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:36.137885094 CEST	443	49715	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:36.283288956 CEST	443	49715	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:36.283380032 CEST	443	49715	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:36.283427954 CEST	49715	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:36.283963919 CEST	49715	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:36.287205935 CEST	49710	80	192.168.2.6	132.226.247.73
Jul 3, 2024 16:31:36.292268038 CEST	80	49710	132.226.247.73	192.168.2.6
Jul 3, 2024 16:31:36.492338896 CEST	80	49710	132.226.247.73	192.168.2.6
Jul 3, 2024 16:31:36.493309975 CEST	49717	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:36.493350029 CEST	443	49717	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:36.493434906 CEST	49717	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:36.493755102 CEST	49717	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:36.493767023 CEST	443	49717	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:36.532396078 CEST	49710	80	192.168.2.6	132.226.247.73
Jul 3, 2024 16:31:36.961446047 CEST	443	49717	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:36.963413954 CEST	49717	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:36.963449001 CEST	443	49717	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:37.092454910 CEST	443	49717	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:37.092586040 CEST	443	49717	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:37.092638016 CEST	49717	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:37.093408108 CEST	49717	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:37.096834898 CEST	49710	80	192.168.2.6	132.226.247.73
Jul 3, 2024 16:31:37.102128029 CEST	80	49710	132.226.247.73	192.168.2.6
Jul 3, 2024 16:31:37.301677942 CEST	80	49710	132.226.247.73	192.168.2.6
Jul 3, 2024 16:31:37.302869081 CEST	49718	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:37.302905083 CEST	443	49718	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:37.302992105 CEST	49718	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:37.303323030 CEST	49718	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:37.303339958 CEST	443	49718	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:37.344924927 CEST	49710	80	192.168.2.6	132.226.247.73
Jul 3, 2024 16:31:37.764549971 CEST	443	49718	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:37.766374111 CEST	49718	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:37.766391993 CEST	443	49718	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:37.913305998 CEST	443	49718	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:37.913403988 CEST	443	49718	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:37.913600922 CEST	49718	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:37.922720909 CEST	49718	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:37.982485056 CEST	49710	80	192.168.2.6	132.226.247.73
Jul 3, 2024 16:31:37.987711906 CEST	80	49710	132.226.247.73	192.168.2.6
Jul 3, 2024 16:31:38.187705040 CEST	80	49710	132.226.247.73	192.168.2.6
Jul 3, 2024 16:31:38.191745043 CEST	49720	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:38.191800117 CEST	443	49720	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:38.191874981 CEST	49720	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:38.192233086 CEST	49720	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:38.192250013 CEST	443	49720	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:38.235337973 CEST	49710	80	192.168.2.6	132.226.247.73
Jul 3, 2024 16:31:38.656172991 CEST	443	49720	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:38.658075094 CEST	49720	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:38.658107042 CEST	443	49720	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:38.796392918 CEST	443	49720	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:38.796478987 CEST	443	49720	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:38.796636105 CEST	49720	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:38.797458887 CEST	49720	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:38.800708055 CEST	49710	80	192.168.2.6	132.226.247.73
Jul 3, 2024 16:31:38.805685997 CEST	80	49710	132.226.247.73	192.168.2.6
Jul 3, 2024 16:31:39.005669117 CEST	80	49710	132.226.247.73	192.168.2.6
Jul 3, 2024 16:31:39.006901979 CEST	49722	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:39.006952047 CEST	443	49722	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:39.007039070 CEST	49722	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:39.007437944 CEST	49722	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:39.007452011 CEST	443	49722	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:39.047910929 CEST	49710	80	192.168.2.6	132.226.247.73
Jul 3, 2024 16:31:39.475714922 CEST	443	49722	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:39.481551886 CEST	49722	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:39.481580019 CEST	443	49722	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:39.606852055 CEST	443	49722	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:39.606956005 CEST	443	49722	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:39.606997013 CEST	49722	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:39.607769966 CEST	49722	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:39.611668110 CEST	49710	80	192.168.2.6	132.226.247.73
Jul 3, 2024 16:31:39.616585016 CEST	80	49710	132.226.247.73	192.168.2.6
Jul 3, 2024 16:31:39.816641092 CEST	80	49710	132.226.247.73	192.168.2.6
Jul 3, 2024 16:31:39.817543983 CEST	49724	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:39.817589045 CEST	443	49724	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:39.817658901 CEST	49724	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:39.817981958 CEST	49724	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:39.817994118 CEST	443	49724	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:39.860312939 CEST	49710	80	192.168.2.6	132.226.247.73
Jul 3, 2024 16:31:40.292833090 CEST	443	49724	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:40.327719927 CEST	49724	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:40.327744961 CEST	443	49724	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:40.434937000 CEST	443	49724	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:40.435039997 CEST	443	49724	188.114.96.3	192.168.2.6
Jul 3, 2024 16:31:40.435087919 CEST	49724	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:40.435699940 CEST	49724	443	192.168.2.6	188.114.96.3
Jul 3, 2024 16:31:40.622617960 CEST	49710	80	192.168.2.6	132.226.247.73

