Edit tour

Windows Analysis Report
Ddj3E3qerh.exe

Overview

General Information

Sample name:	Ddj3E3qerh.exe renamed because original name is a hash value
Original sample name:	88ec98143583ec8e9c2ab137463322ce04bfb1a03f112fe1fb0d09ad502a1429.exe
Analysis ID:	1588297
MD5:	0a6d497237dc22f74fa9eb514ef6aef1
SHA1:	99ced63b28ed88283f8b293d1a4804acb22cf01c
SHA256:	88ec98143583ec8e9c2ab137463322ce04bfb1a03f112fe1fb0d09ad502a1429
Tags:	exeSnakeKeyloggeruser-adrian__luca
Infos:

Detection

Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Snake Keylogger

AI detected suspicious sample

Machine Learning detection for sample

Self deletion via cmd or bat file

Tries to detect the country of the analysis system (by using the IP)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Ddj3E3qerh.exe (PID: 7644 cmdline: "C:\Users\user\Desktop\Ddj3E3qerh.exe" MD5: 0A6D497237DC22F74FA9EB514EF6AEF1)

cmd.exe (PID: 6248 cmdline: "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\Ddj3E3qerh.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

choice.exe (PID: 8180 cmdline: choice /C Y /N /D Y /T 3 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Telegram URL": "https://api.telegram.org/bot7692220058:AAEny12fSzuKXI7iNJaESECu5UR80nmwLAQ/sendMessage?chat_id=7342994424", "Token": "7692220058:AAEny12fSzuKXI7iNJaESECu5UR80nmwLAQ", "Chat_id": "7342994424", "Version": "5.1"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Ddj3E3qerh.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Ddj3E3qerh.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
Ddj3E3qerh.exe	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Ddj3E3qerh.exe	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14bcf:$a1: get_encryptedPassword 0x14ebb:$a2: get_encryptedUsername 0x149db:$a3: get_timePasswordChanged 0x14ad6:$a4: get_passwordField 0x14be5:$a5: set_encryptedPassword 0x1623c:$a7: get_logins 0x1619f:$a10: KeyLoggerEventArgs 0x15e0a:$a11: KeyLoggerEventArgsEventHandler
Ddj3E3qerh.exe	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c51c:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b74e:$a3: \Google\Chrome\User Data\Default\Login Data 0x1bb81:$a4: \Orbitum\User Data\Default\Login Data 0x1cbc0:$a5: \Kometa\User Data\Default\Login Data
Ddj3E3qerh.exe	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x157af:$s1: UnHook 0x157b6:$s2: SetHook 0x157be:$s3: CallNextHook 0x157cb:$s4: _hook
Ddj3E3qerh.exe	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19b54:$x1: $%SMTPDV$ 0x18538:$x2: $#TheHashHere%& 0x19afc:$x3: %FTPDV$ 0x184d8:$x4: $%TelegramDv$ 0x15e0a:$x5: KeyLoggerEventArgs 0x1619f:$x5: KeyLoggerEventArgs 0x19b20:$m2: Clipboard Logs ID 0x19d5e:$m2: Screenshot Logs ID 0x19e6e:$m2: keystroke Logs ID 0x1a148:$m3: SnakePW 0x19d36:$m4: \SnakeKeylogger\
Click to see the 2 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1316295496.0000000000282000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.1316295496.0000000000282000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000000.1316295496.0000000000282000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x149cf:$a1: get_encryptedPassword 0x14cbb:$a2: get_encryptedUsername 0x147db:$a3: get_timePasswordChanged 0x148d6:$a4: get_passwordField 0x149e5:$a5: set_encryptedPassword 0x1603c:$a7: get_logins 0x15f9f:$a10: KeyLoggerEventArgs 0x15c0a:$a11: KeyLoggerEventArgsEventHandler
00000000.00000000.1316295496.0000000000282000.00000002.00000001.01000000.00000003.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19954:$x1: $%SMTPDV$ 0x18338:$x2: $#TheHashHere%& 0x198fc:$x3: %FTPDV$ 0x182d8:$x4: $%TelegramDv$ 0x15c0a:$x5: KeyLoggerEventArgs 0x15f9f:$x5: KeyLoggerEventArgs 0x19920:$m2: Clipboard Logs ID 0x19b5e:$m2: Screenshot Logs ID 0x19c6e:$m2: keystroke Logs ID 0x19f48:$m3: SnakePW 0x19b36:$m4: \SnakeKeylogger\
00000000.00000002.1616729861.00000000025F1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: Ddj3E3qerh.exe PID: 7644	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Ddj3E3qerh.exe PID: 7644	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: Ddj3E3qerh.exe PID: 7644	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x26be9:$a1: get_encryptedPassword 0x26ecb:$a2: get_encryptedUsername 0x269ff:$a3: get_timePasswordChanged 0x26afa:$a4: get_passwordField 0x26bff:$a5: set_encryptedPassword 0x290d5:$a7: get_logins 0x29038:$a10: KeyLoggerEventArgs 0x28ca3:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: Ddj3E3qerh.exe PID: 7644	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x28ca3:$x5: KeyLoggerEventArgs 0x29038:$x5: KeyLoggerEventArgs 0x2993f:$x5: KeyLoggerEventArgs 0x29ca0:$x5: KeyLoggerEventArgs 0x2b264:$m2: Clipboard Logs ID 0x2b36a:$m2: Screenshot Logs ID 0x2b3c0:$m2: keystroke Logs ID 0x2b4f5:$m3: SnakePW 0x2b356:$m4: \SnakeKeylogger\
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.Ddj3E3qerh.exe.280000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.Ddj3E3qerh.exe.280000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.Ddj3E3qerh.exe.280000.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.0.Ddj3E3qerh.exe.280000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14bcf:$a1: get_encryptedPassword 0x14ebb:$a2: get_encryptedUsername 0x149db:$a3: get_timePasswordChanged 0x14ad6:$a4: get_passwordField 0x14be5:$a5: set_encryptedPassword 0x1623c:$a7: get_logins 0x1619f:$a10: KeyLoggerEventArgs 0x15e0a:$a11: KeyLoggerEventArgsEventHandler
0.0.Ddj3E3qerh.exe.280000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c51c:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b74e:$a3: \Google\Chrome\User Data\Default\Login Data 0x1bb81:$a4: \Orbitum\User Data\Default\Login Data 0x1cbc0:$a5: \Kometa\User Data\Default\Login Data
0.0.Ddj3E3qerh.exe.280000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x157af:$s1: UnHook 0x157b6:$s2: SetHook 0x157be:$s3: CallNextHook 0x157cb:$s4: _hook
0.0.Ddj3E3qerh.exe.280000.0.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19b54:$x1: $%SMTPDV$ 0x18538:$x2: $#TheHashHere%& 0x19afc:$x3: %FTPDV$ 0x184d8:$x4: $%TelegramDv$ 0x15e0a:$x5: KeyLoggerEventArgs 0x1619f:$x5: KeyLoggerEventArgs 0x19b20:$m2: Clipboard Logs ID 0x19d5e:$m2: Screenshot Logs ID 0x19e6e:$m2: keystroke Logs ID 0x1a148:$m3: SnakePW 0x19d36:$m4: \SnakeKeylogger\
Click to see the 2 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:40:28.147802+0100	2803305	3	Unknown Traffic	192.168.2.10	49817	104.21.96.1	443	TCP
2025-01-10T23:40:34.147765+0100	2803305	3	Unknown Traffic	192.168.2.10	49861	104.21.16.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:40:24.249618+0100	2803274	2	Potentially Bad Traffic	192.168.2.10	49722	132.226.247.73	80	TCP
2025-01-10T23:40:26.812425+0100	2803274	2	Potentially Bad Traffic	192.168.2.10	49722	132.226.247.73	80	TCP
2025-01-10T23:40:28.921505+0100	2803274	2	Potentially Bad Traffic	192.168.2.10	49821	132.226.247.73	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Ddj3E3qerh.exe

Avira: detected

Found malware configuration

Source: 00000000.00000002.1616729861.00000000025F1000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Telegram URL": "https://api.telegram.org/bot7692220058:AAEny12fSzuKXI7iNJaESECu5UR80nmwLAQ/sendMessage?chat_id=7342994424", "Token": "7692220058:AAEny12fSzuKXI7iNJaESECu5UR80nmwLAQ", "Chat_id": "7342994424", "Version": "5.1"}

Multi AV Scanner detection for submitted file

Source: Ddj3E3qerh.exe	Virustotal: Detection: 69%			Perma Link
Source: Ddj3E3qerh.exe	ReversingLabs: Detection: 91%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Ddj3E3qerh.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: Ddj3E3qerh.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.10:49798 version: TLS 1.0

Source: Ddj3E3qerh.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Yara detected Generic Downloader

Source: Yara match	File source: Ddj3E3qerh.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Ddj3E3qerh.exe.280000.0.unpack, type: UNPACKEDPE

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.16.1 104.21.16.1
Source: Joe Sandbox View	IP Address: 104.21.96.1 104.21.96.1
Source: Joe Sandbox View	IP Address: 104.21.96.1 104.21.96.1
Source: Joe Sandbox View	IP Address: 132.226.247.73 132.226.247.73

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.10:49821 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.10:49722 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.10:49817 -> 104.21.96.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.10:49861 -> 104.21.16.1:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.10:49798 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: Ddj3E3qerh.exe, 00000000.00000002.1616729861.00000000027A9000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.000000000276D000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.00000000026BF000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.000000000277B000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.0000000002752000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.00000000027B7000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.000000000275F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: Ddj3E3qerh.exe, 00000000.00000002.1616729861.00000000027A9000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.000000000276D000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.00000000026B3000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.0000000002702000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.00000000026BF000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.000000000277B000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.0000000002752000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.0000000002789000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.00000000027B7000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.000000000275F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: Ddj3E3qerh.exe, 00000000.00000002.1616729861.00000000025F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: Ddj3E3qerh.exe	String found in binary or memory: http://checkip.dyndns.org/q
Source: Ddj3E3qerh.exe, 00000000.00000002.1616729861.00000000027A9000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.000000000276D000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.00000000026D7000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.000000000277B000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.0000000002752000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.00000000027B7000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.000000000275F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: Ddj3E3qerh.exe, 00000000.00000002.1616729861.00000000025F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Ddj3E3qerh.exe, 00000000.00000002.1616729861.00000000027A9000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.000000000276D000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.0000000002702000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.00000000026BF000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.000000000277B000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.0000000002752000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.00000000027B7000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.000000000275F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: Ddj3E3qerh.exe	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: Ddj3E3qerh.exe, 00000000.00000002.1616729861.000000000275F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: Ddj3E3qerh.exe, 00000000.00000002.1616729861.00000000027A9000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.000000000276D000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.0000000002702000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.000000000277B000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.0000000002752000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.00000000027B7000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.000000000275F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911

System Summary

Malicious sample detected (through community Yara rule)

Source: Ddj3E3qerh.exe, type: SAMPLE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Ddj3E3qerh.exe, type: SAMPLE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: Ddj3E3qerh.exe, type: SAMPLE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: Ddj3E3qerh.exe, type: SAMPLE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.0.Ddj3E3qerh.exe.280000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.0.Ddj3E3qerh.exe.280000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.0.Ddj3E3qerh.exe.280000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.0.Ddj3E3qerh.exe.280000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000000.1316295496.0000000000282000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000000.1316295496.0000000000282000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: Ddj3E3qerh.exe PID: 7644, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: Ddj3E3qerh.exe PID: 7644, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen

Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Code function: 0_2_008CC197	0_2_008CC197
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Code function: 0_2_008C6108	0_2_008C6108
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Code function: 0_2_008CB328	0_2_008CB328
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Code function: 0_2_008CC470	0_2_008CC470
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Code function: 0_2_008C6730	0_2_008C6730
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Code function: 0_2_008CC753	0_2_008CC753
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Code function: 0_2_008C9858	0_2_008C9858
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Code function: 0_2_008C4AD9	0_2_008C4AD9
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Code function: 0_2_008CCA33	0_2_008CCA33
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Code function: 0_2_008CBBD3	0_2_008CBBD3
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Code function: 0_2_008CBEB7	0_2_008CBEB7
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Code function: 0_2_008CB4F3	0_2_008CB4F3
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Code function: 0_2_008C3573	0_2_008C3573

Source: Ddj3E3qerh.exe, 00000000.00000002.1616097570.0000000000A1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Ddj3E3qerh.exe
Source: Ddj3E3qerh.exe, 00000000.00000000.1316295496.0000000000282000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs Ddj3E3qerh.exe
Source: Ddj3E3qerh.exe	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs Ddj3E3qerh.exe

Source: Ddj3E3qerh.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Ddj3E3qerh.exe, type: SAMPLE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Ddj3E3qerh.exe, type: SAMPLE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Ddj3E3qerh.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: Ddj3E3qerh.exe, type: SAMPLE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.0.Ddj3E3qerh.exe.280000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.0.Ddj3E3qerh.exe.280000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.Ddj3E3qerh.exe.280000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.0.Ddj3E3qerh.exe.280000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000000.1316295496.0000000000282000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000000.1316295496.0000000000282000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: Ddj3E3qerh.exe PID: 7644, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: Ddj3E3qerh.exe PID: 7644, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger

Source: classification engine

Classification label: mal100.troj.winEXE@6/1@3/3

Source: C:\Users\user\Desktop\Ddj3E3qerh.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Ddj3E3qerh.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6180:120:WilError_03

Source: Ddj3E3qerh.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Ddj3E3qerh.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%

Source: C:\Users\user\Desktop\Ddj3E3qerh.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Ddj3E3qerh.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Ddj3E3qerh.exe	Virustotal: Detection: 69%
Source: Ddj3E3qerh.exe	ReversingLabs: Detection: 91%

Source: Ddj3E3qerh.exe

String found in binary or memory: F-Stopw

Source: unknown	Process created: C:\Users\user\Desktop\Ddj3E3qerh.exe "C:\Users\user\Desktop\Ddj3E3qerh.exe"
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\Ddj3E3qerh.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /C Y /N /D Y /T 3
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\Ddj3E3qerh.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /C Y /N /D Y /T 3	Jump to behavior

Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior

Source: Ddj3E3qerh.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Ddj3E3qerh.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Hooking and other Techniques for Hiding and Protection

Self deletion via cmd or bat file

Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process created: "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\Ddj3E3qerh.exe"
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process created: "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\Ddj3E3qerh.exe"			Jump to behavior

Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Memory allocated: 8C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Memory allocated: 25F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Memory allocated: 2400000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 599277	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 599170	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 599044	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 598937	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 598828	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 598717	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 598609	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 598500	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 598390	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 598280	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 598172	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 598062	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 597953	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 597843	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 597734	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 597625	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 597515	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 597406	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 597296	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 597187	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 597078	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 596968	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 596859	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 596750	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 596640	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 596531	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 596422	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 596312	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 596203	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 596094	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 595969	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 595750	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 595640	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 595531	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 595422	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 595309	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 595203	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 595094	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 594969	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 594745	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 594640	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 594531	Jump to behavior

Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Window / User API: threadDelayed 1718			Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Window / User API: threadDelayed 8139			Jump to behavior

Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -29514790517935264s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 3472	Thread sleep count: 1718 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 3472	Thread sleep count: 8139 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -599277s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -599170s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -599044s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -598937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -598828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -598717s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -598609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -598500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -598390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -598280s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -598172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -598062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -597953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -597843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -597734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -597625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -597515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -597406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -597296s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -597187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -597078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -596968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -596859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -596750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -596640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -596531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -596422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -596312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -596203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -596094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -595969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -595859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -595750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -595640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -595531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -595422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -595309s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -595203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -595094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -594969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -594859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -594745s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -594640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe TID: 6220	Thread sleep time: -594531s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 599277	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 599170	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 599044	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 598937	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 598828	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 598717	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 598609	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 598500	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 598390	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 598280	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 598172	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 598062	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 597953	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 597843	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 597734	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 597625	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 597515	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 597406	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 597296	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 597187	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 597078	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 596968	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 596859	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 596750	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 596640	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 596531	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 596422	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 596312	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 596203	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 596094	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 595969	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 595750	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 595640	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 595531	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 595422	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 595309	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 595203	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 595094	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 594969	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 594745	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 594640	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Thread delayed: delay time: 594531	Jump to behavior

Source: Ddj3E3qerh.exe, 00000000.00000002.1616166621.0000000000A51000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll|

Source: C:\Users\user\Desktop\Ddj3E3qerh.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Ddj3E3qerh.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Ddj3E3qerh.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\Ddj3E3qerh.exe"			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /C Y /N /D Y /T 3			Jump to behavior

Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Queries volume information: C:\Users\user\Desktop\Ddj3E3qerh.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Ddj3E3qerh.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Ddj3E3qerh.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: Ddj3E3qerh.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Ddj3E3qerh.exe.280000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1316295496.0000000000282000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1616729861.00000000025F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Ddj3E3qerh.exe PID: 7644, type: MEMORYSTR

Source: Yara match	File source: Ddj3E3qerh.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Ddj3E3qerh.exe.280000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1316295496.0000000000282000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Ddj3E3qerh.exe PID: 7644, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: Ddj3E3qerh.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Ddj3E3qerh.exe.280000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1316295496.0000000000282000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1616729861.00000000025F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Ddj3E3qerh.exe PID: 7644, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	12 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Ddj3E3qerh.exe	69%	Virustotal		Browse
Ddj3E3qerh.exe	92%	ReversingLabs	Win32.Keylogger.NotFound
Ddj3E3qerh.exe	100%	Avira	TR/ATRAPS.Gen
Ddj3E3qerh.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
reallyfreegeoip.org	104.21.96.1	true	false	high
checkip.dyndns.com	132.226.247.73	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false		high
https://reallyfreegeoip.org/xml/8.46.123.189	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://reallyfreegeoip.org	Ddj3E3qerh.exe, 00000000.00000002.1616729861.00000000027A9000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.000000000276D000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.0000000002702000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.00000000026BF000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.000000000277B000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.0000000002752000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.00000000027B7000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.000000000275F000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	Ddj3E3qerh.exe, 00000000.00000002.1616729861.00000000027A9000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.000000000276D000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.00000000026B3000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.0000000002702000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.00000000026BF000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.000000000277B000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.0000000002752000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.0000000002789000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.00000000027B7000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.000000000275F000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.com	Ddj3E3qerh.exe, 00000000.00000002.1616729861.00000000027A9000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.000000000276D000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.00000000026BF000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.000000000277B000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.0000000002752000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.00000000027B7000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.000000000275F000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Ddj3E3qerh.exe, 00000000.00000002.1616729861.00000000025F1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/q	Ddj3E3qerh.exe	false	high
https://reallyfreegeoip.org/xml/8.46.123.189$	Ddj3E3qerh.exe, 00000000.00000002.1616729861.00000000027A9000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.000000000276D000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.0000000002702000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.000000000277B000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.0000000002752000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.00000000027B7000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.000000000275F000.00000004.00000800.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.org	Ddj3E3qerh.exe, 00000000.00000002.1616729861.00000000027A9000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.000000000276D000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.00000000026D7000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.000000000277B000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.0000000002752000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.00000000027B7000.00000004.00000800.00020000.00000000.sdmp, Ddj3E3qerh.exe, 00000000.00000002.1616729861.000000000275F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	Ddj3E3qerh.exe	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.16.1	unknown	United States	13335	CLOUDFLARENETUS	false
104.21.96.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
132.226.247.73	checkip.dyndns.com	United States	16989	UTMEMUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588297
Start date and time:	2025-01-10 23:39:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Ddj3E3qerh.exe renamed because original name is a hash value
Original Sample Name:	88ec98143583ec8e9c2ab137463322ce04bfb1a03f112fe1fb0d09ad502a1429.exe
Detection:	MAL
Classification:	mal100.troj.winEXE@6/1@3/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 53 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 52.149.20.212
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Ddj3E3qerh.exe, PID 7644 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:40:25	API Interceptor	130x Sleep call for process: Ddj3E3qerh.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.16.1	NFhRxwbegd.exe	Get hash	malicious	FormBook	Browse	www.kkpmoneysocial.top/86am/
104.21.16.1	JNKHlxGvw4.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	188387cm.n9shteam.in/videolinePipeHttplowProcessorgamelocalTemp.php
104.21.96.1	gH3LlhcRzg.exe	Get hash	malicious	FormBook	Browse	www.dejikenkyu.cyou/58m5/
	EIvidclKOb.exe	Get hash	malicious	FormBook	Browse	www.mffnow.info/0pqe/
	zE1VxVoZ3W.exe	Get hash	malicious	FormBook	Browse	www.aonline.top/fqlg/
	QUOTATION#070125-ELITE MARINE .exe	Get hash	malicious	FormBook	Browse	www.mzkd6gp5.top/3u0p/
	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	pelisplus.so/administrator/index.php
	Recibos.exe	Get hash	malicious	FormBook	Browse	www.mffnow.info/1a34/
132.226.247.73	6cicUo3f8g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	rXKfKM0T49.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	4Vx2rUlb0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	9Yn5tjyOgT.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	JgE2YgxSzB.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	upXUt2jZ0S.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	2CQ2zMn0hb.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	6mGpn6kupm.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	oEQp0EklDb.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	6cicUo3f8g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	PK5pHX4Gu5.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.64.1
	7b4Iaf58Rp.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.80.1
	C5JLkBS1CX.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	rXKfKM0T49.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
	4Vx2rUlb0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.112.1
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	b5BQbAhwVD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.80.1
	UF7jzc7ETP.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	9Yn5tjyOgT.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
s-part-0017.t-0009.t-msedge.net	WN9uCxgU1T.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	Full-Ver_Setup.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.45
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	13.107.246.45
	Qz8OEUxYuH.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	ztcrKv3zFz.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	gH3LlhcRzg.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	3j7f6Bv4FT.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	rComprobante_swift_8676534657698632.exe	Get hash	malicious	AgentTesla	Browse	13.107.246.45
	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	13.107.246.45
	iRmpdWgpoF.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
checkip.dyndns.com	6cicUo3f8g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	PK5pHX4Gu5.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	7b4Iaf58Rp.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	C5JLkBS1CX.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	rXKfKM0T49.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	4Vx2rUlb0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	b5BQbAhwVD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.8.169
	UF7jzc7ETP.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	9Yn5tjyOgT.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Setup.exe	Get hash	malicious	Unknown	Browse	104.21.80.1
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.162.153
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.223.109
	6cicUo3f8g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	PK5pHX4Gu5.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.64.1
	Full-Ver_Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.11.60
	7b4Iaf58Rp.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.80.1
	C5JLkBS1CX.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	rXKfKM0T49.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
	4Vx2rUlb0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.112.1
CLOUDFLARENETUS	Setup.exe	Get hash	malicious	Unknown	Browse	104.21.80.1
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.162.153
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.223.109
	6cicUo3f8g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	PK5pHX4Gu5.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.64.1
	Full-Ver_Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.11.60
	7b4Iaf58Rp.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.80.1
	C5JLkBS1CX.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	rXKfKM0T49.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
	4Vx2rUlb0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.112.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	6cicUo3f8g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	PK5pHX4Gu5.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	7b4Iaf58Rp.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.96.1
	C5JLkBS1CX.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	rXKfKM0T49.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
	4Vx2rUlb0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.96.1
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	b5BQbAhwVD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
	UF7jzc7ETP.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	9Yn5tjyOgT.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Ddj3E3qerh.exe.log

Download File

Process:	C:\Users\user\Desktop\Ddj3E3qerh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1039
Entropy (8bit):	5.353332853270839
Encrypted:	false
SSDEEP:	24:ML9E4KiE4Ko84qXKDE4KhKiKhPKIE4oKNzKoZAE4KzeR:MxHKiHKoviYHKh3oPtHo6hAHKzeR
MD5:	A4AF0F36EC4E0C69DC0F860C891E8BBE
SHA1:	28DD81A1EDDF71CBCBF86DA986E047279EF097CD
SHA-256:	B038D4342E4DD96217BD90CFE32581FCCB381C5C2E6FF257CD32854F840D1FDE
SHA-512:	A675D3E9DB5BDD325A22E82C6BCDBD5409D7A34453DAAEB0E37206BE982C388547E1BDF22DC70393C69D0CE55635E2364502572C3AD2E6753A56A5C3893F6D69
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.827490492485909
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.79% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01%
File name:	Ddj3E3qerh.exe
File size:	134'144 bytes
MD5:	0a6d497237dc22f74fa9eb514ef6aef1
SHA1:	99ced63b28ed88283f8b293d1a4804acb22cf01c
SHA256:	88ec98143583ec8e9c2ab137463322ce04bfb1a03f112fe1fb0d09ad502a1429
SHA512:	4764ea38a57f5617ef748bc52cb9c6a0aa8c435dfd6dfdec993ecf113d3bd1e413b95c49b94424e5eb9256f525328746a894f8322ca8a4a3817a6c6a1243c6c3
SSDEEP:	3072:y99yINAgKjV545jbvk5Hbe7fMuJN07TBqKj+EmfJ9K4b5bPmmmWMIwvcXvQgbY:1INAgKjV5Cjbvk5Hbe7fMuJN07T49K49
TLSH:	D9D31A1927E49814E1FF99730271A111C7BAF8131A26DF1D1BC2F8692A7D6D1CE0AF93
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....-.f..............P.................. ... ....@.. .......................`............@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x42142e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66972DD9 [Wed Jul 17 02:35:05 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x213d4	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x22000	0x108f	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x1f434	0x1f600	b5f6da105e0bdfa55e2ee028c737a23f	False	0.35525087151394424	data	5.840469572542788	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x22000	0x108f	0x1200	f59392b7fa5e8b22ad0c6b19a0b07c20	False	0.3663194444444444	data	4.868462934974607	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x24000	0xc	0x200	378513806a7b2efb061376f2f8071fd8	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x220a0	0x394	OpenPGP Secret Key			0.42358078602620086
RT_MANIFEST	0x22434	0xc5b	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.3926651912741069