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 16:31:32.770555973 CEST	64946	53	192.168.2.6	1.1.1.1
Jul 3, 2024 16:31:32.779099941 CEST	53	64946	1.1.1.1	192.168.2.6
Jul 3, 2024 16:31:33.769985914 CEST	64278	53	192.168.2.6	1.1.1.1
Jul 3, 2024 16:31:33.781582117 CEST	53	64278	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 3, 2024 16:31:32.770555973 CEST	192.168.2.6	1.1.1.1	0x9c77	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 3, 2024 16:31:33.769985914 CEST	192.168.2.6	1.1.1.1	0x1c34	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 3, 2024 16:31:32.779099941 CEST	1.1.1.1	192.168.2.6	0x9c77	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 16:31:32.779099941 CEST	1.1.1.1	192.168.2.6	0x9c77	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 3, 2024 16:31:32.779099941 CEST	1.1.1.1	192.168.2.6	0x9c77	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 3, 2024 16:31:32.779099941 CEST	1.1.1.1	192.168.2.6	0x9c77	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 3, 2024 16:31:32.779099941 CEST	1.1.1.1	192.168.2.6	0x9c77	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 3, 2024 16:31:32.779099941 CEST	1.1.1.1	192.168.2.6	0x9c77	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 3, 2024 16:31:33.781582117 CEST	1.1.1.1	192.168.2.6	0x1c34	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 3, 2024 16:31:33.781582117 CEST	1.1.1.1	192.168.2.6	0x1c34	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	132.226.247.73	80	6600	C:\Users\user\Desktop\7vwfhMuUQg.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 16:31:32.789782047 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 3, 2024 16:31:33.459002972 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 14:31:33 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 3943ae4979bd2acd752ee8367aacf7cf Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 3, 2024 16:31:33.468163967 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jul 3, 2024 16:31:33.674504995 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 14:31:33 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: d95b4760daffc5482bbf0c852e4448f1 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 3, 2024 16:31:34.585611105 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jul 3, 2024 16:31:34.790329933 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 14:31:34 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: b33924000e77d72d3569e7491f084d28 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 3, 2024 16:31:35.453120947 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jul 3, 2024 16:31:35.657546997 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 14:31:35 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: ead4f9baedf31c6604ee3d14940c9a4e Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 3, 2024 16:31:36.287205935 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jul 3, 2024 16:31:36.492338896 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 14:31:36 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 6662f1d4ab9f1ab4e3c9755968566608 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 3, 2024 16:31:37.096834898 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jul 3, 2024 16:31:37.301677942 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 14:31:37 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: b4f5d0b5d6d7c07bc42da4ee01c2a70f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 3, 2024 16:31:37.982485056 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jul 3, 2024 16:31:38.187705040 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 14:31:38 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 92b68779ce8ea183d54fbb0e8ba25450 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 3, 2024 16:31:38.800708055 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jul 3, 2024 16:31:39.005669117 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 14:31:38 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: a30a0c95deca0239a13c53066a71fa0b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 3, 2024 16:31:39.611668110 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jul 3, 2024 16:31:39.816641092 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 14:31:39 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: a07b6eb8f064a6999a4868167b3dade0 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49711	188.114.96.3	443	6600	C:\Users\user\Desktop\7vwfhMuUQg.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 14:31:34 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-07-03 14:31:34 UTC	706	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 14:31:34 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 29718 Last-Modified: Wed, 03 Jul 2024 06:16:16 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KPKYTGa2uIHEizPNrR%2FZt1OSlyxiom6T9ioB0tnXp8RklyHaeEwuEju46eJa0eQXHdAyLjKpzNRXGzPip%2BitsFL1cPRF2l9xTYJaW%2B8of92T5SZzUk4sIxQiLqX2u25QRraf5huA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89d794789ed80f84-EWR alt-svc: h3=":443"; ma=86400
2024-07-03 14:31:34 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-03 14:31:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49714	188.114.96.3	443	6600	C:\Users\user\Desktop\7vwfhMuUQg.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 14:31:35 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-07-03 14:31:35 UTC	712	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 14:31:35 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 29719 Last-Modified: Wed, 03 Jul 2024 06:16:16 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nrDngdMt%2BTJ0oOy2IMO4dqhS13lRywsL6QEih%2Bu2cd2DAGAE%2BqlCDEo0yF599Ecz%2FxT%2BmEyQQKVCjuChBXepyDNAtKWezlwTSUW8NBjBEaJ7uzOxKR888WPkQ%2Fgl9lF2b0FSe1bS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89d7947ddbc341ad-EWR alt-svc: h3=":443"; ma=86400
2024-07-03 14:31:35 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-03 14:31:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49715	188.114.96.3	443	6600	C:\Users\user\Desktop\7vwfhMuUQg.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 14:31:36 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-07-03 14:31:36 UTC	714	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 14:31:36 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 29720 Last-Modified: Wed, 03 Jul 2024 06:16:16 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nB1mga1tNmIaqEI3Zk33Hs0zo5zH7yNAyiAQexfrK63%2Fnfl4SRMKAjQnAxmyssKsBtJRJGLfnk2m9DwN%2FjVv5M8r%2F%2Foicl2%2F1djFPq%2BlZr9Uvc28S1rm7msKXg%2FX61OoyEpZgKey"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89d794836e445e70-EWR alt-svc: h3=":443"; ma=86400
2024-07-03 14:31:36 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-03 14:31:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49717	188.114.96.3	443	6600	C:\Users\user\Desktop\7vwfhMuUQg.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 14:31:36 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-07-03 14:31:37 UTC	710	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 14:31:37 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 29721 Last-Modified: Wed, 03 Jul 2024 06:16:16 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RGN7guH1041%2ByNC1jxogXuffBp%2F8E8WGVstDaopEylUf5ib2KdBHH%2FQyknA0o8voo7tkiZR3kXaQi5RNqtg%2Ffj3qRa3vZldZRWyXhQRUAcGnsXWpIFSABYr5Ifr5At9HD5GM6Y%2Fy"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89d794887c6dc42a-EWR alt-svc: h3=":443"; ma=86400
2024-07-03 14:31:37 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-03 14:31:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49718	188.114.96.3	443	6600	C:\Users\user\Desktop\7vwfhMuUQg.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 14:31:37 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-07-03 14:31:37 UTC	708	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 14:31:37 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 29721 Last-Modified: Wed, 03 Jul 2024 06:16:16 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7%2Fz4H7HNmdAl1M7h0jkOb3GmgViAAQ4pZ%2Fi0RJfUfqUFwHEcMNm%2BTEvHW8KcRJtAfgykVSIU3rQvvtWlzLPPQIsU%2BWfLahtn4V1bvq8yQh7s2nRnaDUG0UbHcOFQA44339KHTR6l"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89d7948d982fc47c-EWR alt-svc: h3=":443"; ma=86400
2024-07-03 14:31:37 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-03 14:31:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49720	188.114.96.3	443	6600	C:\Users\user\Desktop\7vwfhMuUQg.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 14:31:38 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-07-03 14:31:38 UTC	710	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 14:31:38 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 29722 Last-Modified: Wed, 03 Jul 2024 06:16:16 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tfA9b%2BGMOT%2F7V9G7eQA0oXoTIebwEIRhZxfU76ucjZEwDAPUI95AZiSUdD9Qg92jE71zAcsPLfjyZG3bBuQa0mNxKLuy0bfMsZ%2B0GaA8bMPpXOyZkYz4CkqoB%2BDLJPOtB1U3Qj%2Fg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89d794931ef143af-EWR alt-svc: h3=":443"; ma=86400
2024-07-03 14:31:38 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-03 14:31:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49722	188.114.96.3	443	6600	C:\Users\user\Desktop\7vwfhMuUQg.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 14:31:39 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-07-03 14:31:39 UTC	714	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 14:31:39 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 29723 Last-Modified: Wed, 03 Jul 2024 06:16:16 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A63oO%2B2sIR5y9%2B%2Fc4VeAEmtEXdwSyvOKXAuireTuTsVQe34KM%2BL8qP1SBlXfVIUAA0NTFbXnO%2Fm3v1YSIkzjv%2FBSWHI6xG3ISAynxxLNIElJBY4Z6AN%2FI6pcDbAPxW6THHYeL3nJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89d794983af543a6-EWR alt-svc: h3=":443"; ma=86400
2024-07-03 14:31:39 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-03 14:31:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49724	188.114.96.3	443	6600	C:\Users\user\Desktop\7vwfhMuUQg.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 14:31:40 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-07-03 14:31:40 UTC	712	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 14:31:40 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 29724 Last-Modified: Wed, 03 Jul 2024 06:16:16 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SwBhvwnqLJWYDJRZDrkAUzFvVNhb%2BEPMfz8Ty59JKPZGLkd4wLLBdxGbQRPiyk8d%2Fxlm1jIbeTd6Hv%2FnfmDiG67TS6Wqa%2BqtZMz3Q%2BoiIkUzeVNC2sap1masqVcr%2BT9UXyG5k8uM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89d7949d5cc617d9-EWR alt-svc: h3=":443"; ma=86400
2024-07-03 14:31:40 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-03 14:31:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	10:31:30
Start date:	03/07/2024
Path:	C:\Users\user\Desktop\7vwfhMuUQg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\7vwfhMuUQg.exe"
Imagebase:	0x470000
File size:	532'992 bytes
MD5 hash:	87C41E117D5BF575FC5BD9DD9386E2AA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2110119938.0000000003889000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.2110119938.0000000003889000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.2110119938.0000000003889000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.2110119938.0000000003889000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:31:31
Start date:	03/07/2024
Path:	C:\Users\user\Desktop\7vwfhMuUQg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\7vwfhMuUQg.exe"
Imagebase:	0xe0000
File size:	532'992 bytes
MD5 hash:	87C41E117D5BF575FC5BD9DD9386E2AA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.3957028997.0000000000532000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000002.00000002.3957028997.0000000000532000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000002.00000002.3957028997.0000000000532000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000002.00000002.3957028997.0000000000532000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000002.00000002.3958557701.0000000002591000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	10:31:39
Start date:	03/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\7vwfhMuUQg.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:31:39
Start date:	03/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:31:39
Start date:	03/07/2024
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /C Y /N /D Y /T 3
Imagebase:	0x830000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	31.3%
Total number of Nodes:	150
Total number of Limit Nodes:	9

Executed Functions

Function 04D9B8E0 Relevance: 1.9, Strings: 1, Instructions: 615
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(, xrefs: 04D9C090

Memory Dump Source

Source File: 00000000.00000002.2110722700.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d90000_7vwfhMuUQg.jbxd

Similarity

API ID: CreateProcess
String ID: (
API String ID: 963392458-3887548279
Opcode ID: 041847bada5594bb17090d9a65111d3afae35fdd5329186959dcda6a7201be71
Instruction ID: 8dbf2d7fd9dd35bb124089eeeb1df79531e426309680c82406eb08aaa97188c8
Opcode Fuzzy Hash: 041847bada5594bb17090d9a65111d3afae35fdd5329186959dcda6a7201be71
Instruction Fuzzy Hash: EA52D275E012698FEB64DF65C944BEDB7F2BF89300F1081EA9409AB291DB346E85CF50