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T23:40:24.249618+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.10	49722	132.226.247.73	80	TCP
2025-01-10T23:40:26.812425+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.10	49722	132.226.247.73	80	TCP
2025-01-10T23:40:28.147802+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.10	49817	104.21.96.1	443	TCP
2025-01-10T23:40:28.921505+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.10	49821	132.226.247.73	80	TCP
2025-01-10T23:40:34.147765+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.10	49861	104.21.16.1	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:40:11.725390911 CET	49722	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:11.730329037 CET	80	49722	132.226.247.73	192.168.2.10
Jan 10, 2025 23:40:11.730402946 CET	49722	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:11.730616093 CET	49722	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:11.735457897 CET	80	49722	132.226.247.73	192.168.2.10
Jan 10, 2025 23:40:23.572590113 CET	80	49722	132.226.247.73	192.168.2.10
Jan 10, 2025 23:40:23.580374002 CET	49722	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:23.585244894 CET	80	49722	132.226.247.73	192.168.2.10
Jan 10, 2025 23:40:24.194122076 CET	80	49722	132.226.247.73	192.168.2.10
Jan 10, 2025 23:40:24.242693901 CET	49798	443	192.168.2.10	104.21.96.1
Jan 10, 2025 23:40:24.242722988 CET	443	49798	104.21.96.1	192.168.2.10
Jan 10, 2025 23:40:24.242789984 CET	49798	443	192.168.2.10	104.21.96.1
Jan 10, 2025 23:40:24.249618053 CET	49722	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:24.250802040 CET	49798	443	192.168.2.10	104.21.96.1
Jan 10, 2025 23:40:24.250819921 CET	443	49798	104.21.96.1	192.168.2.10
Jan 10, 2025 23:40:24.731762886 CET	443	49798	104.21.96.1	192.168.2.10
Jan 10, 2025 23:40:24.732016087 CET	49798	443	192.168.2.10	104.21.96.1
Jan 10, 2025 23:40:24.793127060 CET	49798	443	192.168.2.10	104.21.96.1
Jan 10, 2025 23:40:24.793155909 CET	443	49798	104.21.96.1	192.168.2.10
Jan 10, 2025 23:40:24.794333935 CET	443	49798	104.21.96.1	192.168.2.10
Jan 10, 2025 23:40:24.843394995 CET	49798	443	192.168.2.10	104.21.96.1
Jan 10, 2025 23:40:25.048485994 CET	49798	443	192.168.2.10	104.21.96.1
Jan 10, 2025 23:40:25.091334105 CET	443	49798	104.21.96.1	192.168.2.10
Jan 10, 2025 23:40:25.172180891 CET	443	49798	104.21.96.1	192.168.2.10
Jan 10, 2025 23:40:25.172419071 CET	443	49798	104.21.96.1	192.168.2.10
Jan 10, 2025 23:40:25.172467947 CET	49798	443	192.168.2.10	104.21.96.1
Jan 10, 2025 23:40:25.183751106 CET	49798	443	192.168.2.10	104.21.96.1
Jan 10, 2025 23:40:25.188186884 CET	49722	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:25.193110943 CET	80	49722	132.226.247.73	192.168.2.10
Jan 10, 2025 23:40:26.761034012 CET	80	49722	132.226.247.73	192.168.2.10
Jan 10, 2025 23:40:26.763598919 CET	49817	443	192.168.2.10	104.21.96.1
Jan 10, 2025 23:40:26.763639927 CET	443	49817	104.21.96.1	192.168.2.10
Jan 10, 2025 23:40:26.763710022 CET	49817	443	192.168.2.10	104.21.96.1
Jan 10, 2025 23:40:26.764072895 CET	49817	443	192.168.2.10	104.21.96.1
Jan 10, 2025 23:40:26.764089108 CET	443	49817	104.21.96.1	192.168.2.10
Jan 10, 2025 23:40:26.812424898 CET	49722	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:27.988269091 CET	443	49817	104.21.96.1	192.168.2.10
Jan 10, 2025 23:40:27.991523027 CET	49817	443	192.168.2.10	104.21.96.1
Jan 10, 2025 23:40:27.991552114 CET	443	49817	104.21.96.1	192.168.2.10
Jan 10, 2025 23:40:28.147806883 CET	443	49817	104.21.96.1	192.168.2.10
Jan 10, 2025 23:40:28.147859097 CET	443	49817	104.21.96.1	192.168.2.10
Jan 10, 2025 23:40:28.147943020 CET	49817	443	192.168.2.10	104.21.96.1
Jan 10, 2025 23:40:28.148533106 CET	49817	443	192.168.2.10	104.21.96.1
Jan 10, 2025 23:40:28.151920080 CET	49722	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:28.154119015 CET	49821	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:28.158216000 CET	80	49722	132.226.247.73	192.168.2.10
Jan 10, 2025 23:40:28.158934116 CET	80	49821	132.226.247.73	192.168.2.10
Jan 10, 2025 23:40:28.159018993 CET	49722	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:28.159219027 CET	49821	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:28.159219027 CET	49821	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:28.163986921 CET	80	49821	132.226.247.73	192.168.2.10
Jan 10, 2025 23:40:28.866862059 CET	80	49821	132.226.247.73	192.168.2.10
Jan 10, 2025 23:40:28.868478060 CET	49827	443	192.168.2.10	104.21.96.1
Jan 10, 2025 23:40:28.868511915 CET	443	49827	104.21.96.1	192.168.2.10
Jan 10, 2025 23:40:28.868711948 CET	49827	443	192.168.2.10	104.21.96.1
Jan 10, 2025 23:40:28.869005919 CET	49827	443	192.168.2.10	104.21.96.1
Jan 10, 2025 23:40:28.869015932 CET	443	49827	104.21.96.1	192.168.2.10
Jan 10, 2025 23:40:28.921504974 CET	49821	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:29.327245951 CET	443	49827	104.21.96.1	192.168.2.10
Jan 10, 2025 23:40:29.338254929 CET	49827	443	192.168.2.10	104.21.96.1
Jan 10, 2025 23:40:29.338274002 CET	443	49827	104.21.96.1	192.168.2.10
Jan 10, 2025 23:40:29.467658043 CET	443	49827	104.21.96.1	192.168.2.10
Jan 10, 2025 23:40:29.467735052 CET	443	49827	104.21.96.1	192.168.2.10
Jan 10, 2025 23:40:29.467921972 CET	49827	443	192.168.2.10	104.21.96.1
Jan 10, 2025 23:40:29.469217062 CET	49827	443	192.168.2.10	104.21.96.1
Jan 10, 2025 23:40:29.474219084 CET	49831	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:29.479017973 CET	80	49831	132.226.247.73	192.168.2.10
Jan 10, 2025 23:40:29.482330084 CET	49831	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:29.482417107 CET	49831	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:29.487128973 CET	80	49831	132.226.247.73	192.168.2.10
Jan 10, 2025 23:40:32.168098927 CET	80	49831	132.226.247.73	192.168.2.10
Jan 10, 2025 23:40:32.169576883 CET	49852	443	192.168.2.10	104.21.96.1
Jan 10, 2025 23:40:32.169622898 CET	443	49852	104.21.96.1	192.168.2.10
Jan 10, 2025 23:40:32.169868946 CET	49852	443	192.168.2.10	104.21.96.1
Jan 10, 2025 23:40:32.170214891 CET	49852	443	192.168.2.10	104.21.96.1
Jan 10, 2025 23:40:32.170228004 CET	443	49852	104.21.96.1	192.168.2.10
Jan 10, 2025 23:40:32.218372107 CET	49831	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:32.635623932 CET	443	49852	104.21.96.1	192.168.2.10
Jan 10, 2025 23:40:32.637948036 CET	49852	443	192.168.2.10	104.21.96.1
Jan 10, 2025 23:40:32.637969017 CET	443	49852	104.21.96.1	192.168.2.10
Jan 10, 2025 23:40:32.784729004 CET	443	49852	104.21.96.1	192.168.2.10
Jan 10, 2025 23:40:32.784785986 CET	443	49852	104.21.96.1	192.168.2.10
Jan 10, 2025 23:40:32.785439968 CET	49852	443	192.168.2.10	104.21.96.1
Jan 10, 2025 23:40:32.785439968 CET	49852	443	192.168.2.10	104.21.96.1
Jan 10, 2025 23:40:32.789175987 CET	49831	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:32.794096947 CET	80	49831	132.226.247.73	192.168.2.10
Jan 10, 2025 23:40:32.794159889 CET	49831	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:32.794217110 CET	49855	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:32.800937891 CET	80	49855	132.226.247.73	192.168.2.10
Jan 10, 2025 23:40:32.804016113 CET	49855	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:32.804016113 CET	49855	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:32.811630964 CET	80	49855	132.226.247.73	192.168.2.10
Jan 10, 2025 23:40:33.483732939 CET	80	49855	132.226.247.73	192.168.2.10
Jan 10, 2025 23:40:33.492978096 CET	49861	443	192.168.2.10	104.21.16.1
Jan 10, 2025 23:40:33.493011951 CET	443	49861	104.21.16.1	192.168.2.10
Jan 10, 2025 23:40:33.493169069 CET	49861	443	192.168.2.10	104.21.16.1
Jan 10, 2025 23:40:33.493498087 CET	49861	443	192.168.2.10	104.21.16.1
Jan 10, 2025 23:40:33.493505955 CET	443	49861	104.21.16.1	192.168.2.10
Jan 10, 2025 23:40:33.530905008 CET	49855	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:33.990834951 CET	443	49861	104.21.16.1	192.168.2.10
Jan 10, 2025 23:40:33.992644072 CET	49861	443	192.168.2.10	104.21.16.1
Jan 10, 2025 23:40:33.992660999 CET	443	49861	104.21.16.1	192.168.2.10
Jan 10, 2025 23:40:34.147789955 CET	443	49861	104.21.16.1	192.168.2.10
Jan 10, 2025 23:40:34.147849083 CET	443	49861	104.21.16.1	192.168.2.10
Jan 10, 2025 23:40:34.147898912 CET	49861	443	192.168.2.10	104.21.16.1
Jan 10, 2025 23:40:34.148430109 CET	49861	443	192.168.2.10	104.21.16.1
Jan 10, 2025 23:40:34.152010918 CET	49855	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:34.153131962 CET	49866	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:34.156985044 CET	80	49855	132.226.247.73	192.168.2.10
Jan 10, 2025 23:40:34.157051086 CET	49855	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:34.157934904 CET	80	49866	132.226.247.73	192.168.2.10
Jan 10, 2025 23:40:34.157990932 CET	49866	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:34.158098936 CET	49866	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:34.162822962 CET	80	49866	132.226.247.73	192.168.2.10
Jan 10, 2025 23:40:34.920676947 CET	80	49866	132.226.247.73	192.168.2.10
Jan 10, 2025 23:40:34.922616959 CET	49872	443	192.168.2.10	104.21.16.1
Jan 10, 2025 23:40:34.922645092 CET	443	49872	104.21.16.1	192.168.2.10
Jan 10, 2025 23:40:34.922698975 CET	49872	443	192.168.2.10	104.21.16.1
Jan 10, 2025 23:40:34.922977924 CET	49872	443	192.168.2.10	104.21.16.1
Jan 10, 2025 23:40:34.922990084 CET	443	49872	104.21.16.1	192.168.2.10
Jan 10, 2025 23:40:34.968554020 CET	49866	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:35.411700964 CET	443	49872	104.21.16.1	192.168.2.10
Jan 10, 2025 23:40:35.413656950 CET	49872	443	192.168.2.10	104.21.16.1
Jan 10, 2025 23:40:35.413691044 CET	443	49872	104.21.16.1	192.168.2.10
Jan 10, 2025 23:40:35.561645985 CET	443	49872	104.21.16.1	192.168.2.10
Jan 10, 2025 23:40:35.561713934 CET	443	49872	104.21.16.1	192.168.2.10
Jan 10, 2025 23:40:35.561835051 CET	49872	443	192.168.2.10	104.21.16.1
Jan 10, 2025 23:40:35.562887907 CET	49872	443	192.168.2.10	104.21.16.1
Jan 10, 2025 23:40:35.568324089 CET	49866	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:35.573241949 CET	80	49866	132.226.247.73	192.168.2.10
Jan 10, 2025 23:40:35.573348045 CET	49866	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:35.577461958 CET	49877	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:35.582261086 CET	80	49877	132.226.247.73	192.168.2.10
Jan 10, 2025 23:40:35.582345963 CET	49877	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:35.582443953 CET	49877	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:35.587219000 CET	80	49877	132.226.247.73	192.168.2.10
Jan 10, 2025 23:40:38.266036034 CET	80	49877	132.226.247.73	192.168.2.10
Jan 10, 2025 23:40:38.267664909 CET	49895	443	192.168.2.10	104.21.16.1
Jan 10, 2025 23:40:38.267707109 CET	443	49895	104.21.16.1	192.168.2.10
Jan 10, 2025 23:40:38.267796040 CET	49895	443	192.168.2.10	104.21.16.1
Jan 10, 2025 23:40:38.268126011 CET	49895	443	192.168.2.10	104.21.16.1
Jan 10, 2025 23:40:38.268141985 CET	443	49895	104.21.16.1	192.168.2.10
Jan 10, 2025 23:40:38.312144041 CET	49877	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:38.728893042 CET	443	49895	104.21.16.1	192.168.2.10
Jan 10, 2025 23:40:38.730751038 CET	49895	443	192.168.2.10	104.21.16.1
Jan 10, 2025 23:40:38.730775118 CET	443	49895	104.21.16.1	192.168.2.10
Jan 10, 2025 23:40:38.851677895 CET	443	49895	104.21.16.1	192.168.2.10
Jan 10, 2025 23:40:38.851748943 CET	443	49895	104.21.16.1	192.168.2.10
Jan 10, 2025 23:40:38.851875067 CET	49895	443	192.168.2.10	104.21.16.1
Jan 10, 2025 23:40:38.852509975 CET	49895	443	192.168.2.10	104.21.16.1
Jan 10, 2025 23:40:38.856188059 CET	49877	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:38.857511044 CET	49899	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:38.861371994 CET	80	49877	132.226.247.73	192.168.2.10
Jan 10, 2025 23:40:38.861471891 CET	49877	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:38.862306118 CET	80	49899	132.226.247.73	192.168.2.10
Jan 10, 2025 23:40:38.862380028 CET	49899	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:38.862505913 CET	49899	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:38.867296934 CET	80	49899	132.226.247.73	192.168.2.10
Jan 10, 2025 23:40:40.534389019 CET	80	49899	132.226.247.73	192.168.2.10
Jan 10, 2025 23:40:40.536264896 CET	49911	443	192.168.2.10	104.21.16.1
Jan 10, 2025 23:40:40.536314964 CET	443	49911	104.21.16.1	192.168.2.10
Jan 10, 2025 23:40:40.536427021 CET	49911	443	192.168.2.10	104.21.16.1
Jan 10, 2025 23:40:40.536735058 CET	49911	443	192.168.2.10	104.21.16.1
Jan 10, 2025 23:40:40.536746979 CET	443	49911	104.21.16.1	192.168.2.10
Jan 10, 2025 23:40:40.577789068 CET	49899	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:41.000272989 CET	443	49911	104.21.16.1	192.168.2.10
Jan 10, 2025 23:40:41.002152920 CET	49911	443	192.168.2.10	104.21.16.1
Jan 10, 2025 23:40:41.002182007 CET	443	49911	104.21.16.1	192.168.2.10
Jan 10, 2025 23:40:41.157655001 CET	443	49911	104.21.16.1	192.168.2.10
Jan 10, 2025 23:40:41.157718897 CET	443	49911	104.21.16.1	192.168.2.10
Jan 10, 2025 23:40:41.157816887 CET	49911	443	192.168.2.10	104.21.16.1
Jan 10, 2025 23:40:41.158375025 CET	49911	443	192.168.2.10	104.21.16.1
Jan 10, 2025 23:40:41.303813934 CET	49899	80	192.168.2.10	132.226.247.73
Jan 10, 2025 23:40:41.303929090 CET	49821	80	192.168.2.10	132.226.247.73

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:40:11.708592892 CET	55618	53	192.168.2.10	1.1.1.1
Jan 10, 2025 23:40:11.715509892 CET	53	55618	1.1.1.1	192.168.2.10
Jan 10, 2025 23:40:24.234199047 CET	59206	53	192.168.2.10	1.1.1.1
Jan 10, 2025 23:40:24.241508961 CET	53	59206	1.1.1.1	192.168.2.10
Jan 10, 2025 23:40:33.485044003 CET	49207	53	192.168.2.10	1.1.1.1
Jan 10, 2025 23:40:33.492167950 CET	53	49207	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 23:40:11.708592892 CET	192.168.2.10	1.1.1.1	0x5350	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:40:24.234199047 CET	192.168.2.10	1.1.1.1	0x275	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:40:33.485044003 CET	192.168.2.10	1.1.1.1	0x7084	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 23:40:08.443109035 CET	1.1.1.1	192.168.2.10	0xda09	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:40:08.443109035 CET	1.1.1.1	192.168.2.10	0xda09	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:40:11.715509892 CET	1.1.1.1	192.168.2.10	0x5350	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:40:11.715509892 CET	1.1.1.1	192.168.2.10	0x5350	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:40:11.715509892 CET	1.1.1.1	192.168.2.10	0x5350	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:40:11.715509892 CET	1.1.1.1	192.168.2.10	0x5350	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:40:11.715509892 CET	1.1.1.1	192.168.2.10	0x5350	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:40:11.715509892 CET	1.1.1.1	192.168.2.10	0x5350	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:40:24.241508961 CET	1.1.1.1	192.168.2.10	0x275	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:40:24.241508961 CET	1.1.1.1	192.168.2.10	0x275	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:40:24.241508961 CET	1.1.1.1	192.168.2.10	0x275	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:40:24.241508961 CET	1.1.1.1	192.168.2.10	0x275	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:40:24.241508961 CET	1.1.1.1	192.168.2.10	0x275	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:40:24.241508961 CET	1.1.1.1	192.168.2.10	0x275	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:40:24.241508961 CET	1.1.1.1	192.168.2.10	0x275	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:40:33.492167950 CET	1.1.1.1	192.168.2.10	0x7084	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:40:33.492167950 CET	1.1.1.1	192.168.2.10	0x7084	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:40:33.492167950 CET	1.1.1.1	192.168.2.10	0x7084	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:40:33.492167950 CET	1.1.1.1	192.168.2.10	0x7084	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:40:33.492167950 CET	1.1.1.1	192.168.2.10	0x7084	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:40:33.492167950 CET	1.1.1.1	192.168.2.10	0x7084	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:40:33.492167950 CET	1.1.1.1	192.168.2.10	0x7084	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49722	132.226.247.73	80	7644	C:\Users\user\Desktop\Ddj3E3qerh.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:40:11.730616093 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:40:23.572590113 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:40:23 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 10, 2025 23:40:23.580374002 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 23:40:24.194122076 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:40:24 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 10, 2025 23:40:25.188186884 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 23:40:26.761034012 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:40:26 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49821	132.226.247.73	80	7644	C:\Users\user\Desktop\Ddj3E3qerh.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:40:28.159219027 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 23:40:28.866862059 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:40:28 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.10	49831	132.226.247.73	80	7644	C:\Users\user\Desktop\Ddj3E3qerh.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:40:29.482417107 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:40:32.168098927 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:40:32 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.10	49855	132.226.247.73	80	7644	C:\Users\user\Desktop\Ddj3E3qerh.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:40:32.804016113 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:40:33.483732939 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:40:33 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.10	49866	132.226.247.73	80	7644	C:\Users\user\Desktop\Ddj3E3qerh.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:40:34.158098936 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:40:34.920676947 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:40:34 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.10	49877	132.226.247.73	80	7644	C:\Users\user\Desktop\Ddj3E3qerh.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:40:35.582443953 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:40:38.266036034 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:40:38 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.10	49899	132.226.247.73	80	7644	C:\Users\user\Desktop\Ddj3E3qerh.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:40:38.862505913 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:40:40.534389019 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:40:40 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49798	104.21.96.1	443	7644	C:\Users\user\Desktop\Ddj3E3qerh.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:40:25 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-10 22:40:25 UTC	861	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:40:25 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1863614 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KGgrMKeoN8w9mVlmEAYH2Hxi8DQkqanc%2F3Bl%2Bf1m%2BdkGkKda1sTp%2F%2Fs6G5Kmol1Mxn3SyL6DET749YwuHK7cYHHGpFwJmymxr15KZYbsaJV%2FIP2rreusxyXOhHpGHlIAc1JcpW0A"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 90002b2cdaad4363-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1590&min_rtt=1583&rtt_var=599&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1844598&cwnd=240&unsent_bytes=0&cid=e8f9da3fb541c08d&ts=448&x=0"
2025-01-10 22:40:25 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49817	104.21.96.1	443	7644	C:\Users\user\Desktop\Ddj3E3qerh.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:40:27 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-10 22:40:28 UTC	859	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:40:28 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1863617 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kOJ%2FE5vfirprbaXl01B8aaFngql36gezqY%2BCVwnS96smyhIkXOlK6zz63yYDFsygfDWljTeI1DolQeiRxycG81x%2FCh1kY%2F3OMN5U%2FcDVvi0PcU4FCwchGUhoGq2A5lzM7EAu32HH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 90002b3f7dd5c32e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1658&min_rtt=1647&rtt_var=625&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1772920&cwnd=178&unsent_bytes=0&cid=0d7c89d897743a06&ts=906&x=0"
2025-01-10 22:40:28 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.10	49827	104.21.96.1	443	7644	C:\Users\user\Desktop\Ddj3E3qerh.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:40:29 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-10 22:40:29 UTC	855	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:40:29 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1863618 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oBxQw79kG9bL4hM7rpXhUpgwC3OrMn%2FxbQcBSVm9tcqX7oWohvl7vLcSmTv5bePKMM9BubIp%2FXWGXedW7t%2BtsmLDEbuP2MFyweX98hbBkMV2JVqY7AEeb8FVMSKTEg71e6Pby3Sq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 90002b47cf331a48-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2013&min_rtt=2002&rtt_var=774&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1393794&cwnd=157&unsent_bytes=0&cid=97c4f24c93d00d12&ts=148&x=0"
2025-01-10 22:40:29 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.10	49852	104.21.96.1	443	7644	C:\Users\user\Desktop\Ddj3E3qerh.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:40:32 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-10 22:40:32 UTC	857	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:40:32 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1863621 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z0cLasxhb4OWpDnl4TJImWxrx22m5s9z1G79DAxBKf%2FLfnrE3nIAIAisJ9yFDU16n1jocC6z%2BOT4JeRpg37No7SmIuHHWdfwj5xpdwTYUrDYJXGcQ1GZ65x%2FU1DL6uEL7bIy%2BLMW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 90002b5c7da61a48-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1931&min_rtt=1922&rtt_var=740&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1459270&cwnd=157&unsent_bytes=0&cid=98bb68b105b289e2&ts=154&x=0"
2025-01-10 22:40:32 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.10	49861	104.21.16.1	443	7644	C:\Users\user\Desktop\Ddj3E3qerh.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:40:33 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-10 22:40:34 UTC	869	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:40:34 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1863623 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9t0Qb%2BzHZDN70hmHtpRApj5XH8pVfknAhTxjjIc%2B4hXfS6XxNG7hvwH%2Fb%2Bubauc9%2BgalAFHTi463%2FfU0Z%2B6AKB8%2BJZ9tPVeUczcXATlaMMAd%2FvoT6VVz%2BvTai9CTpT3DQKMBzmBD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 90002b64faf67293-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1920&min_rtt=1908&rtt_var=741&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1452736&cwnd=158&unsent_bytes=0&cid=d479866b0b92677c&ts=162&x=0"
2025-01-10 22:40:34 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.10	49872	104.21.16.1	443	7644	C:\Users\user\Desktop\Ddj3E3qerh.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:40:35 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-10 22:40:35 UTC	859	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:40:35 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1863624 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gJ3athWS7ZGM7dfYYjnAdBAUKJaezqzaUtI7FlMIPk637CC1XieuB80lIzos9ui7E%2ByR64vqvUJ5Fo3K%2BFgCp9nIHwnH9seKJ%2BWh1hn4aKoZULsWDUZXdvUEQG6h%2FzSMV9CH%2BTf5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 90002b6dcae80fa8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1483&min_rtt=1461&rtt_var=564&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1998631&cwnd=252&unsent_bytes=0&cid=51fdd81fce86a069&ts=155&x=0"
2025-01-10 22:40:35 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.10	49895	104.21.16.1	443	7644	C:\Users\user\Desktop\Ddj3E3qerh.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:40:38 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-10 22:40:38 UTC	853	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:40:38 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1863627 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nb7LqYzHxFZgn8IMNOW6LrjkvkppgZU8AGhp4FVr2Asa4tjMos%2Fyyj1z46iRHZan4oQHKhqjs5v9QJd9cYw%2BkEoul6THeOT7GeBwxUZOzEOWlrx0M1YAZXwkA2U7MCu0v9Z9dfcv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 90002b827ab37293-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2078&min_rtt=1968&rtt_var=816&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1483739&cwnd=158&unsent_bytes=0&cid=7429dcc5a81d6e3b&ts=135&x=0"
2025-01-10 22:40:38 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.10	49911	104.21.16.1	443	7644	C:\Users\user\Desktop\Ddj3E3qerh.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:40:40 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-10 22:40:41 UTC	857	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:40:41 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1863630 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=olsJN7lxfiXetqfU%2BGET0u4Q7s79y9354y7EU5TyWZrmBsWq3BkmlZwyXaUIczp9R%2FHtKN%2BWpcTrT8K4%2FRCBKZlifJvHe5r11tsBUF3RPMKbiXAHL3FL3QfZ6GmraSRYzOb2vUIs"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 90002b90dbbe4388-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1578&min_rtt=1572&rtt_var=603&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1794714&cwnd=221&unsent_bytes=0&cid=0148f159c4e007ee&ts=163&x=0"
2025-01-10 22:40:41 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Ddj3E3qerh.exePID: 7644, Parent PID: 3968

General

Target ID:	0
Start time:	17:40:10
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\Ddj3E3qerh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Ddj3E3qerh.exe"
Imagebase:	0x280000
File size:	134'144 bytes
MD5 hash:	0A6D497237DC22F74FA9EB514EF6AEF1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000000.1316295496.0000000000282000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000000.1316295496.0000000000282000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000000.1316295496.0000000000282000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000000.1316295496.0000000000282000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.1616729861.00000000025F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 6248, Parent PID: 7644

General

Target ID:	3
Start time:	17:40:40
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\Ddj3E3qerh.exe"
Imagebase:	0xd70000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6180, Parent PID: 6248

General

Target ID:	4
Start time:	17:40:40
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: choice.exePID: 8180, Parent PID: 6248

General

Target ID:	5
Start time:	17:40:40
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /C Y /N /D Y /T 3
Imagebase:	0xd10000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: Ddj3E3qerh.exePID: 7644, Parent PID: 3968COMMON

Executed Functions

Function 008C6730 Relevance: 6.7, Strings: 5, Instructions: 444COMMON

Download Yara Rule

Strings

(oq, xrefs: 008C6988
,q, xrefs: 008C6A00
(oq, xrefs: 008C697A
(oq, xrefs: 008C6CA5
,q, xrefs: 008C69F2

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID: (oq$(oq$(oq$,q$,q
API String ID: 0-189141485
Opcode ID: 8ce18da8702f64beb4246d664f368376c03d5f746637ac494db019dced6e7ced
Instruction ID: fca02c29f3f1e3fda29da25d9b3a8da071bddd2abcbd2245611de7dba976afea
Opcode Fuzzy Hash: 8ce18da8702f64beb4246d664f368376c03d5f746637ac494db019dced6e7ced
Instruction Fuzzy Hash: 1B023870A002199FCB14CF68C984FAEBBB2FF88314F158469E855EB261E730ED65DB51

Function 008CB328 Relevance: 4.1, Strings: 3, Instructions: 358COMMON

Download Yara Rule

Strings

PHq, xrefs: 008CB747
PHq, xrefs: 008CB758
E, xrefs: 008CB44A

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID: E$PHq$PHq
API String ID: 0-3203107152
Opcode ID: 731cf0faa45d789ea8f96a9518b0e899922a98fa9140d3a3c461b878dc919236
Instruction ID: 3ddf22b9e8ccc763b7761741d98cc867341d273eada604bfd120fd0de888a1b4
Opcode Fuzzy Hash: 731cf0faa45d789ea8f96a9518b0e899922a98fa9140d3a3c461b878dc919236
Instruction Fuzzy Hash: EDE1E474A046588FDB14CFA9D885F9DBBB1FF49310F158069E819EB262DB30EC41CB54

Function 008C9858 Relevance: 3.4, Strings: 2, Instructions: 860COMMON

Download Yara Rule

Strings

(oq, xrefs: 008C9C78
4'q, xrefs: 008CA273

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID: (oq$4'q
API String ID: 0-1336004174
Opcode ID: deb331ebfae159f4f89a8e8431ad413fb97a3eab1a4a3e4b6a5c5da3be26e86f
Instruction ID: 708ef5100343c95da56af4e0af7cebdfbf10ab415b0bd7111b7054cc348cc671
Opcode Fuzzy Hash: deb331ebfae159f4f89a8e8431ad413fb97a3eab1a4a3e4b6a5c5da3be26e86f
Instruction Fuzzy Hash: F9727E71A00609DFCB19CF68C888EAEBBB2FF48314F158599E846DB2A1D730ED45DB51