Function 04D9B8D0 Relevance: .5, Instructions: 501COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110722700.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d90000_7vwfhMuUQg.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 6e9e99e9ee7d0e48b8de7e28fda247a16e50e00f1eb17af5a1c581c361f02c15
Instruction ID: b854f09b134e715ae28c28d7ca16077d475cd6aa391a4d0e2dcf82d1acb1b73c
Opcode Fuzzy Hash: 6e9e99e9ee7d0e48b8de7e28fda247a16e50e00f1eb17af5a1c581c361f02c15
Instruction Fuzzy Hash: 6B32E471E012298FEB64DF65C944BEDBBF1BF89300F1481EA9109AB291DB746E85CF50

Function 04D9A6D0 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110722700.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d90000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a6da7d219f19decd80b508cc868ead3bde49e1435eb44a8f02623fc87217453
Instruction ID: 5dbb7e7f2482f24ee0365b5d00e2258debb8d3388460640960e74f25239efb90
Opcode Fuzzy Hash: 1a6da7d219f19decd80b508cc868ead3bde49e1435eb44a8f02623fc87217453
Instruction Fuzzy Hash: C9817F35B002589BDB08AFB9985477EBBF3BFC9B00B15851DE446EB384DE359C058792

Function 00E8A690 Relevance: 1.7, APIs: 1, Instructions: 193
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00E8A8E6

Memory Dump Source

Source File: 00000000.00000002.2109640579.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_7vwfhMuUQg.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2c162b85941bc2ac0106ecfc96ecb114432ad78bba981ccd25571f68388f09b1
Instruction ID: 11a8c8a0d8c32cb01d9a60d15d598ba047428363ef52787743c7b137d53cb850
Opcode Fuzzy Hash: 2c162b85941bc2ac0106ecfc96ecb114432ad78bba981ccd25571f68388f09b1
Instruction Fuzzy Hash: B3714670A00B058FEB24EF29D05475ABBF1FF88304F14892ED54AE7A50DB35E945CB92

Function 04D9A564 Relevance: 1.6, APIs: 1, Instructions: 140
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(00000000,?,00000009,?,?,?,?,?,00000000,?), ref: 04D9C54C

Memory Dump Source

Source File: 00000000.00000002.2110722700.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d90000_7vwfhMuUQg.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: eb24bba2ec2c84d633e892470517eec450d39f58afa93aff8ac0bd41c791891f
Instruction ID: f671a4a42b97ba1610402783847b0c768255c5fc5d6f7ea72503715960dcf814
Opcode Fuzzy Hash: eb24bba2ec2c84d633e892470517eec450d39f58afa93aff8ac0bd41c791891f
Instruction Fuzzy Hash: 6D512571901329DFDF20CF99C944BDDBBB2BF49700F0080AAE948A7250D771AA84CF51

Function 04D9C404 Relevance: 1.6, APIs: 1, Instructions: 139
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(00000000,?,00000009,?,?,?,?,?,00000000,?), ref: 04D9C54C

Memory Dump Source

Source File: 00000000.00000002.2110722700.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d90000_7vwfhMuUQg.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: c0248db5edee9907ae4c5078ae2e5997f8e9bce764b2f3e0d2baa1f46ee06123
Instruction ID: 938f2f81f7252522452ae2cd596d3e73b41ee391772bb1fc0914a62bc8c17800
Opcode Fuzzy Hash: c0248db5edee9907ae4c5078ae2e5997f8e9bce764b2f3e0d2baa1f46ee06123
Instruction Fuzzy Hash: 1D511471901329DFDF20CFA9C944BDDBBB2BF49710F10809AE908A7250DB71AA84CF51

Function 04D93EC0 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04D93F81

Memory Dump Source

Source File: 00000000.00000002.2110722700.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d90000_7vwfhMuUQg.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 68541c28ed2be7ce4664d216013d9c8b7e88fc59d6b06ee74f786ed8eaa562b5
Instruction ID: 4928f83fb7b328636721e5281a76e7fa6c688a5d9a33084b9d119b349ee71ba4
Opcode Fuzzy Hash: 68541c28ed2be7ce4664d216013d9c8b7e88fc59d6b06ee74f786ed8eaa562b5
Instruction Fuzzy Hash: 0241F7B5900309DFDB14CF99C448AAABBF5FB88314F248459E519AB321D774A841CFA1

Function 04D9B5B8 Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 04D9B650

Memory Dump Source

Source File: 00000000.00000002.2110722700.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d90000_7vwfhMuUQg.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: e2f4cf8df882ea6ef8a17e86763faed0bc851f2689c1c42321a66264f744fa48
Instruction ID: c7a4166473c26af5170f0956b2c6e50ee6c0af437b0a5afe6278fea6a40745d2
Opcode Fuzzy Hash: e2f4cf8df882ea6ef8a17e86763faed0bc851f2689c1c42321a66264f744fa48
Instruction Fuzzy Hash: 3B21F7719003499FDF10CFA9D885BEEBBF5BF48310F14842AE558A7240D778A954CB65

Function 04D9B5C0 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 04D9B650

Memory Dump Source

Source File: 00000000.00000002.2110722700.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d90000_7vwfhMuUQg.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 3b88a1a114b9713c985a15dc1ca2494199cee3e1ded02ba8406ec40de23d92ba
Instruction ID: 0b9c2505c644f5ecb685a252a7b9c8c980c156d4cd72ec2be38bf2ab47f692ac
Opcode Fuzzy Hash: 3b88a1a114b9713c985a15dc1ca2494199cee3e1ded02ba8406ec40de23d92ba
Instruction Fuzzy Hash: 9C2102719003499FDF10CFAAD881BEEBBF5BF48310F10842AE918A7240C778A954CBA5

Function 00E8CB58 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00E8CB26,?,?,?,?,?), ref: 00E8CBE7

Memory Dump Source

Source File: 00000000.00000002.2109640579.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_7vwfhMuUQg.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0b25ed859cdf54c5726f80c75404e28a956652f69d7f3103c0e01587c43af59d
Instruction ID: 33b984a4b076a054faf2926cec436b7df350ab5c78877d0ff56806af81c7ddfe
Opcode Fuzzy Hash: 0b25ed859cdf54c5726f80c75404e28a956652f69d7f3103c0e01587c43af59d
Instruction Fuzzy Hash: 662116B5D00249EFDB10CFAAD985ADEBBF5EB49720F24841AE918B3310C3789944CF61

Function 00E8BDE0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00E8CB26,?,?,?,?,?), ref: 00E8CBE7

Memory Dump Source

Source File: 00000000.00000002.2109640579.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_7vwfhMuUQg.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9e65ebe67c64b356707d4675e42d8a85e17faac6f24e5c75d3cacb53295ba2de
Instruction ID: 630cff493a1968c556db8a5147c4c0b239faab35acbc54cc27a64105e516309f
Opcode Fuzzy Hash: 9e65ebe67c64b356707d4675e42d8a85e17faac6f24e5c75d3cacb53295ba2de
Instruction Fuzzy Hash: E52105B5D00649DFDB10CFAAD885ADEBBF4EB49310F20841AE918B3350C374A944CFA5

Function 04D9B4E1 Relevance: 1.6, APIs: 1, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 04D9B566

Memory Dump Source

Source File: 00000000.00000002.2110722700.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d90000_7vwfhMuUQg.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: e54e25eb8211b2b46e4c9cda3aa49a7644e89129bdaac03af8624f7909c4cc65
Instruction ID: 228cee84d552057d33a38ebcf9183d1d40a0a0f2e718d9a340677d9af6e5c3eb
Opcode Fuzzy Hash: e54e25eb8211b2b46e4c9cda3aa49a7644e89129bdaac03af8624f7909c4cc65
Instruction Fuzzy Hash: C3213771D003099FEB50DFAAD4857AEBBF4FF89320F54842AD519A7240CB78A944CFA5

Function 04D9B4E8 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 04D9B566

Memory Dump Source

Source File: 00000000.00000002.2110722700.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d90000_7vwfhMuUQg.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: c484b70063b50b9b78c6f31f432acc9147eda2a3686705d4bf1509621ae5f7fb
Instruction ID: 1277ac7a628973b4d524b756a6247b4de27d55c676769cca207f561b04e6ef8f
Opcode Fuzzy Hash: c484b70063b50b9b78c6f31f432acc9147eda2a3686705d4bf1509621ae5f7fb
Instruction Fuzzy Hash: 1F213471D003098FEB50DFAAD4857AEBBF4BF88320F54842AD519A7240CB78A944CFA5

Function 04D9A588 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,00010002), ref: 04D9C769

Memory Dump Source

Source File: 00000000.00000002.2110722700.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d90000_7vwfhMuUQg.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 208ec46d02ce0b68b93332e48a46c5e8e725fae4d124e85c6bdbd973ce1ddb55
Instruction ID: 68e35132170e10a99b51d79ffe6aade200eaeb443075518f62b9c3826f6e0232
Opcode Fuzzy Hash: 208ec46d02ce0b68b93332e48a46c5e8e725fae4d124e85c6bdbd973ce1ddb55
Instruction Fuzzy Hash: 6D2102B5900709DFDB10CF9AD984AEEBBF4FB09710F50842AE918A3240D378A944CBA5

Function 04D9A570 Relevance: 1.6, APIs: 1, Instructions: 57
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64GetThreadContext.KERNEL32(?,00000000), ref: 04D9C6AB

Memory Dump Source

Source File: 00000000.00000002.2110722700.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d90000_7vwfhMuUQg.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 9f48b58c491f69a330f3a6b81b3d267c6c53a5291151be7e4c7b49b28068bb59
Instruction ID: b7a5896af59f38e7aa266a10f1bc0a40dd2dd0ee611a14ab1e830bda62076274
Opcode Fuzzy Hash: 9f48b58c491f69a330f3a6b81b3d267c6c53a5291151be7e4c7b49b28068bb59
Instruction Fuzzy Hash: 371126B1D106098FDB10DF9AD844BEEBBF4EB88720F558029D418E3250D378A944CFA5

Function 04D9C6F3 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,00010002), ref: 04D9C769

Memory Dump Source

Source File: 00000000.00000002.2110722700.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d90000_7vwfhMuUQg.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 9515469553bbe037c89fbceb8f79c0f1118ea7544997f30aa95094023276a3e2
Instruction ID: d4675763209896a08f56a6a7b06bcc4dc331d70803718aa0d3aafa307fef1144
Opcode Fuzzy Hash: 9515469553bbe037c89fbceb8f79c0f1118ea7544997f30aa95094023276a3e2
Instruction Fuzzy Hash: AE21E2B5800709DFDB10CF9AD984BDEBBF4FB49720F50842AE918A3250C378A944CBA5

Function 04D9C638 Relevance: 1.6, APIs: 1, Instructions: 56
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64GetThreadContext.KERNEL32(?,00000000), ref: 04D9C6AB

Memory Dump Source

Source File: 00000000.00000002.2110722700.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d90000_7vwfhMuUQg.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: dd0f9cbfacd63485b6b0bef7153edd156b2421285721567efba0304815467d7f
Instruction ID: 33f4c8b888ae4b0bdb6ba39933d45f5a415b67f6b9df4932558f0173ead2c6a6
Opcode Fuzzy Hash: dd0f9cbfacd63485b6b0bef7153edd156b2421285721567efba0304815467d7f
Instruction Fuzzy Hash: A81123B2D102099FDB10DF9AD849BDEBBF4EB88720F55802AD418A3250D378A545CFA5

Function 00E8A118 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00E8A961,00000800,00000000,00000000), ref: 00E8AB72

Memory Dump Source

Source File: 00000000.00000002.2109640579.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_7vwfhMuUQg.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 0e5626af9fde9766cce4c97d2492d50115aedd1e349d6a890a7f39fbae6c87d7
Instruction ID: a04fee5164e182c77197241d456366206f1936ec7ff6a8cfd8d2c449a6218b82
Opcode Fuzzy Hash: 0e5626af9fde9766cce4c97d2492d50115aedd1e349d6a890a7f39fbae6c87d7
Instruction Fuzzy Hash: 891103B6800349DFEB10DF9AD444A9EFBF5AB88360F14842AD519B7200C379A944CFA5

Function 04D9B6A8 Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 04D9B71E

Memory Dump Source

Source File: 00000000.00000002.2110722700.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d90000_7vwfhMuUQg.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ee8505feadfe3226c966809a41d93f04f996f5faa40879725c03beb93882a9f4
Instruction ID: 22c14abf49e17ee2fcad9965aa8973fc0a730c3925707c0886d04f47bbbc70b4
Opcode Fuzzy Hash: ee8505feadfe3226c966809a41d93f04f996f5faa40879725c03beb93882a9f4
Instruction Fuzzy Hash: 4C1103729003499FDF10DFAAE845BEEBBF5AF88320F24841AE555A7250C775A940CBA1

Function 00E8AB00 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00E8A961,00000800,00000000,00000000), ref: 00E8AB72

Memory Dump Source

Source File: 00000000.00000002.2109640579.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_7vwfhMuUQg.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f91f3a8c6e02001f5cc696d1ac518c7049e1c094514099bc373f7f7423061608
Instruction ID: 45aeb61d22b2d8fc0126c76d51f320d94fdbdbd9b674ffeffadd341bdc218865
Opcode Fuzzy Hash: f91f3a8c6e02001f5cc696d1ac518c7049e1c094514099bc373f7f7423061608
Instruction Fuzzy Hash: 511114B6D00349CFEB10DF9AD444A9EFBF5AB48310F14842AD529B7640C379A545CFA5

Function 04D9B6B0 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 04D9B71E

Memory Dump Source

Source File: 00000000.00000002.2110722700.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d90000_7vwfhMuUQg.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0d27df32e43d15b309062c3ab4df5cb534980ce4f21d2b20b63eeac68e7b32b9
Instruction ID: b03f4faafdbc1a10c8f4ddee4fa6142bca9eadf5627dcf065536c901ed200609
Opcode Fuzzy Hash: 0d27df32e43d15b309062c3ab4df5cb534980ce4f21d2b20b63eeac68e7b32b9
Instruction Fuzzy Hash: 34111471800349DFDF10DFAAD845BEEBBF5AF88720F24841AE515A7250C775A940CBA5

Function 04D9B769 Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 04D9B7D2

Memory Dump Source

Source File: 00000000.00000002.2110722700.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d90000_7vwfhMuUQg.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 4bb20e60fc551d32294fc786e137f49de898e3af721cabe2046516faa7d4a501
Instruction ID: 7ea54e2586c719f48f007f633af3400172d9b48d606e8b7874c4fe47f23965e3
Opcode Fuzzy Hash: 4bb20e60fc551d32294fc786e137f49de898e3af721cabe2046516faa7d4a501
Instruction Fuzzy Hash: 561128B1D003498FDB10DFAAD4457AEFBF5AF88720F24841AD519A7240CB79A944CBA5

Function 04D9B770 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 04D9B7D2

Memory Dump Source

Source File: 00000000.00000002.2110722700.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d90000_7vwfhMuUQg.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: c5a59ab93e3aa315afaa8c6a2168ebed6d961ccda0b0351a070f7ee65fe2fb08
Instruction ID: e7344af0fcf2c913df7c52045affe1adcf05ee4c86e2bd7a19079df1440a426d
Opcode Fuzzy Hash: c5a59ab93e3aa315afaa8c6a2168ebed6d961ccda0b0351a070f7ee65fe2fb08
Instruction Fuzzy Hash: EE112571D003498FEB10DFAAD4457AEFBF5AF88720F24841AD519A7240CB79A944CBA5

Function 00E8A880 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00E8A8E6

Memory Dump Source

Source File: 00000000.00000002.2109640579.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_7vwfhMuUQg.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ac511a7912ab8155a6698f925f313c8569b5e219b8fb4f33d6eecae5d8ae6d8c
Instruction ID: 44d329968ea45de44c07e29b61bef07c4d0ef314cb303c8ad98d8b91eddedccd
Opcode Fuzzy Hash: ac511a7912ab8155a6698f925f313c8569b5e219b8fb4f33d6eecae5d8ae6d8c
Instruction Fuzzy Hash: 18110FB5C00749CFDB14DF9AD444A9EFBF4EB88324F14842AD428B7200C379A545CFA2