Function 008C6108 Relevance: 3.0, Strings: 2, Instructions: 511COMMON

Download Yara Rule

Strings

(oq, xrefs: 008C6642
Hq, xrefs: 008C650E

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID: (oq$Hq
API String ID: 0-2917151738
Opcode ID: 0b1985571768991874c3ae973346260296488a9deea23bfb59dca55341f4234a
Instruction ID: f9269984a5f26f07ca12309cca149f2f37d2f6a78a416b020c9eeebe48caf7d1
Opcode Fuzzy Hash: 0b1985571768991874c3ae973346260296488a9deea23bfb59dca55341f4234a
Instruction Fuzzy Hash: F8125870A002189FDB18DF69C854BAEBBB6FF88304F248569E406DB391EB34DD56CB50

Function 008CBBD3 Relevance: 2.8, Strings: 2, Instructions: 256COMMON

Download Yara Rule

Strings

PHq, xrefs: 008CBE38
PHq, xrefs: 008CBE27

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 3153df5d7beb1ddbe3cba5daa36f85de8c102b420f158501bce637b7ef3a9fe0
Instruction ID: cac6bf95ac88c99401d56e972a7e627ad0d9bd70093a8501979defc35628a1b5
Opcode Fuzzy Hash: 3153df5d7beb1ddbe3cba5daa36f85de8c102b420f158501bce637b7ef3a9fe0
Instruction Fuzzy Hash: 33B16870E006188FDB15DFA9C851B9DBBB2FF89314F2480AAE405EB266DB349C46CF50

Function 008CC197 Relevance: 2.7, Strings: 2, Instructions: 203COMMON

Download Yara Rule

Strings

PHq, xrefs: 008CC3F8
PHq, xrefs: 008CC3E7

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 694811648a21ffe5973a54baa18f7be4697c5d2f6813ef0b8d73e27b61e58513
Instruction ID: 101f5b1d4c9500c545f5072a1a99a4fab812e326f42812ce88d3bc22b3810ee3
Opcode Fuzzy Hash: 694811648a21ffe5973a54baa18f7be4697c5d2f6813ef0b8d73e27b61e58513
Instruction Fuzzy Hash: 9C919074E002188FDB14DFAAD884B9DBBB2FF89300F14C069E419EB265DB709985CF50

Function 008CBEB7 Relevance: 2.7, Strings: 2, Instructions: 203COMMON

Download Yara Rule

Strings

PHq, xrefs: 008CC107
PHq, xrefs: 008CC118

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: f363d9a698fa4737ead76038a1bb9194d732779566ab83226f224e464f79a37f
Instruction ID: b29b96c97f928653a96ff9428c42217049f3d9a00bed6ef9e6bed9f24fe6ad20
Opcode Fuzzy Hash: f363d9a698fa4737ead76038a1bb9194d732779566ab83226f224e464f79a37f
Instruction Fuzzy Hash: 31919174E00618CFDB14DFAAD984B9DBBB2FF89300F148069E419EB265DB309985DF11

Function 008CC470 Relevance: 2.7, Strings: 2, Instructions: 186COMMON

Download Yara Rule

Strings

PHq, xrefs: 008CC6D8
PHq, xrefs: 008CC6C7

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 4fff925c12a2510387646045ea11f1cd18cdf246a4f0e819a0af1ee0dd8a0cf9
Instruction ID: 94cc527847e4a589c2dca1d344391bc46c32555eb4b509cd60ed5a0dcd80f929
Opcode Fuzzy Hash: 4fff925c12a2510387646045ea11f1cd18cdf246a4f0e819a0af1ee0dd8a0cf9
Instruction Fuzzy Hash: 218191B4E002188FDB14DFAAD984B9DBBF2FF89300F249069E419EB265DB749945CF11

Function 008CCA33 Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

PHq, xrefs: 008CCC98
PHq, xrefs: 008CCC87

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 2adb68a8ee439e5d67e4a14f6504999cd8b1a082d3d5a8185f699b2b9ec43222
Instruction ID: 4e87b949808caa3a5e27721bd0b53665a58b95b19c90d282c90a03c45195a9ac
Opcode Fuzzy Hash: 2adb68a8ee439e5d67e4a14f6504999cd8b1a082d3d5a8185f699b2b9ec43222
Instruction Fuzzy Hash: 87819074E002188FDB14DFAAD984B9DBBF2FF89300F148069E819EB265DB749945DF10

Function 008CC753 Relevance: 2.7, Strings: 2, Instructions: 184COMMON

Download Yara Rule

Strings

PHq, xrefs: 008CC9B8
PHq, xrefs: 008CC9A7

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 9093e5e6d29cf89f498d9f9f86de76381338c2f5bdded43704d32cfb12dcadb8
Instruction ID: 273a065e49a33d003e2e27e7b72db9d00a33caceb632229057b14cf8065cf09b
Opcode Fuzzy Hash: 9093e5e6d29cf89f498d9f9f86de76381338c2f5bdded43704d32cfb12dcadb8
Instruction Fuzzy Hash: E6819F74E002189FEB14DFAAD884B9DBBF2FF89300F148069E419EB265DB749985CF50

Function 008C4AD9 Relevance: 2.7, Strings: 2, Instructions: 183COMMON

Download Yara Rule

Strings

PHq, xrefs: 008C4D41
PHq, xrefs: 008C4D30

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 328cfbf991ac8665e34000cc6e54db2601fabb6474a5f65b316aa68568ab55e5
Instruction ID: f3d3219157ff80ea0a027211fb541b7e6fa8582ac53d5e45de6c65350f40bd20
Opcode Fuzzy Hash: 328cfbf991ac8665e34000cc6e54db2601fabb6474a5f65b316aa68568ab55e5
Instruction Fuzzy Hash: EB81B1B4E002188FDB14DFA9D894B9DBBF2FF88300F149069E819EB265DB349985DF10

Function 008CB4F3 Relevance: 2.7, Strings: 2, Instructions: 180COMMON

Download Yara Rule

Strings

PHq, xrefs: 008CB747
PHq, xrefs: 008CB758

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 390999bc9b364b448ee70a5cfa809fb386ef0c46101a87ca892331c356eed788
Instruction ID: 302c77cb3f93df279c02b8cc5e54a3df778c6993bf7dbb7008d928973395a7b6
Opcode Fuzzy Hash: 390999bc9b364b448ee70a5cfa809fb386ef0c46101a87ca892331c356eed788
Instruction Fuzzy Hash: A771C474E006089FDB18DFAAD985A9DBBF2FF89310F148069E409EB365DB349946CF50

Function 008C6E58 Relevance: 10.5, Strings: 8, Instructions: 478COMMON

Download Yara Rule

Strings

(oq, xrefs: 008C6F7D
(oq, xrefs: 008C6E96
(oq, xrefs: 008C7367
,q, xrefs: 008C72F8
,q, xrefs: 008C7308
(oq, xrefs: 008C701A
(oq, xrefs: 008C7377
(oq, xrefs: 008C6F51

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID: (oq$(oq$(oq$(oq$(oq$(oq$,q$,q
API String ID: 0-2212926057
Opcode ID: ae6a44bd31a8195cdbf95226f6f6daceb19236682392f876f2ba5bc9ffddd3e4
Instruction ID: 4a85954034697068ec2204103d7f0811285fb7c11a1db812abe15f3b34f7f47c
Opcode Fuzzy Hash: ae6a44bd31a8195cdbf95226f6f6daceb19236682392f876f2ba5bc9ffddd3e4
Instruction Fuzzy Hash: 50121430A046488FCB15CF69D884EAEBBF2FF89314B558569E856DB2A1DB30ED41CF50

Function 008C87E9 Relevance: 4.3, Strings: 3, Instructions: 503COMMON

Download Yara Rule

Strings

;q, xrefs: 008C8C2C
4'q, xrefs: 008C8837
4'q, xrefs: 008C8811

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID: 4'q$4'q$;q
API String ID: 0-144927120
Opcode ID: 1f2260585cb59cbfa831cc0622eea9968090435734585587a8365bb07d3a38b3
Instruction ID: 4fcee53b67a3897eb17ea05aac81270eda263aa6727fc7764606a3b869131ba4
Opcode Fuzzy Hash: 1f2260585cb59cbfa831cc0622eea9968090435734585587a8365bb07d3a38b3
Instruction Fuzzy Hash: 5BF19A70384615CFDB199A29C868F3937B6FF85714F2844AEE502CB3A2EE35CC819752

Function 008C77F0 Relevance: 3.2, Strings: 2, Instructions: 707COMMON

Download Yara Rule

Strings

$q, xrefs: 008C8337
$q, xrefs: 008C8314

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID: $q$$q
API String ID: 0-3126353813
Opcode ID: 0e93642e28b3e01a936a54d288d2db2474479bf204d5f188cd00ea2a5611a4a2
Instruction ID: 44ba4adc5995635d7f1a30086aa56a9f416588309e0bf1b557cb577ee5a8f906
Opcode Fuzzy Hash: 0e93642e28b3e01a936a54d288d2db2474479bf204d5f188cd00ea2a5611a4a2
Instruction Fuzzy Hash: E3524034A00318CFEB159FA4C860B9EB772FF88301F1080AAD14AAB755DF759E859F55

Function 008C56A8 Relevance: 2.8, Strings: 2, Instructions: 329COMMON

Download Yara Rule

Strings

Hq, xrefs: 008C57C6
Hq, xrefs: 008C5793

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID: Hq$Hq
API String ID: 0-925789375
Opcode ID: ec59faf33bcccb862aee322b8309ae172a1cba6771cf51d10eaa26bd73ac7b2e
Instruction ID: d26b5d2e88db7f4f2f0d2b09f0924d7cb798294f4473c3c231e66e0ffc8a3898
Opcode Fuzzy Hash: ec59faf33bcccb862aee322b8309ae172a1cba6771cf51d10eaa26bd73ac7b2e
Instruction Fuzzy Hash: 22B1BB70B046148FDF269F38D894B6A7BB2FB88314F14892DE446CB291DB74EC86D791

Function 008C5C08 Relevance: 2.7, Strings: 2, Instructions: 232COMMON

Download Yara Rule

Strings

,q, xrefs: 008C5CE8
,q, xrefs: 008C5CDE

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID: ,q$,q
API String ID: 0-1667412543
Opcode ID: d92ee961bb254ddba9bbc8dafb0b2925e7a7618bad5f22a8bd4360e09285ab95
Instruction ID: bab4a53bfcf44559f41f3b6349d4a34695887b60bc1dfd1367d9d643c1d6bb26
Opcode Fuzzy Hash: d92ee961bb254ddba9bbc8dafb0b2925e7a7618bad5f22a8bd4360e09285ab95
Instruction Fuzzy Hash: 60814B35A00A058FCF14CF69C888FAAB7B2FF89314B258169D506EB365DB31ED81CB51

Function 008C3428 Relevance: 2.6, Strings: 2, Instructions: 112COMMON

Download Yara Rule

Strings

Xq, xrefs: 008C3435
Xq, xrefs: 008C345E

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID: Xq$Xq
API String ID: 0-1556399337
Opcode ID: 1eb4ba66087031fe8a06d80db5d30f8565598c72b5e17113655b12cef22981a4
Instruction ID: 6ff8c80f50754bfcbbcf102808060e026fcd98907b32ef0cab2ba3d989ba226b
Opcode Fuzzy Hash: 1eb4ba66087031fe8a06d80db5d30f8565598c72b5e17113655b12cef22981a4
Instruction Fuzzy Hash: C131C471B003298BDB1D9AB95995B7E71BAFBD4310F18843DE806C3380DBB4CE4697A5

Function 008C0C8F Relevance: 1.7, Strings: 1, Instructions: 401COMMON

Download Yara Rule

Strings

LRq, xrefs: 008C0E5E

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: 68c61a9cb63bf1250c59d2047833bf7e082d93a092e3f0c39f1dd7e2dd32a1c8
Instruction ID: fed050653f8684cd80bb9161ecc3ed0fae95668a26490b60d7313da2bf7a656c
Opcode Fuzzy Hash: 68c61a9cb63bf1250c59d2047833bf7e082d93a092e3f0c39f1dd7e2dd32a1c8
Instruction Fuzzy Hash: 2A22B7B8900219CFDB55EF64E888A9DBBB2FF48301F1085A9D409E7368DB705D8ADF54

Function 008C0CA0 Relevance: 1.6, Strings: 1, Instructions: 395COMMON

Download Yara Rule

Strings

LRq, xrefs: 008C0E5E

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: dc094e216141ff107b4e139bc66a3c973d1f2d31544a3870769d305fcbe63bba
Instruction ID: 9be1b2d79510deafc4865b7e52aa3ca89a2a2c06ade8f23e61a33fa5ff5c841b
Opcode Fuzzy Hash: dc094e216141ff107b4e139bc66a3c973d1f2d31544a3870769d305fcbe63bba
Instruction Fuzzy Hash: 1B22B6B8900219CFDB95EF64E888A9DB7B2FF48301F1085A9D409A7368DB705D8ADF54

Function 008CA650 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

(oq, xrefs: 008CA7D9

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID: (oq
API String ID: 0-1999159160
Opcode ID: c76dacb5ff54ddd06ee78e3848913db58ad5e58bfaa08208a2a4d05336ea4dcb
Instruction ID: b9ad8b9e3ac6a28dca4c1a585a3614bab4670d44954aaed52a244b393417ffae
Opcode Fuzzy Hash: c76dacb5ff54ddd06ee78e3848913db58ad5e58bfaa08208a2a4d05336ea4dcb
Instruction Fuzzy Hash: 7B41EF35B002089FCB199B78D855BEE7BB6FBC9211F244429E906D7391CE319C0ADB91

Function 008CA818 Relevance: .4, Instructions: 415COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf8684a5e38f5384182c2809aae77428629225aa0faa4dd5a9afee3e291a0049
Instruction ID: 15d7684711a97ca7df7e26214d0c29098807d516fa15cdd57a38ce06a3fa2691
Opcode Fuzzy Hash: cf8684a5e38f5384182c2809aae77428629225aa0faa4dd5a9afee3e291a0049
Instruction Fuzzy Hash: 58F10A75A006188FCB08CFA8D984EADBBF2FF88314B1A8059E555EB361CB35EC41CB55

Function 008C7438 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb700d62301485319cd5ca12d55061aa60865a26b5ec6cc8c6dd840dd1c3ba95
Instruction ID: b8513379a8fa5f0ee377cb6100db23c28849b8ce8d3672d3dca2b73644ffc20d
Opcode Fuzzy Hash: cb700d62301485319cd5ca12d55061aa60865a26b5ec6cc8c6dd840dd1c3ba95
Instruction Fuzzy Hash: 1D71DF346086058FCB19DE29C898FAA7BF6FF59304B1944A9E902CB3A1DB70DC41DF90

Function 008CCEC7 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 450a7d19eb796899d4102b1ecd10037475daa9df23a774e922dded65d705048e
Instruction ID: d00fba835839718824f7bf0c05fe0cb1fa11241f84eb26c01d59d35453ddf36b
Opcode Fuzzy Hash: 450a7d19eb796899d4102b1ecd10037475daa9df23a774e922dded65d705048e
Instruction Fuzzy Hash: C051B6348B27478FC78A2F34A5AC17BBB70FB0F3177046D54A41E810269BB594A9EE19

Function 008CCED8 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b235814a79222c1e3194d5d6512a6249aec2974c23b5c536158c38324f8b683
Instruction ID: 3738f0a214ac21cc91ec99f43436acf715ab54172c55b516385c4b496251c269
Opcode Fuzzy Hash: 9b235814a79222c1e3194d5d6512a6249aec2974c23b5c536158c38324f8b683
Instruction Fuzzy Hash: CB51A4348B27478FD78A2F30A5AC13BBB74FB0F3177046C14A51E810269BB194A9AA19

Function 008C38F9 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b5805146fea4156206dd552e7e9d5a60c2565f7f5f1d5783179efd65b3982ed
Instruction ID: eddf65dcd90d427ddc43b2c76e6995aab0b377bb4a867fe1ae72807df677f812
Opcode Fuzzy Hash: 0b5805146fea4156206dd552e7e9d5a60c2565f7f5f1d5783179efd65b3982ed
Instruction Fuzzy Hash: E25198B4E01208CFCB48DFA9D59499DBBF2FF89301F609569E805AB369DB319946CF40

Function 008CCD10 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6644e1cde4789817a10c5fdee5969364ba456d055a101cddb988bceb1fdf5e4
Instruction ID: c0adda5698953dd7671a16a40c53fea14ce45e12f587b6b17af559b5ffbe14c8
Opcode Fuzzy Hash: a6644e1cde4789817a10c5fdee5969364ba456d055a101cddb988bceb1fdf5e4
Instruction Fuzzy Hash: 4B518674E01208DFDB44DFA9D994A9DBBF2FF89300F248169E819AB365DB30A945CF50

Function 008C3908 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0126c2d870fb88bc3cfb1441378788f7b0cce4f606400ee0f66d9a8e7455d52
Instruction ID: fdb22b9923911714430ed258e6d91058c26de1dc7060bd9c0e2f3b1a73ab9005
Opcode Fuzzy Hash: c0126c2d870fb88bc3cfb1441378788f7b0cce4f606400ee0f66d9a8e7455d52
Instruction Fuzzy Hash: AB5196B4E01208CFCB48DFA9D59499DBBF2FF89301F609469E805AB364DB31A946CF40

Function 008C9A63 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e0b341da3606b3255eb84448a55d711ac8dee202f0b4205f5c544bd9f6cdac3
Instruction ID: e41f6fad0c6d187e0faa197bb147b1ad1207b3ce3523635bedcc8d2055dee221
Opcode Fuzzy Hash: 2e0b341da3606b3255eb84448a55d711ac8dee202f0b4205f5c544bd9f6cdac3
Instruction Fuzzy Hash: E3419A31A042599FCF11CFA8D848BADBBB2FF49314F14859AE881DB2A1D335ED15DB60

Function 008C4DC8 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3bec825f4cc5363934bf9da94e02198fd9421755a088c7eca1051f2f31a4a10
Instruction ID: 7cc2712d9c233f18d213f1ca49668cf54b585b2b8b044690665abbac31d60376
Opcode Fuzzy Hash: b3bec825f4cc5363934bf9da94e02198fd9421755a088c7eca1051f2f31a4a10
Instruction Fuzzy Hash: 223190316001099FCB069F68D864EAF7BB2FF88310F114428F915CB251CB75DD65EBA5

Function 008C76D0 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac9a9a3de24c5d6dde6940965cb4dc77a878ed9a874751f9fc6969403ce372cc
Instruction ID: 24f9a82ea033c23f4381611e9693ec655d1ce34a4c0f82c48160774daeec64ef
Opcode Fuzzy Hash: ac9a9a3de24c5d6dde6940965cb4dc77a878ed9a874751f9fc6969403ce372cc
Instruction Fuzzy Hash: F221CF343086188BEB1616399894F7927B7FFD8719718407DDA02CB795EE39CC42AA81

Function 008CA809 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e00ae0b8ace967c1ab8ad80ec12e35aef5cc85466a808d047bc3fcdee60e6344
Instruction ID: 8f8f55f1e5841d913fbe34f139b60f2bd88e06d5d6e86939b51df2726412a263
Opcode Fuzzy Hash: e00ae0b8ace967c1ab8ad80ec12e35aef5cc85466a808d047bc3fcdee60e6344
Instruction Fuzzy Hash: 96318171A005098FCB08CF6DD885AAEBBB2FF89354B158159E525D73A1CB34DD06CB91

Function 008C76E0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 924ed454980f8e53d4445085bdcdfd3898ffc034445d4b2351c086b4f51de373
Instruction ID: d838b15a58a5c6eef9e7d3229f7ea8e90b83ddd74e341c528882b994d0ddd8af
Opcode Fuzzy Hash: 924ed454980f8e53d4445085bdcdfd3898ffc034445d4b2351c086b4f51de373
Instruction Fuzzy Hash: 0C21B3343086184BEB1516398894F7A36A7FFD8719F28807CD502CB794EE79CC41AB84

Function 008C5A63 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc94eeec06e50128386046c022c7622b849152e37a401529386639630ed92e31
Instruction ID: a5483973fa58da0459b5475745db3b87d77407117bb310b75e69f43ee69e1953
Opcode Fuzzy Hash: bc94eeec06e50128386046c022c7622b849152e37a401529386639630ed92e31
Instruction Fuzzy Hash: 3721C135700A218FCB169A29D494A6FBBB2FF89361715866DE806CB355CF30EC06CB80

Function 008C2060 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b93d700895ce652149a38cf2c7333e8a7745c22aa20b078524da4d47448027b4
Instruction ID: 6352aadeb7ae3c25386ce86f25de311353891e540dac67b8f659b41750803410
Opcode Fuzzy Hash: b93d700895ce652149a38cf2c7333e8a7745c22aa20b078524da4d47448027b4
Instruction Fuzzy Hash: 6F21B275A006049FCB14EB68C450EAE7BB5FB98360F20C52ED919CB294DA31EE46CBD1

Function 0086D404 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1615567180.000000000086D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0086D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_86d000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab5eb15cfbf2f3a81eed45103dfd9080481dcdf00975fc3e9174d9f2c71a899c
Instruction ID: d6a1f495c9a2b125dcfbd53d4a6cdc33096c53a15e87dfa87d033bae929a47bf
Opcode Fuzzy Hash: ab5eb15cfbf2f3a81eed45103dfd9080481dcdf00975fc3e9174d9f2c71a899c
Instruction Fuzzy Hash: 462125B2A04344DFDB15DF10D8C0B26BB65FB98324F25C169E9098F246C736EC56CBA6

Function 008CD218 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58f439461a143d1250351d459c5db012d1422c2806ac6f7962573a3c52ac7ec6
Instruction ID: 1ca764ce72d2afe2f3c1e0d18e9ac27f38ff09116a336b2abb68682c0c4bce51
Opcode Fuzzy Hash: 58f439461a143d1250351d459c5db012d1422c2806ac6f7962573a3c52ac7ec6
Instruction Fuzzy Hash: 542118749422089FDF09DFB4E851AEDB7B2FB89301F105429D801B7364DB359946CF65

Function 008C1F08 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d63399d2b0da3b9c2abdace2a063cd935d03e3fca11c7b7bf5d56c60f1622a68
Instruction ID: 72f0bfa8e5f39c3c2c2c47e6addef2d3aeb93bf105d475226381f988ce052623
Opcode Fuzzy Hash: d63399d2b0da3b9c2abdace2a063cd935d03e3fca11c7b7bf5d56c60f1622a68
Instruction Fuzzy Hash: E72189B0C04609CFCB51EFA4C4986EDBFF0FF5A311F54456ED805A6255EB309A49CBA2

Function 008CD123 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed1a95d7bc0336884bacb7b227bee4a2d0aff7cc99529fd94bb55a13577c5e64
Instruction ID: 8a476e318fccb843e0abb763fdaeb32474ac7395a1d525971a31471d9fab6b6d
Opcode Fuzzy Hash: ed1a95d7bc0336884bacb7b227bee4a2d0aff7cc99529fd94bb55a13577c5e64
Instruction Fuzzy Hash: 9421EB31C10619DECB11EFE8D844AECFBB4FF4A315F149529D504B7254EB70AA59CB50

Function 008C215C Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb8389dc003d8c4904ff37fb042c266380e82332f06404072a4d1bc1909171c8
Instruction ID: 4aa69266bc073a7aefb80cfe7b79c4bf0e6250ddcd36601bbc38fba2e52dc536
Opcode Fuzzy Hash: cb8389dc003d8c4904ff37fb042c266380e82332f06404072a4d1bc1909171c8
Instruction Fuzzy Hash: 51115275E452595FCF01DBB8AC009DEB734FF85320B248757D526B7091E6316506C791

Function 008C39ED Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a96ac5db685c43ed29fc5f9b73eabf3a1ad890436b9032362254d6fad68ff6b
Instruction ID: 03e552c5b6aa3582bd4104cedbae5d4e9b9570769050947e1ab8d7838237d77c
Opcode Fuzzy Hash: 2a96ac5db685c43ed29fc5f9b73eabf3a1ad890436b9032362254d6fad68ff6b
Instruction Fuzzy Hash: C63194B8E01308DFCB44DFA8E59499DBBB2FF49305B618469E809AB364D731AD49DF40

Function 008C4DBB Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b01c7a3c2697fdcf8fc48b6255fa2fefa5946214a9d32d29980f9bb6fae4a35
Instruction ID: f0171b2a83d857dbea7a9a640615bba1e5b4347bce135c1a43fd650b5b52173a
Opcode Fuzzy Hash: 3b01c7a3c2697fdcf8fc48b6255fa2fefa5946214a9d32d29980f9bb6fae4a35
Instruction Fuzzy Hash: 8A21CF316041498FDB129F68E464FAB7BA2FF98314F114429F805CB251CB34CD96DB95

Function 008CD228 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75f664989093c073dfe0aec6c6f71311ab0cd6cef2389ace46014a02d5619591
Instruction ID: 1330c04d9014802984f92fd7589df471d3d2838bbc437d2f1ffed4dae93f00a7
Opcode Fuzzy Hash: 75f664989093c073dfe0aec6c6f71311ab0cd6cef2389ace46014a02d5619591
Instruction Fuzzy Hash: D021F4749012088FCB08EFB4E854AEEB7B2FB89301F10542AD405B73A4DB36A949CF65

Function 008C5A70 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec1c9df446a85c3cb8e9a4abafce358fc1ff475f07d1e13aaa6cb1f406fadebb
Instruction ID: 754f8ebd844e02d450588bf1e7091f366dd24ea8e397b638fdec5ec6f26c5509
Opcode Fuzzy Hash: ec1c9df446a85c3cb8e9a4abafce358fc1ff475f07d1e13aaa6cb1f406fadebb
Instruction Fuzzy Hash: 2E118E35740A219FCB1A9A2AC4A4A3EB7A6FF88761715456CE906CB350DF30EC428BD4

Function 0086D3FF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1615567180.000000000086D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0086D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_86d000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2c4bb083ffa01750429338de36c7bd8c3c5b68e8b11f755f55576fea2132e6f
Instruction ID: 60a708f642e88d7ebf7350b439ac90a778c3fb6bb1bfab8033e442756f9eb1fe
Opcode Fuzzy Hash: c2c4bb083ffa01750429338de36c7bd8c3c5b68e8b11f755f55576fea2132e6f
Instruction Fuzzy Hash: 6B11B176904280DFCB16CF10D5C4B16BF72FB94324F28C5A9DC494B656C33AE856CBA1

Function 008C1F61 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dda6b23366eb0b66f42e57d04da82ffd7c787e0478455a7a11445f365246cf9
Instruction ID: f37e2a060764792a91fb60f7af74c14e6f7330ef125accf179287561b69bf5d8
Opcode Fuzzy Hash: 2dda6b23366eb0b66f42e57d04da82ffd7c787e0478455a7a11445f365246cf9
Instruction Fuzzy Hash: 0121EFB4C052098FCB41EFA8D8485EEBFF4FF09301F10556AD805B7264EB305A59CBA5

Function 008C5607 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cdae67ac13b82e5c5cf0949c9012154cef995c4b80164955a96e13ba4c0f638
Instruction ID: 51b90c488596597019d3f600e232ca5410dedd9ad39bcfe787548f00ae7dfdc4
Opcode Fuzzy Hash: 6cdae67ac13b82e5c5cf0949c9012154cef995c4b80164955a96e13ba4c0f638
Instruction Fuzzy Hash: 57019271B001146FCB068E589810BEE3BA7EBC8751F28802AF915D7280DA71D9559795

Function 008C2010 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9c53359ed650806f0d67c476db92476ca89a8844daa35080448747fd677e121
Instruction ID: 395f6aa820aaa31d67b2d12a5391f9e5ffa1e8a2bfc49b3c5c13f8d6e81696b2
Opcode Fuzzy Hash: c9c53359ed650806f0d67c476db92476ca89a8844daa35080448747fd677e121
Instruction Fuzzy Hash: 09E0D831D243964FC722A7B4A8584FEBF70ADD7320B1546ABD0A06B446EB30156AC791

Function 008C2020 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4b7b1b7e470c426161026a97edb0a25007a2a1753545dbe83264577eec41b59
Instruction ID: 5173bff55ec8661dcf84086ce029f384702e65dc4f64c9eecc6a0c168bdb71ed
Opcode Fuzzy Hash: e4b7b1b7e470c426161026a97edb0a25007a2a1753545dbe83264577eec41b59
Instruction Fuzzy Hash: 76D01231D2032A978B10A6A5DC044EEBB38EE95221B504626D51437144EB70665986A1

Function 008C8258 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: 424aabe94c3d3ee2485083fa33323e6a4a0327aa14ef1962270f123a77eb900b
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: DBC0123324C1286A9624104E7C44EA3675CD3C17B4925013BF51CD320058529C4001A4

Function 008CA70D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2e48f083cca5bb0663c18d4a3be405d8f76820716d99606aeaef47be837ea8c
Instruction ID: 46d5d9bde28b73d7dcf867261e4cd9c33b0561eb599840837444ffb4404ed7d0
Opcode Fuzzy Hash: d2e48f083cca5bb0663c18d4a3be405d8f76820716d99606aeaef47be837ea8c
Instruction Fuzzy Hash: EFD0173BF000089FCB008F88E8408DDB7B6FB8C222B008116E911A3260C6319821DB50

Function 008C5EA8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55ca6b3ce31f0371d0190803ef8deec3745e17a6c91d623583d3752fa925e5f9
Instruction ID: 133611e2dbb9735414869bdf974e4e8fc333d785b91c3dca3e610ea57dc71898
Opcode Fuzzy Hash: 55ca6b3ce31f0371d0190803ef8deec3745e17a6c91d623583d3752fa925e5f9
Instruction Fuzzy Hash: 01D02B709043820FCB12F330F5A28983B26EA83104B548195FC828911BEABE498F9B72

Function 008C5EB8 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d57a903c7f88bf965d31259b738b75d5111f9dec3cb81eabd214e7bf0ac1089d
Instruction ID: 66227afc70ac50cdb0db8cb41d249559eabe98a71f5fc41c89467d6f44bb904d
Opcode Fuzzy Hash: d57a903c7f88bf965d31259b738b75d5111f9dec3cb81eabd214e7bf0ac1089d
Instruction Fuzzy Hash: 67C012705103094FD541F771EA45A15331EF6C5600F808510F04A4552DEFB85A8A5AA6

Non-executed Functions

Function 008C3573 Relevance: 2.8, Strings: 2, Instructions: 269COMMON

Download Yara Rule

Strings

Xq, xrefs: 008C35AF
$q, xrefs: 008C3596

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID: Xq$$q
API String ID: 0-855381642
Opcode ID: a2f7f3a587c3df0c039d7452aad3c02a99163e41a38a3669d43b049e80d01e5f
Instruction ID: 592a081e78152e041e437cab1cc669c0bf757c68c04062be34416656a94ab825
Opcode Fuzzy Hash: a2f7f3a587c3df0c039d7452aad3c02a99163e41a38a3669d43b049e80d01e5f
Instruction Fuzzy Hash: A4915934F002589BDB98EB78985476EBAB6FF88710B14842EA406E7384CE34DD069B91

Function 008C21E2 Relevance: 5.1, Strings: 4, Instructions: 147COMMON

Download Yara Rule

Strings

Xq, xrefs: 008C2314
Xq, xrefs: 008C220E
Xq, xrefs: 008C22C7
Xq, xrefs: 008C2248

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID: Xq$Xq$Xq$Xq
API String ID: 0-3965792415
Opcode ID: f30e0bf889c108efb43305926b6c93c0215572f88dc90dc2f6b63148914608c1
Instruction ID: 5b47096505b3f167088b09ebb32ea902baeef3343c0717b3e88d754ec515ba6a
Opcode Fuzzy Hash: f30e0bf889c108efb43305926b6c93c0215572f88dc90dc2f6b63148914608c1
Instruction Fuzzy Hash: 2E519270E043298BDF659B688855BAEB7B6FF89300F1445ADC40AE7391DB70CD85CB92

Function 008C6088 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;q, xrefs: 008C609E
\;q, xrefs: 008C6094
\;q, xrefs: 008C60C6
\;q, xrefs: 008C60BA

Memory Dump Source

Source File: 00000000.00000002.1615854657.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8c0000_Ddj3E3qerh.jbxd

Similarity

API ID:
String ID: \;q$\;q$\;q$\;q
API String ID: 0-2933265366
Opcode ID: 43754d738145ad85a467ebce741084a14520cbdf741c6168eb39e85f2d07a7b3
Instruction ID: c6ea2c35426e4aff6a387e403bdf73917484c0eba8afa09fdf53ac5543b48d06
Opcode Fuzzy Hash: 43754d738145ad85a467ebce741084a14520cbdf741c6168eb39e85f2d07a7b3
Instruction Fuzzy Hash: 67015E317049188F8B248E2DC454F2573B6FF89765729427EE502FB2A0EA71DC628B51

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Ddj3E3qerh.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Ddj3E3qerh.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
Ddj3E3qerh.exe