Function 00CED01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109387623.0000000000CED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ced000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cbef50d45eaefcb6410235f3a3b98c418029b84f41859f5e7ddd1d18e8752d6
Instruction ID: bc9d95e6fe90199e2083a6880d3ae510409e545fbe2e2bd1a26b6dfd20d93906
Opcode Fuzzy Hash: 2cbef50d45eaefcb6410235f3a3b98c418029b84f41859f5e7ddd1d18e8752d6
Instruction Fuzzy Hash: 55210471604384EFDB14DF25D9C0B26BB65FB84314F28C56DE90A4B286C33BD847CA62

Function 00CED1EC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109387623.0000000000CED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ced000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97703cd654145f01720758ef2382c540753efb0e3f6fd3a61d65e750bd58baa9
Instruction ID: 5b7ef03277a610e9e3de0671b439185f575486d4d5b731851a0100643294abec
Opcode Fuzzy Hash: 97703cd654145f01720758ef2382c540753efb0e3f6fd3a61d65e750bd58baa9
Instruction Fuzzy Hash: DF210475604384EFDB04DF25D5C0B26BB65FB88314F20C5ADEA0A4B292C37ADC46CAA1

Function 00CED005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109387623.0000000000CED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ced000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 678891d28653862567ae0ceb71cb73d57bdf05cb679451b955696aa5e9e7aedd
Instruction ID: 0a4481da1b64f043e059b010b3bd970eace6e344430ccd6dffd2d5b09b5ad13b
Opcode Fuzzy Hash: 678891d28653862567ae0ceb71cb73d57bdf05cb679451b955696aa5e9e7aedd
Instruction Fuzzy Hash: 43219F755093C09FCB02CF20D990715BF71EB46314F28C5EAD8498F2A7C33A980ACB62

Function 00CED1E7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109387623.0000000000CED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ced000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42a98d763aa616cafc5cdf308aa0cc1e619621035a6359fb41dac703237424f2
Instruction ID: 9fc81b7c480f7b808f90f8de8d411734cbf12f4ca93fe2fc825d878636d318f4
Opcode Fuzzy Hash: 42a98d763aa616cafc5cdf308aa0cc1e619621035a6359fb41dac703237424f2
Instruction Fuzzy Hash: B7119D75904284DFCB05CF50D5C4B15FFA2FB88314F24C6A9D94A4B656C33AD94ACFA2

Non-executed Functions

Function 04D90040 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110722700.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d90000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db73f8ada3d30dda25f447b4257b27a6734bef7736d6669e331f7ec1a69c83d3
Instruction ID: 66796fe064deae8827301015956a58ac454742f136b18fe343551f4eff477db3
Opcode Fuzzy Hash: db73f8ada3d30dda25f447b4257b27a6734bef7736d6669e331f7ec1a69c83d3
Instruction Fuzzy Hash: CF1288B9C827468BD310CF66E98C1893BF1BB65318BD0CB1AD2615F2E1DBB4156ACF44

Function 00E8D3DC Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109640579.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccae06d8924ba70ec56dc5c225c68d297a85b189b6accab21c0a3a1b64aaada8
Instruction ID: 37224af8b9708a6e1b99648b7736fa9f55e0f85d7c98ccc7904b3cc9b372f215
Opcode Fuzzy Hash: ccae06d8924ba70ec56dc5c225c68d297a85b189b6accab21c0a3a1b64aaada8
Instruction Fuzzy Hash: 65A14932E002198FCF19EFA4C84459EB7F2FF85304B15956AE81ABB265DB31E915CB90

Function 04D90007 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110722700.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d90000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 467e2011175d3ab399c6272905663c0250ffa2f7fd348d98008a138ddb9f3657
Instruction ID: 3bdeb6003d650d9e019eea35e661634f2d68bf5c0a42797c25f59c059e8ec9e1
Opcode Fuzzy Hash: 467e2011175d3ab399c6272905663c0250ffa2f7fd348d98008a138ddb9f3657
Instruction Fuzzy Hash: 84C13BB8C827468FD310CF66E8881893BF1FFA5314B918B1BD1616B2D1DBB8156ACF44

Function 00E82560 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109640579.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3262a5f5dc16338da0226749e7f1d1daa890d6169ba78d710fc4888ad2e500d8
Instruction ID: 45a3bd3d3c9dce47ca30e8e0d886c034fa748ba91145db8ee972c6fe3e9b9d15
Opcode Fuzzy Hash: 3262a5f5dc16338da0226749e7f1d1daa890d6169ba78d710fc4888ad2e500d8
Instruction Fuzzy Hash: 04312D62498654CBD732377A08751D01F50D6AB31C74472CEC37CB65E3E4990847D363

Analysis Process: 7vwfhMuUQg.exePID: 6600, Parent PID: 5824COMMON

Executed Functions

Function 00A098B8 Relevance: .9, Instructions: 860COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38aa8753ec04d5777be03629f47d069f102a19a40f5255309dcccfbbb97be5c3
Instruction ID: f0bcab5390838d020c067f66168a5e4fe755f2dabcba92cca8f595c361e03e1c
Opcode Fuzzy Hash: 38aa8753ec04d5777be03629f47d069f102a19a40f5255309dcccfbbb97be5c3
Instruction Fuzzy Hash: 40728E71A0020DDFCB15CF68E984AAEBBF2FF99300F158569E8069B2A1D731ED51CB51

Function 00A06168 Relevance: .5, Instructions: 515COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 566dabe382ce121fd781bc2dc8afb08d33a68b85f375070b243823e6e07f7b0e
Instruction ID: 75061e2ec8d5d5790dbbdc1405291fbce80ee6e24c6e0ceaf1cd9445151ed85c
Opcode Fuzzy Hash: 566dabe382ce121fd781bc2dc8afb08d33a68b85f375070b243823e6e07f7b0e
Instruction Fuzzy Hash: 6C128B70A002199FDB18DF69D854BAEBBF6FF89304F208529E406DB395DB349D51CB90

Function 00A06790 Relevance: .4, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dcad673e0b013ab2a71d41f5348ae44c07a80a7f5bc8083d6a8feac94d5cf65
Instruction ID: 6cea3f53a3b57b122c6af0e1f21928ea4071febd370c1e8ae704cf8f3eb22317
Opcode Fuzzy Hash: 3dcad673e0b013ab2a71d41f5348ae44c07a80a7f5bc8083d6a8feac94d5cf65
Instruction Fuzzy Hash: 71025B70A0021DDFDB14CFA9E984AADBBF6FF89308F158069E445AB2A1D731DC65CB50

Function 00A035C8 Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e215f538c6213fcf0fbb1b67979c4d535c2c22c47ae7450ab47268aaa08db681
Instruction ID: 1c5eeb8e77cf5f5ced10625894dc39e997eb6cccda19962786c34422156b35ab
Opcode Fuzzy Hash: e215f538c6213fcf0fbb1b67979c4d535c2c22c47ae7450ab47268aaa08db681
Instruction Fuzzy Hash: ABF1AE75E042489FDB08DFB9E8546AEBBB6BF89310B14846EE406E7395CF309C06DB50

Function 00A0B388 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ebce55b71a9b516241ab1f7e2a8aca3611e4bc02dcc5ee9549e8ee85a8fbd78
Instruction ID: 02cf27c2605c05a1dc1ab9e15da77099d3ae13802602128356109cf4cf87351b
Opcode Fuzzy Hash: 5ebce55b71a9b516241ab1f7e2a8aca3611e4bc02dcc5ee9549e8ee85a8fbd78
Instruction Fuzzy Hash: A5E1FC75E10218CFDB14CFA9D994A9DBBB1FF49310F1580A9E819AB3A2D731AD41CF60

Function 00A0CA91 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44375990ce4e570037b6f9bd9e82d62599192ecce2732558310902d146b4fcf4
Instruction ID: f59b78c0607bda9362c9eb478a47f852597a2cca52371a1a879272b22ba16d2b
Opcode Fuzzy Hash: 44375990ce4e570037b6f9bd9e82d62599192ecce2732558310902d146b4fcf4
Instruction Fuzzy Hash: D691C374E00218DFEB14DFA9D894A9DBBF2BF89310F14C16AE809AB365DB309945CF50

Function 00A0BC32 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d9b1941a5077c2e5c6e20e310691ea0d2a2814532f2177b82658205f75123d3
Instruction ID: 80c37c6e20be0625d24471bb035031af5d24a0c0f9a1d0a8199826aaa0cb1788
Opcode Fuzzy Hash: 0d9b1941a5077c2e5c6e20e310691ea0d2a2814532f2177b82658205f75123d3
Instruction Fuzzy Hash: E681C574E10218DFDB14DFA9D984A9DBBF2FF88300F148069E419AB3A5DB309946CF50

Function 00A0C7B1 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8fe93b5505b4cfd263248f4d4bda2ba231d72a4762258f734dd2f03efbe9dfb
Instruction ID: 3565a9a98107901ce1a66b39c6ba0d7f359cf92246f173fd1a950094c5ed25e3
Opcode Fuzzy Hash: f8fe93b5505b4cfd263248f4d4bda2ba231d72a4762258f734dd2f03efbe9dfb
Instruction Fuzzy Hash: A381B274E0021CDFDB14DFAAD984A9DBBF2BF88310F248169E819AB365DB305945CF50

Function 00A04B31 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b19a4032902d7c9f3429fb08e502cbf1d553e9ec82f51fd2b6d613f58edc6bd
Instruction ID: 00f141e8f822db77aa49a4c73437e69c5c871efb18773c4716f12e94dd0696e2
Opcode Fuzzy Hash: 4b19a4032902d7c9f3429fb08e502cbf1d553e9ec82f51fd2b6d613f58edc6bd
Instruction Fuzzy Hash: 4B81B274E00218DFEB14DFAAD984A9DBBF2BF88300F148069E919AB365DB349945CF50

Function 00A0BF10 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26914aa836610e7fa07933a1f2b28b1ed681a6944787474d3c1a1e897815d0ce
Instruction ID: 8f78773218a3c7421940c0d4eeb46b836149966d4b17f4a7623a0073f9eb4d00
Opcode Fuzzy Hash: 26914aa836610e7fa07933a1f2b28b1ed681a6944787474d3c1a1e897815d0ce
Instruction Fuzzy Hash: A781B374E00258DFDB14DFA9D984A9DBBF2BF89310F14C169E409AB365DB309986CF50

Function 00A0C1F0 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cb1ab980f38fcd7a49277db1940b3192c99a23bfe8706f11d4070ec9b44ccd6
Instruction ID: c544dfca3adab87d4e6cae12035a8b129f72a48026b27d44933d2850135a0967
Opcode Fuzzy Hash: 1cb1ab980f38fcd7a49277db1940b3192c99a23bfe8706f11d4070ec9b44ccd6
Instruction Fuzzy Hash: E881B174E00218DFDB14DFAAD894A9DBBF2BF88310F24C169E819AB265DB309945CF51

Function 00A0C4D0 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48d8397dab8582406b7ae04787f08c7c33004fb6c205e49eb2b4853088e1c549
Instruction ID: 90a2e675b33db4bdd860a6480551c6644ff77e6216ede5befba67295e958d61e
Opcode Fuzzy Hash: 48d8397dab8582406b7ae04787f08c7c33004fb6c205e49eb2b4853088e1c549
Instruction Fuzzy Hash: A181B074E00218DFDB14DFAAD984A9DBBF2FF88310F24D169E809AB265DB349945CF50

Function 00A0B552 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2099d4ddc70445a36ccc4fd814f4b1b875c5dd1e541d9ada96b5a4127283d9c0
Instruction ID: a57883371713bf3254b03637093368d3d061171caf114da9b72374ebd9683f1c
Opcode Fuzzy Hash: 2099d4ddc70445a36ccc4fd814f4b1b875c5dd1e541d9ada96b5a4127283d9c0
Instruction Fuzzy Hash: EB61B274E00608DFDB14DFAAD984A9DBBF2FF89300F248069E419AB365DB355946CF50

Function 00A07850 Relevance: .7, Instructions: 697COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a5dff28df4d91ee61cf639bdfba291e88039c95cc504def2b7decbc52f0ac7c
Instruction ID: 6bcb7764665d9bb9ed48bdd72514c9ac2dd523444b66b6c2bfb0c87288526ec5
Opcode Fuzzy Hash: 0a5dff28df4d91ee61cf639bdfba291e88039c95cc504def2b7decbc52f0ac7c
Instruction Fuzzy Hash: 42523234A0025CCFEB14DBA4C860BAEBB76FF89701F1080AAD2466B395CF355E859F55

Function 00A021A8 Relevance: .7, Instructions: 678COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71d553bce084ad223a1e650cfdad923e14966c4636f7bd02e0689d8420a7d7bc
Instruction ID: 30816ab509fe78769247422f9ad702739535d56e6ddf3ece5360a67d414ad2ab
Opcode Fuzzy Hash: 71d553bce084ad223a1e650cfdad923e14966c4636f7bd02e0689d8420a7d7bc
Instruction Fuzzy Hash: 2952E46594D3C84EDB234B78A8BC3EA7F71AF5B200B1A19DFC4D24F2A7DA601446D712

Function 00A06EB8 Relevance: .5, Instructions: 477COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12796795d2d6465243275b713d97f2683da37e920dda5f1610ea2676b944a84c
Instruction ID: 523dad06bf0a3f1439a8e4b169ee6d8b107f292bba863429b31f776d2940d296
Opcode Fuzzy Hash: 12796795d2d6465243275b713d97f2683da37e920dda5f1610ea2676b944a84c
Instruction Fuzzy Hash: E0125A30A04249CFCB15CF69E994AAEBBF2FF49314F148599E8499B2A1D731FD41CB90

Function 00A00C8F Relevance: .4, Instructions: 418COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 845e402b1d72dd4fdca0f7357a1a0b4b02cfb588865b13e54354a6873f66c4a1
Instruction ID: e69d769cccd4f0a216a2e6d287258171f59ffcff7a68c9139cc733b57fe185c6
Opcode Fuzzy Hash: 845e402b1d72dd4fdca0f7357a1a0b4b02cfb588865b13e54354a6873f66c4a1
Instruction Fuzzy Hash: 8532FA74A40219DFCB54EF64E894E9DBBB5FF8A300F1185AAD409A7368DB305D4ADF80

Function 00A0A8AF Relevance: .4, Instructions: 410COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4e67b10aa0b2e3dd8067290264a78cd02085b6cfea66d6a3dded52bc65c51bb
Instruction ID: a54eb0a2555f9146bbbcf42a681e3bf15e4a092bab9cbb8108d3a64a47397ebf
Opcode Fuzzy Hash: a4e67b10aa0b2e3dd8067290264a78cd02085b6cfea66d6a3dded52bc65c51bb
Instruction Fuzzy Hash: D1F12A71E00618CFDB04CFA9D584AADBBF6FF99311B168099E419AB3A1C735EC81CB51

Function 00A00CA0 Relevance: .4, Instructions: 410COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa96974d4b2de60b44f9b9c8b6859d646151fb47ada2131438c47d95bac0e190
Instruction ID: eb902cfa2c3306c1faabf8f38a09dc7204bbfac76f928cb96be2b6de2c6c3dae
Opcode Fuzzy Hash: aa96974d4b2de60b44f9b9c8b6859d646151fb47ada2131438c47d95bac0e190
Instruction Fuzzy Hash: D522EB74A00219DFDB54EF64E894E9DBBB5FF8A300F1185AAD409A7368DB305D4ADF80

Function 00A08849 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb0b9f6fe9ac364eddcd1e69da0e2118af59aa67f5b0ee440a79ce9d406a349a
Instruction ID: 0a19b466a311c086c919b45e169362fc7abd467afd16fd9a83c791132e5345d1
Opcode Fuzzy Hash: bb0b9f6fe9ac364eddcd1e69da0e2118af59aa67f5b0ee440a79ce9d406a349a
Instruction Fuzzy Hash: 88B180707042098FEB155F28E958B3D37A9EF95780F1504AAE182CF3E1EE2DCC519B59

Function 00A05700 Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3086abd5452e3f304ab067d27b636e74a585e02b0bca6500d819cbe359c6e90e
Instruction ID: af918643851bc42e3f0bb0a245f80bf452590db275bc4e9ab564c1c25ffd4ebe
Opcode Fuzzy Hash: 3086abd5452e3f304ab067d27b636e74a585e02b0bca6500d819cbe359c6e90e
Instruction Fuzzy Hash: 5BB1CC70B046089FDB159B38E898B6B7BE6EF89350F148929E846CB2D1DB35CC41DF91

Function 00A05C60 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29e3a843efb7c95d64be3780410f9c7db6e17b8d7794e4aaa3593ee7dd8df3f5
Instruction ID: 73486b60325c6619fbc43b7e36bbe3e4b229c5d463c3f978ac88b46b00ce01ef
Opcode Fuzzy Hash: 29e3a843efb7c95d64be3780410f9c7db6e17b8d7794e4aaa3593ee7dd8df3f5
Instruction Fuzzy Hash: 3E815C34E009098FDB18CF79E488AABB7B2BF89304B65816AD405DB3A5D731ED41CF91

Function 00A07498 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16be0a8826e76bc51d1e92f5f15b6f38ca3229e00e30d7ad5d64adef313b8ecf
Instruction ID: ed9166965324d6f4fbeabf7e5bcbad8027d29b4d945bdba6ed0abed85e3ae4cc
Opcode Fuzzy Hash: 16be0a8826e76bc51d1e92f5f15b6f38ca3229e00e30d7ad5d64adef313b8ecf
Instruction Fuzzy Hash: 2F710C34B046098FCB15DF28D894AAD7BEAAF49710F1944A9E406CB3B1DB76EC51CB90

Function 00A0D3C1 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b3c1b5a9656fc77603695d47108559ff28a4beba3dc2b183ea6c8524a8635a4
Instruction ID: bc777d56a0328d3044b4d929035d2d2fb46df9c11a4127d5fbf50de1ff893ca4
Opcode Fuzzy Hash: 4b3c1b5a9656fc77603695d47108559ff28a4beba3dc2b183ea6c8524a8635a4
Instruction Fuzzy Hash: 0651B2B18A574A8FD3103F34BAAE13B7B78FB0F723B41AC10E15E85455CB7204A5CA11

Function 00A0D3D0 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30372da894f9a99452671f5bf41eedacd16fb02914f9a3e21bb628b0ec038bf4
Instruction ID: 49298b2d39b8b502258940e5cb341ea9e7439e81a3c80640f0493f30aea897ce
Opcode Fuzzy Hash: 30372da894f9a99452671f5bf41eedacd16fb02914f9a3e21bb628b0ec038bf4
Instruction Fuzzy Hash: 995181B18A574ACFD3103F34B6AE13B7BB8FB0F727B81AD10E11E854559B7204A5CA15

Function 00A0CD70 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe1d683917ab9acdb2bab6c6e5c6411dcc7409c803d98dc7358f34e94213ac78
Instruction ID: 6159e2951ad266e6717484f3c747c5866b0d06325f7d6ccd350d5f6577c2c54c
Opcode Fuzzy Hash: fe1d683917ab9acdb2bab6c6e5c6411dcc7409c803d98dc7358f34e94213ac78
Instruction Fuzzy Hash: 89519274E01208DFDB48DFA9D98499DBBF2FF89310F20816AE819AB365DB319905CF10

Function 00A03960 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39e2df5855835398fd9b5da4aef2c0eb16f3ecf2a4fc0531e154686e82f5315a
Instruction ID: 7efbb639f11adc497add7eea7437672471e1eed08add7c8dd1b19cca6122594e
Opcode Fuzzy Hash: 39e2df5855835398fd9b5da4aef2c0eb16f3ecf2a4fc0531e154686e82f5315a
Instruction Fuzzy Hash: B8518374E01208DFCB08DFA9E59499DBBB2FF8D310F209569E805AB364DB31A946DF50

Function 00A09AC3 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 683eb8fff1e4f92c3419833bc61aefbb58a26d3372955630d9db7eb2c61caeec
Instruction ID: ec1a8b6a6a1cac1756e9b04f64fa21e26f1fdf75dee6486ecadcc5394d26f90f
Opcode Fuzzy Hash: 683eb8fff1e4f92c3419833bc61aefbb58a26d3372955630d9db7eb2c61caeec
Instruction Fuzzy Hash: CC41AF71A0424DDFDF15CFA5E844A9FBBB2EF4A310F048155E8159B2A2D331E951DB60

Function 00A0A6B0 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd6d7d5600738cf2c6faff5254961ddc15682a98f2a1b0d6ed2cc6be29d1810e
Instruction ID: 1c2ffc8399b8f722b1c2080ff2dd958b957ea852707dfd502bc7d58630a22602
Opcode Fuzzy Hash: cd6d7d5600738cf2c6faff5254961ddc15682a98f2a1b0d6ed2cc6be29d1810e
Instruction Fuzzy Hash: 2641BD76B002089FDB199B69D854AAE7BFAFFCD310F148469E906D7391DE319C02CB91

Function 00A04E20 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9cd2ad03bca3cb382719d8876d7cc16cc145e5190fd8e5119b55145b23b822f
Instruction ID: 08d2434f2b4f3ba02ab9d268ab5529bbf8976fddde1519f9a5208834a1acb6f7
Opcode Fuzzy Hash: b9cd2ad03bca3cb382719d8876d7cc16cc145e5190fd8e5119b55145b23b822f
Instruction Fuzzy Hash: E3318FB160410AAFCF059F68E854AAF7BBAFF8D300F104415FA058B294CB35CD61DBA1

Function 00A07730 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d77ebe4fc03fcbe8bd0060ac66f5d5cd44d48509b456166509dcbbdc966d07a4
Instruction ID: 48e08a5a39e09e2cbc946c1a3b47899fd9b2a43c6cf4a6cb4772210815e5bd29
Opcode Fuzzy Hash: d77ebe4fc03fcbe8bd0060ac66f5d5cd44d48509b456166509dcbbdc966d07a4
Instruction Fuzzy Hash: F621D634F081044BEB151B39A898A7D37ABAFD9758B148479D902CB3D1DE35DC86E7C0

Function 00A07740 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b92987244db6fa05c31c5ca1bf4a5aac626ad14bfcdc8558b172b2f619234b1
Instruction ID: 47909d2ae3402f70864485d7451bf11d4ebcd523d34d3658e14e950cca5e5190
Opcode Fuzzy Hash: 2b92987244db6fa05c31c5ca1bf4a5aac626ad14bfcdc8558b172b2f619234b1
Instruction Fuzzy Hash: 0021A134F081054BEB151B29A89877E769BAFD9758F248438D902CB3D4EE36DC86E7C0

Function 00A05AB8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f8740fd4774141347e61cb64989856db62777b74ed242a4fa5ac927d96a411a
Instruction ID: cc39383e80a814eebcadfd252492748b26aabc3256ef46c6f2c661cda5901c36
Opcode Fuzzy Hash: 0f8740fd4774141347e61cb64989856db62777b74ed242a4fa5ac927d96a411a
Instruction Fuzzy Hash: D821D334B01A158FC7299B79E45492BB7A6FF8A750B15456AE806CF391DF31EC02CF80

Function 00A020B8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 598fcedb57c089864e002ad2af2411a0497ba313fa7f55ba6d4cc2ba04ebcc3f
Instruction ID: d76fa64565475bc7cf735dbe48456b5855aeee88a734ff81e6c29ed8d3b787e1
Opcode Fuzzy Hash: 598fcedb57c089864e002ad2af2411a0497ba313fa7f55ba6d4cc2ba04ebcc3f
Instruction Fuzzy Hash: E621C131A0024AAFCF14DF24D444ABE77A5EF99360F11C519E9099B390DB30EE46CB81

Function 00A0D611 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c952e4fbedf55af4217d5425dabeb56d536e33f723805bb58a4c63f03ad466d
Instruction ID: 6ff5e58d7a8939eaf00fc03b587eb79bee805416c5b92ff85fe55550d5878fd5
Opcode Fuzzy Hash: 4c952e4fbedf55af4217d5425dabeb56d536e33f723805bb58a4c63f03ad466d
Instruction Fuzzy Hash: E6211531D10259CECB11EFE8E8546ECFBB4FF4A301F10922AE45577294EB306A8ADB40

Function 00A0D70F Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adc9e8c920a7cf1b9623ef2814c0f2eb1e5c8ac31596c1d44a26679163ad8ee5
Instruction ID: c4f85370ac7bdc865d0239f355298bcf9d44ea598b60b22b05077a25ccf54bb8
Opcode Fuzzy Hash: adc9e8c920a7cf1b9623ef2814c0f2eb1e5c8ac31596c1d44a26679163ad8ee5
Instruction Fuzzy Hash: 6E216834A462088FCB05DFB4E840AEEB7B6FF8A300F105069C805B73A4CB359906CF24

Function 00A04E11 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 540ac6cd04c0a3fbbd734b0f583147de9c6877fc55db3d24e36a436064acf0ab
Instruction ID: 6c3efcbf732647df5dcf96a20f7d0c1d41dcee0cbe3bc2bbd6a6d151cd7815b8
Opcode Fuzzy Hash: 540ac6cd04c0a3fbbd734b0f583147de9c6877fc55db3d24e36a436064acf0ab
Instruction Fuzzy Hash: 1C21CFB1A042499FCB159F68E454AAB3BB6FF89310F10446AFA058B291CB35CE56DB90

Function 00A0D720 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4661f1186482cc7ee637c606c8bbc95bb56610c6542f4d2fe0f6a1fceb985e05
Instruction ID: 648dd8cc3ec00787cadba22973865b615efd0511e59ad194edae7dd7ca92bb04
Opcode Fuzzy Hash: 4661f1186482cc7ee637c606c8bbc95bb56610c6542f4d2fe0f6a1fceb985e05
Instruction Fuzzy Hash: A621F235A022098FCB04EFB4E840AEEB7B6FB89300F109529D405B73A4DB359946CF64

Function 00A05AC8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 811b337bca40160d44cd3a8e4cb3d2ce80ddf57e6744e9f7585a02115622d7e8
Instruction ID: f88cea8d42223cefd6c08a8c7cccde0e6bb5fb138f061aaa254d6202688fc745
Opcode Fuzzy Hash: 811b337bca40160d44cd3a8e4cb3d2ce80ddf57e6744e9f7585a02115622d7e8
Instruction Fuzzy Hash: 9511C235B019168BC7199B39E85892BB7AAFF867517154569E806CB390DF21EC02CF80

Function 00A01FB8 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 446de035c838ef6f0ae653d3ad64479788910e481965e6e238b6b0c44d1acf4b
Instruction ID: 8a02bb4e9b15814663dd742c237bfc519e79d6798eb0748ea2c41640b8746d19
Opcode Fuzzy Hash: 446de035c838ef6f0ae653d3ad64479788910e481965e6e238b6b0c44d1acf4b
Instruction Fuzzy Hash: 6521EEB4C0520A8FCB00EFA8D9955EEBBF4FF4A301F10556AD815B3260EB341A56CFA1

Function 00A0565F Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 281ea35867f78613df50105e746c9fff7a21b22ab6220f53820fbc2415f4f662
Instruction ID: f0d9436f91874b3bf67f6e219340508e703cc44dd658be03b8ca7f31e9a68b82
Opcode Fuzzy Hash: 281ea35867f78613df50105e746c9fff7a21b22ab6220f53820fbc2415f4f662
Instruction Fuzzy Hash: 9401D671B001085FCF068E7898106EF3FBBDFCA351B18806AF414CB281CA368D529B90

Function 00A02068 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6589dbab9058e1d3d95c2330405b6b0a4f8eb1c987ea6ef66b2ea3231635df4c
Instruction ID: 3c71c3b0e354af1a2fb75f6b1ed9617cf448855cb5264b4d3911552aeeaf198f
Opcode Fuzzy Hash: 6589dbab9058e1d3d95c2330405b6b0a4f8eb1c987ea6ef66b2ea3231635df4c
Instruction Fuzzy Hash: C5E0D8319152D64EC71297B498540EEBF34EED7220B0546BBD8907B041EB34251FC761

Function 00A02078 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96bab5a188ee9a6bbc43e45246b3d9b1c08836d2c6e6bd0d9516049537eab417
Instruction ID: 76d11c61ae604af78a2df147a7dd9ff603c47e304809cef8dd32cb21c2aae4f9
Opcode Fuzzy Hash: 96bab5a188ee9a6bbc43e45246b3d9b1c08836d2c6e6bd0d9516049537eab417
Instruction Fuzzy Hash: 16D05B31D2126B57CB00E7A5DC044EFF738EED5661B544626D51437140FB702659C7E1

Function 00A082B8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: b3e389353bdbf6eb8ca9f5683c15a005f7782aa419da7c9323451d0d1d5b602e
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: 1AC08C7320C22C2AE234508E7C41EE3BB8CC3D57B4A210137FAACE7381AC469C8001F9

Function 00A0A76D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 075d4fd5b99c16bf2509928d23ba0bfdc3483a91f10d07da7c15ae06225f9d7d
Instruction ID: f5ddf51aff95ec921f8234037305f6a1fbad593c4c32733dde900ebfaa2c6784
Opcode Fuzzy Hash: 075d4fd5b99c16bf2509928d23ba0bfdc3483a91f10d07da7c15ae06225f9d7d
Instruction Fuzzy Hash: B4D067BBB411089FDF049F99EC409DDB7B6FB9C221B448516E915A3260C6319921DB60

Function 00A05F00 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a764bc47c3cab44c42ea8b454be31f397247cb7eabfabf6fd31c8b06857db5f
Instruction ID: 740fafa5337760ab7a8cb6cbd669d730746dc0ed9d45e1c3942eca957c795b68
Opcode Fuzzy Hash: 5a764bc47c3cab44c42ea8b454be31f397247cb7eabfabf6fd31c8b06857db5f
Instruction Fuzzy Hash: 28D0C2304183469BDB02BB34F9205543F39AA86304B8001A7A8044D01BFA740949C792

Function 00A05F10 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3958156481.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_7vwfhMuUQg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 691654f30ffc2dcb1555f9966506fdbd1236c776785af6fd39159345e0fb1c42
Instruction ID: 968e1bc2ba04a3e9dab544a0c9c9ac90078c21ddf913e7a3e13539479d328f34
Opcode Fuzzy Hash: 691654f30ffc2dcb1555f9966506fdbd1236c776785af6fd39159345e0fb1c42
Instruction Fuzzy Hash: 48C0123052430A97DA01F775F955A953B3EFAC5300F405626B5094D129EF741A499691

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 7vwfhMuUQg.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\7vwfhMuUQg.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
7vwfhMuUQg.exe

Function 04D9B8E0 Relevance: 1.9, Strings: 1, Instructions: 615
COMMON

Function 00E8A690 Relevance: 1.7, APIs: 1, Instructions: 193
COMMON

Function 04D9A564 Relevance: 1.6, APIs: 1, Instructions: 140
processCOMMON

Function 04D9C404 Relevance: 1.6, APIs: 1, Instructions: 139
processCOMMON

Function 04D93EC0 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Function 04D9B5B8 Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Function 04D9B5C0 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Function 00E8CB58 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Function 00E8BDE0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 04D9B4E1 Relevance: 1.6, APIs: 1, Instructions: 65
threadCOMMON

Function 04D9B4E8 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Function 04D9A588 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Function 04D9A570 Relevance: 1.6, APIs: 1, Instructions: 57
threadCOMMON

Function 04D9C638 Relevance: 1.6, APIs: 1, Instructions: 56
threadCOMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre