Edit tour

Windows Analysis Report
tVuAoupHhZ.exe

Overview

General Information

Sample name:	tVuAoupHhZ.exe renamed because original name is a hash value
Original sample name:	cb84dc0df43c3fe063e43f547dd9678ffa8c054ba955f98bf35c9a8581be5c87.exe
Analysis ID:	1588345
MD5:	4634e3e6584b3f6f79c63b718dcd858c
SHA1:	2a540ad0f78d989a4a32521354aaa7ec65a83a9e
SHA256:	cb84dc0df43c3fe063e43f547dd9678ffa8c054ba955f98bf35c9a8581be5c87
Tags:	exeSnakeKeyloggeruser-adrian__luca
Infos:

Detection

Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Snake Keylogger

AI detected suspicious sample

Machine Learning detection for sample

Self deletion via cmd or bat file

Tries to detect the country of the analysis system (by using the IP)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

tVuAoupHhZ.exe (PID: 1276 cmdline: "C:\Users\user\Desktop\tVuAoupHhZ.exe" MD5: 4634E3E6584B3F6F79C63B718DCD858C)

cmd.exe (PID: 2876 cmdline: "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\tVuAoupHhZ.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5060 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

choice.exe (PID: 7064 cmdline: choice /C Y /N /D Y /T 3 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "clienti@damaz.it", "Password": "348cli", "Host": "mail.damaz.it", "Port": "587", "Version": "5.1"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
tVuAoupHhZ.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
tVuAoupHhZ.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
tVuAoupHhZ.exe	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
tVuAoupHhZ.exe	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14b67:$a1: get_encryptedPassword 0x14e53:$a2: get_encryptedUsername 0x14973:$a3: get_timePasswordChanged 0x14a6e:$a4: get_passwordField 0x14b7d:$a5: set_encryptedPassword 0x16245:$a7: get_logins 0x161a8:$a10: KeyLoggerEventArgs 0x15e13:$a11: KeyLoggerEventArgsEventHandler
tVuAoupHhZ.exe	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c52d:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b75f:$a3: \Google\Chrome\User Data\Default\Login Data 0x1bb92:$a4: \Orbitum\User Data\Default\Login Data 0x1cbd1:$a5: \Kometa\User Data\Default\Login Data
tVuAoupHhZ.exe	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x15777:$s1: UnHook 0x1577e:$s2: SetHook 0x15786:$s3: CallNextHook 0x15793:$s4: _hook
tVuAoupHhZ.exe	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x184d0:$x1: $%SMTPDV$ 0x18536:$x2: $#TheHashHere%& 0x19b2f:$x3: %FTPDV$ 0x19c23:$x4: $%TelegramDv$ 0x15e13:$x5: KeyLoggerEventArgs 0x161a8:$x5: KeyLoggerEventArgs 0x19b53:$m2: Clipboard Logs ID 0x19d73:$m2: Screenshot Logs ID 0x19e83:$m2: keystroke Logs ID 0x1a15d:$m3: SnakePW 0x19d4b:$m4: \SnakeKeylogger\
Click to see the 2 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2238928111.0000000002D49000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000000.2073909707.0000000000832000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.2073909707.0000000000832000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000000.2073909707.0000000000832000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14967:$a1: get_encryptedPassword 0x14c53:$a2: get_encryptedUsername 0x14773:$a3: get_timePasswordChanged 0x1486e:$a4: get_passwordField 0x1497d:$a5: set_encryptedPassword 0x16045:$a7: get_logins 0x15fa8:$a10: KeyLoggerEventArgs 0x15c13:$a11: KeyLoggerEventArgsEventHandler
00000000.00000000.2073909707.0000000000832000.00000002.00000001.01000000.00000003.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x182d0:$x1: $%SMTPDV$ 0x18336:$x2: $#TheHashHere%& 0x1992f:$x3: %FTPDV$ 0x19a23:$x4: $%TelegramDv$ 0x15c13:$x5: KeyLoggerEventArgs 0x15fa8:$x5: KeyLoggerEventArgs 0x19953:$m2: Clipboard Logs ID 0x19b73:$m2: Screenshot Logs ID 0x19c83:$m2: keystroke Logs ID 0x19f5d:$m3: SnakePW 0x19b4b:$m4: \SnakeKeylogger\
00000000.00000002.2238928111.0000000002B91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: tVuAoupHhZ.exe PID: 1276	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: tVuAoupHhZ.exe PID: 1276	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: tVuAoupHhZ.exe PID: 1276	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1b452:$a1: get_encryptedPassword 0x1b734:$a2: get_encryptedUsername 0x1b268:$a3: get_timePasswordChanged 0x1b363:$a4: get_passwordField 0x1b468:$a5: set_encryptedPassword 0x1d983:$a7: get_logins 0x1d8e6:$a10: KeyLoggerEventArgs 0x1d551:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: tVuAoupHhZ.exe PID: 1276	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1d551:$x5: KeyLoggerEventArgs 0x1d8e6:$x5: KeyLoggerEventArgs 0x1e4bf:$x5: KeyLoggerEventArgs 0x1e820:$x5: KeyLoggerEventArgs 0x1fb31:$m2: Clipboard Logs ID 0x1fc28:$m2: Screenshot Logs ID 0x1fc7e:$m2: keystroke Logs ID 0x1fdb3:$m3: SnakePW 0x1fc14:$m4: \SnakeKeylogger\
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.tVuAoupHhZ.exe.830000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.tVuAoupHhZ.exe.830000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.tVuAoupHhZ.exe.830000.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.0.tVuAoupHhZ.exe.830000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14b67:$a1: get_encryptedPassword 0x14e53:$a2: get_encryptedUsername 0x14973:$a3: get_timePasswordChanged 0x14a6e:$a4: get_passwordField 0x14b7d:$a5: set_encryptedPassword 0x16245:$a7: get_logins 0x161a8:$a10: KeyLoggerEventArgs 0x15e13:$a11: KeyLoggerEventArgsEventHandler
0.0.tVuAoupHhZ.exe.830000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c52d:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b75f:$a3: \Google\Chrome\User Data\Default\Login Data 0x1bb92:$a4: \Orbitum\User Data\Default\Login Data 0x1cbd1:$a5: \Kometa\User Data\Default\Login Data
0.0.tVuAoupHhZ.exe.830000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x15777:$s1: UnHook 0x1577e:$s2: SetHook 0x15786:$s3: CallNextHook 0x15793:$s4: _hook
0.0.tVuAoupHhZ.exe.830000.0.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x184d0:$x1: $%SMTPDV$ 0x18536:$x2: $#TheHashHere%& 0x19b2f:$x3: %FTPDV$ 0x19c23:$x4: $%TelegramDv$ 0x15e13:$x5: KeyLoggerEventArgs 0x161a8:$x5: KeyLoggerEventArgs 0x19b53:$m2: Clipboard Logs ID 0x19d73:$m2: Screenshot Logs ID 0x19e83:$m2: keystroke Logs ID 0x1a15d:$m3: SnakePW 0x19d4b:$m4: \SnakeKeylogger\
Click to see the 2 entries

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T00:50:32.674639+0100	2803305	3	Unknown Traffic	192.168.2.5	49706	104.21.32.1	443	TCP
2025-01-11T00:50:35.309466+0100	2803305	3	Unknown Traffic	192.168.2.5	49710	104.21.32.1	443	TCP
2025-01-11T00:50:36.493350+0100	2803305	3	Unknown Traffic	192.168.2.5	49712	104.21.32.1	443	TCP
2025-01-11T00:50:37.643911+0100	2803305	3	Unknown Traffic	192.168.2.5	49714	104.21.32.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T00:50:30.039653+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49704	193.122.130.0	80	TCP
2025-01-11T00:50:30.242747+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49704	193.122.130.0	80	TCP
2025-01-11T00:50:32.070914+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49704	193.122.130.0	80	TCP
2025-01-11T00:50:33.448230+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49707	193.122.130.0	80	TCP
2025-01-11T00:50:34.742778+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49709	193.122.130.0	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: tVuAoupHhZ.exe

Avira: detected

Found malware configuration

Source: 00000000.00000002.2238928111.0000000002B91000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "clienti@damaz.it", "Password": "348cli", "Host": "mail.damaz.it", "Port": "587", "Version": "5.1"}

Multi AV Scanner detection for submitted file

Source: tVuAoupHhZ.exe	Virustotal: Detection: 66%			Perma Link
Source: tVuAoupHhZ.exe	ReversingLabs: Detection: 91%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: tVuAoupHhZ.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: tVuAoupHhZ.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.5:49705 version: TLS 1.0

Source: tVuAoupHhZ.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Yara detected Generic Downloader

Source: Yara match	File source: tVuAoupHhZ.exe, type: SAMPLE
Source: Yara match	File source: 0.0.tVuAoupHhZ.exe.830000.0.unpack, type: UNPACKEDPE

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.32.1 104.21.32.1
Source: Joe Sandbox View	IP Address: 193.122.130.0 193.122.130.0

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49707 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49709 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49704 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49710 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49706 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49712 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49714 -> 104.21.32.1:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.5:49705 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002D0C000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002C57000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002CFE000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002D49000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002D0C000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002C57000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002D27000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002CFE000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002D49000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002C4B000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002CA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002B91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: tVuAoupHhZ.exe	String found in binary or memory: http://checkip.dyndns.org/q
Source: tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002D0C000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002CFE000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002D49000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002C7A000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002B91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002D0C000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002C57000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002CFE000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002D49000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002CA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: tVuAoupHhZ.exe	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002CA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002D0C000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002CFE000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002D49000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002CA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

System Summary

Malicious sample detected (through community Yara rule)

Source: tVuAoupHhZ.exe, type: SAMPLE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: tVuAoupHhZ.exe, type: SAMPLE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: tVuAoupHhZ.exe, type: SAMPLE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: tVuAoupHhZ.exe, type: SAMPLE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.0.tVuAoupHhZ.exe.830000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.0.tVuAoupHhZ.exe.830000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.0.tVuAoupHhZ.exe.830000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.0.tVuAoupHhZ.exe.830000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000000.2073909707.0000000000832000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000000.2073909707.0000000000832000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: tVuAoupHhZ.exe PID: 1276, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: tVuAoupHhZ.exe PID: 1276, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen

Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Code function: 0_2_0299C1D2	0_2_0299C1D2
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Code function: 0_2_029951C5	0_2_029951C5
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Code function: 0_2_0299A1E8	0_2_0299A1E8
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Code function: 0_2_02997680	0_2_02997680
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Code function: 0_2_0299C790	0_2_0299C790
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Code function: 0_2_0299C4B2	0_2_0299C4B2
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Code function: 0_2_02994AD9	0_2_02994AD9
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Code function: 0_2_0299CA70	0_2_0299CA70
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Code function: 0_2_02996F09	0_2_02996F09
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Code function: 0_2_0299BD28	0_2_0299BD28
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Code function: 0_2_0299CD52	0_2_0299CD52
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Code function: 0_2_0299523C	0_2_0299523C
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Code function: 0_2_02993572	0_2_02993572
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Code function: 0_2_0299BEF0	0_2_0299BEF0

Source: tVuAoupHhZ.exe, 00000000.00000000.2073909707.0000000000832000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs tVuAoupHhZ.exe
Source: tVuAoupHhZ.exe, 00000000.00000002.2238214578.0000000000CDE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs tVuAoupHhZ.exe
Source: tVuAoupHhZ.exe	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs tVuAoupHhZ.exe

Source: tVuAoupHhZ.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: tVuAoupHhZ.exe, type: SAMPLE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: tVuAoupHhZ.exe, type: SAMPLE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: tVuAoupHhZ.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: tVuAoupHhZ.exe, type: SAMPLE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.0.tVuAoupHhZ.exe.830000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.0.tVuAoupHhZ.exe.830000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.tVuAoupHhZ.exe.830000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.0.tVuAoupHhZ.exe.830000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000000.2073909707.0000000000832000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000000.2073909707.0000000000832000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: tVuAoupHhZ.exe PID: 1276, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: tVuAoupHhZ.exe PID: 1276, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger

Source: classification engine

Classification label: mal100.troj.winEXE@6/1@2/2

Source: C:\Users\user\Desktop\tVuAoupHhZ.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\tVuAoupHhZ.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5060:120:WilError_03

Source: tVuAoupHhZ.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: tVuAoupHhZ.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%

Source: C:\Users\user\Desktop\tVuAoupHhZ.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\tVuAoupHhZ.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: tVuAoupHhZ.exe	Virustotal: Detection: 66%
Source: tVuAoupHhZ.exe	ReversingLabs: Detection: 91%

Source: tVuAoupHhZ.exe

String found in binary or memory: F-Stopw

Source: unknown	Process created: C:\Users\user\Desktop\tVuAoupHhZ.exe "C:\Users\user\Desktop\tVuAoupHhZ.exe"
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\tVuAoupHhZ.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /C Y /N /D Y /T 3
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\tVuAoupHhZ.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /C Y /N /D Y /T 3	Jump to behavior

Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior

Source: tVuAoupHhZ.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: tVuAoupHhZ.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Hooking and other Techniques for Hiding and Protection

Self deletion via cmd or bat file

Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process created: "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\tVuAoupHhZ.exe"
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process created: "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\tVuAoupHhZ.exe"			Jump to behavior

Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Memory allocated: 2990000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Memory allocated: 2B90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Memory allocated: 2AC0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 599874	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 599655	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 599537	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 599353	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 599247	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 599124	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 598905	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 598575	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 598249	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 597921	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 597593	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 597374	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 597265	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 597046	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 596820	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 596718	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 596609	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 596496	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 596390	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 596170	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 596062	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 595953	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 595843	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 595734	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 595625	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 595515	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 595296	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 595187	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 595077	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 594968	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 594749	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 594640	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 594531	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 594421	Jump to behavior

Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Window / User API: threadDelayed 1820			Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Window / User API: threadDelayed 8017			Jump to behavior

Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -30437127721620741s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -599874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 6600	Thread sleep count: 1820 > 30	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 6600	Thread sleep count: 8017 > 30	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -599655s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -599537s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -599353s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -599247s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -599124s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -599015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -598905s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -598796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -598687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -598575s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -598468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -598359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -598249s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -598140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -598031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -597921s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -597812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -597703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -597593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -597484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -597374s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -597265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -597156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -597046s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -596937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -596820s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -596718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -596609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -596496s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -596390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -596281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -596170s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -596062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -595953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -595843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -595734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -595625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -595515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -595406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -595296s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -595187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -595077s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -594968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -594859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -594749s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -594640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -594531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe TID: 5972	Thread sleep time: -594421s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 599874	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 599655	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 599537	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 599353	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 599247	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 599124	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 598905	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 598575	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 598249	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 597921	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 597593	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 597374	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 597265	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 597046	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 596820	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 596718	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 596609	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 596496	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 596390	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 596170	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 596062	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 595953	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 595843	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 595734	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 595625	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 595515	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 595296	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 595187	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 595077	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 594968	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 594749	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 594640	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 594531	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Thread delayed: delay time: 594421	Jump to behavior

Source: tVuAoupHhZ.exe, 00000000.00000002.2240301996.0000000006277000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: tVuAoupHhZ.exe, 00000000.00000002.2238214578.0000000000D13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\tVuAoupHhZ.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\tVuAoupHhZ.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\tVuAoupHhZ.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\tVuAoupHhZ.exe"			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /C Y /N /D Y /T 3			Jump to behavior

Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Queries volume information: C:\Users\user\Desktop\tVuAoupHhZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\tVuAoupHhZ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\tVuAoupHhZ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: tVuAoupHhZ.exe, type: SAMPLE
Source: Yara match	File source: 0.0.tVuAoupHhZ.exe.830000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2238928111.0000000002D49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2073909707.0000000000832000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2238928111.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: tVuAoupHhZ.exe PID: 1276, type: MEMORYSTR

Source: Yara match	File source: tVuAoupHhZ.exe, type: SAMPLE
Source: Yara match	File source: 0.0.tVuAoupHhZ.exe.830000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2073909707.0000000000832000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: tVuAoupHhZ.exe PID: 1276, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: tVuAoupHhZ.exe, type: SAMPLE
Source: Yara match	File source: 0.0.tVuAoupHhZ.exe.830000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2238928111.0000000002D49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2073909707.0000000000832000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2238928111.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: tVuAoupHhZ.exe PID: 1276, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	12 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
tVuAoupHhZ.exe	67%	Virustotal		Browse
tVuAoupHhZ.exe	92%	ReversingLabs	Win32.Keylogger.NotFound
tVuAoupHhZ.exe	100%	Avira	TR/ATRAPS.Gen
tVuAoupHhZ.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	104.21.32.1	true	false	high
checkip.dyndns.com	193.122.130.0	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false		high
https://reallyfreegeoip.org/xml/8.46.123.189	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://reallyfreegeoip.org	tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002D0C000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002C57000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002CFE000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002D49000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002CA5000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002D0C000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002C57000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002D27000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002CFE000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002D49000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002C4B000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002CA5000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.com	tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002D0C000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002C57000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002CFE000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002D49000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002B91000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/q	tVuAoupHhZ.exe	false	high
https://reallyfreegeoip.org/xml/8.46.123.189$	tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002D0C000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002CFE000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002D49000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002CA5000.00000004.00000800.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.org	tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002D0C000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002CFE000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002D49000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002C7A000.00000004.00000800.00020000.00000000.sdmp, tVuAoupHhZ.exe, 00000000.00000002.2238928111.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	tVuAoupHhZ.exe	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.32.1	reallyfreegeoip.org	United States		13335	CLOUDFLARENETUS	false
193.122.130.0	checkip.dyndns.com	United States		31898	ORACLE-BMC-31898US	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588345
Start date and time:	2025-01-11 00:49:27 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	tVuAoupHhZ.exe renamed because original name is a hash value
Original Sample Name:	cb84dc0df43c3fe063e43f547dd9678ffa8c054ba955f98bf35c9a8581be5c87.exe
Detection:	MAL
Classification:	mal100.troj.winEXE@6/1@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 55 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 20.109.210.53
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target tVuAoupHhZ.exe, PID 1276 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
18:50:31	API Interceptor	73x Sleep call for process: tVuAoupHhZ.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.32.1	25IvlOVEB1.exe	Get hash	malicious	FormBook	Browse	www.masterqq.pro/3vdc/
	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	www.mzkd6gp5.top/3u0p/
	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	redroomaudio.com/administrator/index.php
193.122.130.0	WGi85dsMNp.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	wymvwQ4mC4.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	C5JLkBS1CX.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	VQsnGWaNi5.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	lsc5QN46NH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	y1jQC8Y6bP.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	zAK7HHniGW.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	B3aqD8srjF.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	VIAmJUhQ54.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	bd9Gvqt6AK.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.80.1
	Kb94RzMYNf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	WGi85dsMNp.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.16.1
	wymvwQ4mC4.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	H75MnQEha8.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.112.1
	3i1gMM8K4z.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	2NJzy3tiny.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.32.1
	z87sammylastborn.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	vnV17JImCH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	czHx16QwGQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.112.1
checkip.dyndns.com	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Kb94RzMYNf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	WGi85dsMNp.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.130.0
	wymvwQ4mC4.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	H75MnQEha8.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	WGi85dsMNp.exe	Get hash	malicious	GuLoader	Browse	158.101.44.242
	3i1gMM8K4z.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	2NJzy3tiny.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	z87sammylastborn.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	vnV17JImCH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	phish_alert_sp2_2.0.0.0(4).eml	Get hash	malicious	Unknown	Browse	192.29.202.93
	https://app.online.mt.com/e/es?s=961579678&e=14507707&elqTrackId=4f40dcb3a3854013ad3a46d461cc3aff&elq=5140e028df1a42afab491350388fd129&elqaid=221811&elqat=1&elqcst=272&elqcsid=2325629&elqak=8AF5D97DFF9E423CC7C7524F5CA3C1A86F5F67341B9DF612D5A2FB20DE928F2AA351	Get hash	malicious	Unknown	Browse	192.29.202.93
	https://app.online.mt.com/e/es?s=961579678&e=14507707&elqTrackId=4f40dcb3a3854013ad3a46d461cc3aff&elq=5140e028df1a42afab491350388fd129&elqaid=221811&elqat=1&elqcst=272&elqcsid=2325629&elqak=8AF5D97DFF9E423CC7C7524F5CA3C1A86F5F67341B9DF612D5A2FB20DE928F2AA351	Get hash	malicious	Unknown	Browse	192.29.202.93
	WGi85dsMNp.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.130.0
	wymvwQ4mC4.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	WGi85dsMNp.exe	Get hash	malicious	GuLoader	Browse	158.101.44.242
	3i1gMM8K4z.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	2NJzy3tiny.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	vnV17JImCH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	czHx16QwGQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
CLOUDFLARENETUS	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.80.1
	phish_alert_sp2_2.0.0.0(4).eml	Get hash	malicious	Unknown	Browse	172.66.0.227
	https://app.online.mt.com/e/es?s=961579678&e=14507707&elqTrackId=4f40dcb3a3854013ad3a46d461cc3aff&elq=5140e028df1a42afab491350388fd129&elqaid=221811&elqat=1&elqcst=272&elqcsid=2325629&elqak=8AF5D97DFF9E423CC7C7524F5CA3C1A86F5F67341B9DF612D5A2FB20DE928F2AA351	Get hash	malicious	Unknown	Browse	172.66.0.227
	https://app.online.mt.com/e/es?s=961579678&e=14507707&elqTrackId=4f40dcb3a3854013ad3a46d461cc3aff&elq=5140e028df1a42afab491350388fd129&elqaid=221811&elqat=1&elqcst=272&elqcsid=2325629&elqak=8AF5D97DFF9E423CC7C7524F5CA3C1A86F5F67341B9DF612D5A2FB20DE928F2AA351	Get hash	malicious	Unknown	Browse	172.66.0.227
	https://maya-lopez.filemail.com/t/XhcWEjoR	Get hash	malicious	Unknown	Browse	188.114.96.3
	25IvlOVEB1.exe	Get hash	malicious	FormBook	Browse	104.21.32.1
	Kb94RzMYNf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	WGi85dsMNp.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.16.1
	wymvwQ4mC4.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	H75MnQEha8.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.112.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.32.1
	Kb94RzMYNf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	WGi85dsMNp.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
	wymvwQ4mC4.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.32.1
	H75MnQEha8.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.32.1
	3i1gMM8K4z.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	2NJzy3tiny.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.32.1
	z87sammylastborn.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.32.1
	vnV17JImCH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	czHx16QwGQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\tVuAoupHhZ.exe.log

Download File

Process:	C:\Users\user\Desktop\tVuAoupHhZ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1039
Entropy (8bit):	5.353332853270839
Encrypted:	false
SSDEEP:	24:ML9E4KiE4Ko84qXKDE4KhKiKhPKIE4oKNzKoZAE4KzeR:MxHKiHKoviYHKh3oPtHo6hAHKzeR
MD5:	A4AF0F36EC4E0C69DC0F860C891E8BBE
SHA1:	28DD81A1EDDF71CBCBF86DA986E047279EF097CD
SHA-256:	B038D4342E4DD96217BD90CFE32581FCCB381C5C2E6FF257CD32854F840D1FDE
SHA-512:	A675D3E9DB5BDD325A22E82C6BCDBD5409D7A34453DAAEB0E37206BE982C388547E1BDF22DC70393C69D0CE55635E2364502572C3AD2E6753A56A5C3893F6D69
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.827429319739148
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.79% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01%
File name:	tVuAoupHhZ.exe
File size:	134'144 bytes
MD5:	4634e3e6584b3f6f79c63b718dcd858c
SHA1:	2a540ad0f78d989a4a32521354aaa7ec65a83a9e
SHA256:	cb84dc0df43c3fe063e43f547dd9678ffa8c054ba955f98bf35c9a8581be5c87
SHA512:	3e5246d594069ba469cf26dc8002e0020a874b2f0ceac25d31b5dcdbf6aca46901c7409a227460c3ff532cebfdd3f0009ad898b76cf5e97c5024761a0b1fdf52
SSDEEP:	3072:nq/6fidzVhevEzfPUilnb51D5sLCwvxpJgbY:q2i5ckbD8Cb
TLSH:	76D3080927E49814E1FFAA730670A111C779B8431A6ADE1D1BC2F86D2B7D6D1CE06F93
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....-.f..............P.............>.... ... ....@.. .......................`............@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x42143e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66972DD9 [Wed Jul 17 02:35:05 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x213e4	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x22000	0x108f	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x1f444	0x1f600	c7526c70c8d9ac73e17221a18802f8e0	False	0.3557566608565737	data	5.84047926916259	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x22000	0x108f	0x1200	f59392b7fa5e8b22ad0c6b19a0b07c20	False	0.3663194444444444	data	4.868462934974607	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x24000	0xc	0x200	6890ec35b658cdac6b1695e39bbdb5d4	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x220a0	0x394	OpenPGP Secret Key			0.42358078602620086
RT_MANIFEST	0x22434	0xc5b	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.3926651912741069

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T00:50:30.039653+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49704	193.122.130.0	80	TCP
2025-01-11T00:50:30.242747+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49704	193.122.130.0	80	TCP
2025-01-11T00:50:32.070914+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49704	193.122.130.0	80	TCP
2025-01-11T00:50:32.674639+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49706	104.21.32.1	443	TCP
2025-01-11T00:50:33.448230+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49707	193.122.130.0	80	TCP
2025-01-11T00:50:34.742778+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49709	193.122.130.0	80	TCP
2025-01-11T00:50:35.309466+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49710	104.21.32.1	443	TCP
2025-01-11T00:50:36.493350+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49712	104.21.32.1	443	TCP
2025-01-11T00:50:37.643911+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49714	104.21.32.1	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 00:50:23.801529884 CET	49704	80	192.168.2.5	193.122.130.0
Jan 11, 2025 00:50:23.806397915 CET	80	49704	193.122.130.0	192.168.2.5
Jan 11, 2025 00:50:23.806555033 CET	49704	80	192.168.2.5	193.122.130.0
Jan 11, 2025 00:50:23.807720900 CET	49704	80	192.168.2.5	193.122.130.0
Jan 11, 2025 00:50:23.837852001 CET	80	49704	193.122.130.0	192.168.2.5
Jan 11, 2025 00:50:26.879671097 CET	80	49704	193.122.130.0	192.168.2.5
Jan 11, 2025 00:50:26.884701014 CET	49704	80	192.168.2.5	193.122.130.0
Jan 11, 2025 00:50:26.891093016 CET	80	49704	193.122.130.0	192.168.2.5
Jan 11, 2025 00:50:29.987149000 CET	80	49704	193.122.130.0	192.168.2.5
Jan 11, 2025 00:50:30.039653063 CET	49704	80	192.168.2.5	193.122.130.0
Jan 11, 2025 00:50:30.093719006 CET	49704	80	192.168.2.5	193.122.130.0
Jan 11, 2025 00:50:30.100155115 CET	80	49704	193.122.130.0	192.168.2.5
Jan 11, 2025 00:50:30.196466923 CET	80	49704	193.122.130.0	192.168.2.5
Jan 11, 2025 00:50:30.242747068 CET	49704	80	192.168.2.5	193.122.130.0
Jan 11, 2025 00:50:30.245855093 CET	49705	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:30.245898962 CET	443	49705	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:30.245975018 CET	49705	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:30.252974987 CET	49705	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:30.253007889 CET	443	49705	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:30.722625017 CET	443	49705	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:30.722700119 CET	49705	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:30.728159904 CET	49705	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:30.728193045 CET	443	49705	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:30.728672981 CET	443	49705	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:30.774456024 CET	49705	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:30.780864000 CET	49705	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:30.827337027 CET	443	49705	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:30.901397943 CET	443	49705	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:30.901483059 CET	443	49705	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:30.901550055 CET	49705	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:30.906349897 CET	49705	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:30.910008907 CET	49704	80	192.168.2.5	193.122.130.0
Jan 11, 2025 00:50:30.914940119 CET	80	49704	193.122.130.0	192.168.2.5
Jan 11, 2025 00:50:32.016899109 CET	80	49704	193.122.130.0	192.168.2.5
Jan 11, 2025 00:50:32.020181894 CET	49706	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:32.020227909 CET	443	49706	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:32.020320892 CET	49706	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:32.020796061 CET	49706	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:32.020813942 CET	443	49706	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:32.070914030 CET	49704	80	192.168.2.5	193.122.130.0
Jan 11, 2025 00:50:32.479476929 CET	443	49706	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:32.524005890 CET	49706	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:32.564136028 CET	49706	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:32.564156055 CET	443	49706	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:32.674660921 CET	443	49706	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:32.674730062 CET	443	49706	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:32.674776077 CET	49706	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:32.681898117 CET	49706	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:32.762005091 CET	49704	80	192.168.2.5	193.122.130.0
Jan 11, 2025 00:50:32.763292074 CET	49707	80	192.168.2.5	193.122.130.0
Jan 11, 2025 00:50:32.768567085 CET	80	49704	193.122.130.0	192.168.2.5
Jan 11, 2025 00:50:32.768634081 CET	49704	80	192.168.2.5	193.122.130.0
Jan 11, 2025 00:50:32.769476891 CET	80	49707	193.122.130.0	192.168.2.5
Jan 11, 2025 00:50:32.769551039 CET	49707	80	192.168.2.5	193.122.130.0
Jan 11, 2025 00:50:32.771907091 CET	49707	80	192.168.2.5	193.122.130.0
Jan 11, 2025 00:50:32.778390884 CET	80	49707	193.122.130.0	192.168.2.5
Jan 11, 2025 00:50:33.397109985 CET	80	49707	193.122.130.0	192.168.2.5
Jan 11, 2025 00:50:33.398320913 CET	49708	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:33.398377895 CET	443	49708	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:33.398446083 CET	49708	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:33.398689985 CET	49708	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:33.398699999 CET	443	49708	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:33.448230028 CET	49707	80	192.168.2.5	193.122.130.0
Jan 11, 2025 00:50:33.878880024 CET	443	49708	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:33.880676985 CET	49708	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:33.880709887 CET	443	49708	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:34.035839081 CET	443	49708	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:34.035907030 CET	443	49708	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:34.036072969 CET	49708	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:34.036401987 CET	49708	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:34.039509058 CET	49707	80	192.168.2.5	193.122.130.0
Jan 11, 2025 00:50:34.040960073 CET	49709	80	192.168.2.5	193.122.130.0
Jan 11, 2025 00:50:34.047030926 CET	80	49707	193.122.130.0	192.168.2.5
Jan 11, 2025 00:50:34.047446012 CET	49707	80	192.168.2.5	193.122.130.0
Jan 11, 2025 00:50:34.047847986 CET	80	49709	193.122.130.0	192.168.2.5
Jan 11, 2025 00:50:34.047924995 CET	49709	80	192.168.2.5	193.122.130.0
Jan 11, 2025 00:50:34.048089981 CET	49709	80	192.168.2.5	193.122.130.0
Jan 11, 2025 00:50:34.055234909 CET	80	49709	193.122.130.0	192.168.2.5
Jan 11, 2025 00:50:34.700704098 CET	80	49709	193.122.130.0	192.168.2.5
Jan 11, 2025 00:50:34.701958895 CET	49710	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:34.701992035 CET	443	49710	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:34.702063084 CET	49710	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:34.702287912 CET	49710	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:34.702295065 CET	443	49710	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:34.742778063 CET	49709	80	192.168.2.5	193.122.130.0
Jan 11, 2025 00:50:35.164118052 CET	443	49710	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:35.178666115 CET	49710	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:35.178706884 CET	443	49710	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:35.309488058 CET	443	49710	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:35.309556007 CET	443	49710	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:35.309628963 CET	49710	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:35.310087919 CET	49710	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:35.314620972 CET	49711	80	192.168.2.5	193.122.130.0
Jan 11, 2025 00:50:35.320105076 CET	80	49711	193.122.130.0	192.168.2.5
Jan 11, 2025 00:50:35.320204020 CET	49711	80	192.168.2.5	193.122.130.0
Jan 11, 2025 00:50:35.320323944 CET	49711	80	192.168.2.5	193.122.130.0
Jan 11, 2025 00:50:35.327541113 CET	80	49711	193.122.130.0	192.168.2.5
Jan 11, 2025 00:50:35.904844999 CET	80	49711	193.122.130.0	192.168.2.5
Jan 11, 2025 00:50:35.906336069 CET	49712	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:35.906373024 CET	443	49712	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:35.906440020 CET	49712	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:35.906747103 CET	49712	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:35.906755924 CET	443	49712	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:35.945904970 CET	49711	80	192.168.2.5	193.122.130.0
Jan 11, 2025 00:50:36.365320921 CET	443	49712	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:36.367296934 CET	49712	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:36.367336035 CET	443	49712	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:36.493393898 CET	443	49712	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:36.493463993 CET	443	49712	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:36.493514061 CET	49712	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:36.494441032 CET	49712	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:36.499862909 CET	49711	80	192.168.2.5	193.122.130.0
Jan 11, 2025 00:50:36.500521898 CET	49713	80	192.168.2.5	193.122.130.0
Jan 11, 2025 00:50:36.507380962 CET	80	49711	193.122.130.0	192.168.2.5
Jan 11, 2025 00:50:36.507399082 CET	80	49713	193.122.130.0	192.168.2.5
Jan 11, 2025 00:50:36.507436037 CET	49711	80	192.168.2.5	193.122.130.0
Jan 11, 2025 00:50:36.507482052 CET	49713	80	192.168.2.5	193.122.130.0
Jan 11, 2025 00:50:36.507569075 CET	49713	80	192.168.2.5	193.122.130.0
Jan 11, 2025 00:50:36.514467955 CET	80	49713	193.122.130.0	192.168.2.5
Jan 11, 2025 00:50:37.025933027 CET	80	49713	193.122.130.0	192.168.2.5
Jan 11, 2025 00:50:37.027127981 CET	49714	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:37.027185917 CET	443	49714	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:37.027266979 CET	49714	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:37.027508974 CET	49714	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:37.027523041 CET	443	49714	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:37.070866108 CET	49713	80	192.168.2.5	193.122.130.0
Jan 11, 2025 00:50:37.509485960 CET	443	49714	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:37.511899948 CET	49714	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:37.511935949 CET	443	49714	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:37.643999100 CET	443	49714	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:37.644160986 CET	443	49714	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:37.644227982 CET	49714	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:37.644526958 CET	49714	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:37.647525072 CET	49713	80	192.168.2.5	193.122.130.0
Jan 11, 2025 00:50:37.648788929 CET	49715	80	192.168.2.5	193.122.130.0
Jan 11, 2025 00:50:37.652448893 CET	80	49713	193.122.130.0	192.168.2.5
Jan 11, 2025 00:50:37.652513981 CET	49713	80	192.168.2.5	193.122.130.0
Jan 11, 2025 00:50:37.653553963 CET	80	49715	193.122.130.0	192.168.2.5
Jan 11, 2025 00:50:37.653623104 CET	49715	80	192.168.2.5	193.122.130.0
Jan 11, 2025 00:50:37.653752089 CET	49715	80	192.168.2.5	193.122.130.0
Jan 11, 2025 00:50:37.658488989 CET	80	49715	193.122.130.0	192.168.2.5
Jan 11, 2025 00:50:39.137031078 CET	80	49715	193.122.130.0	192.168.2.5
Jan 11, 2025 00:50:39.138554096 CET	49716	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:39.138617992 CET	443	49716	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:39.138712883 CET	49716	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:39.138976097 CET	49716	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:39.138992071 CET	443	49716	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:39.180291891 CET	49715	80	192.168.2.5	193.122.130.0
Jan 11, 2025 00:50:39.635081053 CET	443	49716	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:39.643476963 CET	49716	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:39.643502951 CET	443	49716	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:39.787791014 CET	443	49716	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:39.787863970 CET	443	49716	104.21.32.1	192.168.2.5
Jan 11, 2025 00:50:39.787919044 CET	49716	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:39.788352966 CET	49716	443	192.168.2.5	104.21.32.1
Jan 11, 2025 00:50:39.903863907 CET	49715	80	192.168.2.5	193.122.130.0
Jan 11, 2025 00:50:39.904448032 CET	49709	80	192.168.2.5	193.122.130.0

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 00:50:23.787868977 CET	57181	53	192.168.2.5	1.1.1.1
Jan 11, 2025 00:50:23.794985056 CET	53	57181	1.1.1.1	192.168.2.5
Jan 11, 2025 00:50:30.236125946 CET	53724	53	192.168.2.5	1.1.1.1
Jan 11, 2025 00:50:30.245155096 CET	53	53724	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 00:50:23.787868977 CET	192.168.2.5	1.1.1.1	0xe8ae	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:50:30.236125946 CET	192.168.2.5	1.1.1.1	0xc280	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 00:50:23.794985056 CET	1.1.1.1	192.168.2.5	0xe8ae	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 00:50:23.794985056 CET	1.1.1.1	192.168.2.5	0xe8ae	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:50:23.794985056 CET	1.1.1.1	192.168.2.5	0xe8ae	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:50:23.794985056 CET	1.1.1.1	192.168.2.5	0xe8ae	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:50:23.794985056 CET	1.1.1.1	192.168.2.5	0xe8ae	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:50:23.794985056 CET	1.1.1.1	192.168.2.5	0xe8ae	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:50:30.245155096 CET	1.1.1.1	192.168.2.5	0xc280	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:50:30.245155096 CET	1.1.1.1	192.168.2.5	0xc280	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:50:30.245155096 CET	1.1.1.1	192.168.2.5	0xc280	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:50:30.245155096 CET	1.1.1.1	192.168.2.5	0xc280	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:50:30.245155096 CET	1.1.1.1	192.168.2.5	0xc280	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:50:30.245155096 CET	1.1.1.1	192.168.2.5	0xc280	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:50:30.245155096 CET	1.1.1.1	192.168.2.5	0xc280	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.122.130.0	80	1276	C:\Users\user\Desktop\tVuAoupHhZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 00:50:23.807720900 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 00:50:26.879671097 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 23:50:26 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 5ecc972f4baf630c8a1e855edd591095 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 11, 2025 00:50:26.884701014 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 00:50:29.987149000 CET	745	IN	HTTP/1.1 504 Gateway Time-out Date: Fri, 10 Jan 2025 23:50:29 GMT Content-Type: text/html Content-Length: 557 Connection: keep-alive X-Request-ID: b2ba13bc10bc3582341a4dc01f5c8b2c Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c [TRUNCATED] Data Ascii: <html><head><title>504 Gateway Time-out</title></head><body><center><h1>504 Gateway Time-out</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Jan 11, 2025 00:50:30.093719006 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 00:50:30.196466923 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 23:50:30 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: b5b7eeed30a039d938b9d80346880a4d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 11, 2025 00:50:30.910008907 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 00:50:32.016899109 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 23:50:31 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: bb51d36bc759a46cbd54b56c4513f05b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49707	193.122.130.0	80	1276	C:\Users\user\Desktop\tVuAoupHhZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 00:50:32.771907091 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 00:50:33.397109985 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 23:50:33 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 1408eb018f51854ecd074eaf13f39c6d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49709	193.122.130.0	80	1276	C:\Users\user\Desktop\tVuAoupHhZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 00:50:34.048089981 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 00:50:34.700704098 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 23:50:34 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 24530a062a60c9f022f71af51ddefe95 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49711	193.122.130.0	80	1276	C:\Users\user\Desktop\tVuAoupHhZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 00:50:35.320323944 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 00:50:35.904844999 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 23:50:35 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 1e3eaf138e07fe4ebf86b455e75d6d81 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49713	193.122.130.0	80	1276	C:\Users\user\Desktop\tVuAoupHhZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 00:50:36.507569075 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 00:50:37.025933027 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 23:50:36 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: bb6c5d2dd66869b8458626e20cbc5558 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49715	193.122.130.0	80	1276	C:\Users\user\Desktop\tVuAoupHhZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 00:50:37.653752089 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 00:50:39.137031078 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 23:50:39 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 35d0005661f2ddcecd309a0dced5cb8b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	104.21.32.1	443	1276	C:\Users\user\Desktop\tVuAoupHhZ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 23:50:30 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-10 23:50:30 UTC	859	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 23:50:30 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1867819 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h42INMm79wiW2%2FPD4o5EJPZzsjmqs4pYSZE59enc%2BNH2Cqfu6HrHw5gOYQNi2AB2WNgM7KgqjTH05I7cAm3%2BEALXZ0swpCmYCiWMJ7gp%2FhX6TpERfKIpkpyip%2BygLSnU3UEw6Wqd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900091dabc488cda-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1768&min_rtt=1765&rtt_var=664&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1654390&cwnd=243&unsent_bytes=0&cid=a851d8d75b7ca77a&ts=195&x=0"
2025-01-10 23:50:30 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49706	104.21.32.1	443	1276	C:\Users\user\Desktop\tVuAoupHhZ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 23:50:32 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-10 23:50:32 UTC	857	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 23:50:32 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1867821 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rBzakafIf822CH%2FIKitjohfIUD3R2VcM6AAD%2F3HucCr%2B0GHcizlNlLWpq8hGAvWsT4TdDjfMbGfFUqfoRW6CSg%2BgZpIkcB3co8dSoclwM7I5trbd0PkWvd4OhKzDHAx0QuqEPAlp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900091e5dcdc41a6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1589&min_rtt=1588&rtt_var=598&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1823860&cwnd=241&unsent_bytes=0&cid=c761b17fc1eabc3c&ts=199&x=0"
2025-01-10 23:50:32 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49708	104.21.32.1	443	1276	C:\Users\user\Desktop\tVuAoupHhZ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 23:50:33 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-10 23:50:34 UTC	863	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 23:50:33 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1867823 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O0DJ9P6b6BU6sCICPoQ3%2B4Ay%2F%2FVCxENj4ayP4cqkS3ju3pJBes6Rigf7V1jTA%2BIAm2mp8bvvLio7St6Ar%2F5P7cjOeCrb3PR%2BKtmGa6M8FoAZNyq9ms3jbUzgI99qVy3gGiUVY7%2F0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900091ee5e981875-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1666&min_rtt=1660&rtt_var=634&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1708601&cwnd=153&unsent_bytes=0&cid=ec87cffed8d90182&ts=164&x=0"
2025-01-10 23:50:34 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49710	104.21.32.1	443	1276	C:\Users\user\Desktop\tVuAoupHhZ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 23:50:35 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-10 23:50:35 UTC	861	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 23:50:35 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1867824 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=k%2B3irgUNEUIra4CJ0AxrmcRU2FKp4s1DyxLZr%2FnRUMTYd%2F3ytTTjI2rq%2FF3Yr919qNf7YxssMiVujF3tck8dl7BNVWqfCI%2FtnMY24GTGhhTyny9Ardhw2wUG9eQ10j%2BL46Wi08uN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900091f65e0fc327-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1631&min_rtt=1627&rtt_var=619&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1755862&cwnd=189&unsent_bytes=0&cid=9e996c523e9b0560&ts=154&x=0"
2025-01-10 23:50:35 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49712	104.21.32.1	443	1276	C:\Users\user\Desktop\tVuAoupHhZ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 23:50:36 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-10 23:50:36 UTC	859	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 23:50:36 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1867825 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XFlxZTNBQraFB07iloyIFW%2F5vhydcx%2BZd8d885Yb73nOxwEE%2FuzocmJsRVgDAys6fiN%2B4SZMWFRGg5qCD4cSvKwWJT1QIKtOWphLIRm%2FZsIwH7N9W6R3PiC7lQoXtYdtxK2PIj2X"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900091fdbb8dc327-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1637&min_rtt=1613&rtt_var=622&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1810291&cwnd=189&unsent_bytes=0&cid=8539e2d5bb8180ca&ts=134&x=0"
2025-01-10 23:50:36 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49714	104.21.32.1	443	1276	C:\Users\user\Desktop\tVuAoupHhZ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 23:50:37 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-10 23:50:37 UTC	853	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 23:50:37 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1867826 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3WFr9LtYNiDIF9PHCFdXpEeWlfNPlvd8wf8lAwZo2XpQqF7oWsaJYxiMS6tk%2FuXF2aqxgrP%2FBFriozxl95M0AmlDVteMaW7VVKaLE3EfwJUfdWIVQgsbWFPYSnRjfBRUQxYcHSSU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 90009204e86372b9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1803&min_rtt=1795&rtt_var=689&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1569048&cwnd=217&unsent_bytes=0&cid=72cd533136410892&ts=141&x=0"
2025-01-10 23:50:37 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49716	104.21.32.1	443	1276	C:\Users\user\Desktop\tVuAoupHhZ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 23:50:39 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-10 23:50:39 UTC	854	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 23:50:39 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1867828 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N5Fh%2B2kRUAjIub1bfqdfZzhq3L5SzvomREDnK3meo6gf697VI5rBd%2B1aoCS6V4iunr9SC192zPKF3V7jHHp9TsSTy1wb4nlkXezxuJhHUbrDr97v9RKqfdBSwtyifalpt2HJf5tN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900092124aca8cda-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8742&min_rtt=1816&rtt_var=4961&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1607929&cwnd=243&unsent_bytes=0&cid=70f71278c2625b75&ts=161&x=0"
2025-01-10 23:50:39 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: tVuAoupHhZ.exePID: 1276, Parent PID: 1028

General

Target ID:	0
Start time:	18:50:22
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\tVuAoupHhZ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\tVuAoupHhZ.exe"
Imagebase:	0x830000
File size:	134'144 bytes
MD5 hash:	4634E3E6584B3F6F79C63B718DCD858C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.2238928111.0000000002D49000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000000.2073909707.0000000000832000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000000.2073909707.0000000000832000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000000.2073909707.0000000000832000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000000.2073909707.0000000000832000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.2238928111.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 2876, Parent PID: 1276

General

Target ID:	3
Start time:	18:50:39
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\tVuAoupHhZ.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5060, Parent PID: 2876

General

Target ID:	4
Start time:	18:50:39
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: choice.exePID: 7064, Parent PID: 2876

General

Target ID:	5
Start time:	18:50:39
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /C Y /N /D Y /T 3
Imagebase:	0x3a0000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: tVuAoupHhZ.exePID: 1276, Parent PID: 1028COMMON

Executed Functions

Function 029951C5 Relevance: 6.8, Strings: 5, Instructions: 530COMMON

Download Yara Rule

Strings

PH]q, xrefs: 02995741
0o@p, xrefs: 0299554A
Lj@p, xrefs: 029956B8
Lj@p, xrefs: 029956CE
PH]q, xrefs: 02995730

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: 7cdcf570f1cc13a4e4a30fe738817839746cd0e64f968434ed9878b1ff5e0c41
Instruction ID: ab679b8c4fc81619dd1f89a8d4fc4fc9e397e97b65eb9262a55c433c6e1641c9
Opcode Fuzzy Hash: 7cdcf570f1cc13a4e4a30fe738817839746cd0e64f968434ed9878b1ff5e0c41
Instruction Fuzzy Hash: 8891F674E00218DFDB19CFA9D984A9DBBF2BF89310F55C069E818AB365DB349981CF10

Function 0299BD28 Relevance: 6.6, Strings: 5, Instructions: 348COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0299C158
Lj@p, xrefs: 0299C0CF
Lj@p, xrefs: 0299C0E5
PH]q, xrefs: 0299C147
0o@p, xrefs: 0299BF62

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: 104b59e4d7073eb51ad8befded96925639b38142c44004422dde69cb2bff47b2
Instruction ID: 541eb53aa246f3439d8e8b273bfc0363519ba10f49cae25141af7f50bae85478
Opcode Fuzzy Hash: 104b59e4d7073eb51ad8befded96925639b38142c44004422dde69cb2bff47b2
Instruction Fuzzy Hash: 31E11974E00218CFDF14CFADD994A9DBBBABF88314F158069E919AB361D734A841CF90

Function 0299CA70 Relevance: 6.4, Strings: 5, Instructions: 186COMMON

Download Yara Rule

Strings

Lj@p, xrefs: 0299CC65
PH]q, xrefs: 0299CCC7
0o@p, xrefs: 0299CAE2
Lj@p, xrefs: 0299CC4F
PH]q, xrefs: 0299CCD8

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: 8f2e9028084e33ca2a06ae5863935dfe2d0bed4d99a0c7d56b7205f591378e67
Instruction ID: 233cba834d77f07499f757a6bc016b4e238d78b42236ae5d60aabb4c9b3da1cf
Opcode Fuzzy Hash: 8f2e9028084e33ca2a06ae5863935dfe2d0bed4d99a0c7d56b7205f591378e67
Instruction Fuzzy Hash: 3581C474E00218DFDB18DFA9D984A9DBBF2BF88310F14C46AE819AB365DB349941CF10

Function 02994AD9 Relevance: 6.4, Strings: 5, Instructions: 185COMMON

Download Yara Rule

Strings

Lj@p, xrefs: 02994CB8
0o@p, xrefs: 02994B4A
PH]q, xrefs: 02994D30
PH]q, xrefs: 02994D41
Lj@p, xrefs: 02994CCE

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: b07db4acc0ba3c0b623853b3468197b0ccffeee12caeb1c99b2837b1b8edaf1f
Instruction ID: 1d959fbb9fb53281e35483b50ac4396849861ed6b04e4d67c40f9c60428e90be
Opcode Fuzzy Hash: b07db4acc0ba3c0b623853b3468197b0ccffeee12caeb1c99b2837b1b8edaf1f
Instruction Fuzzy Hash: 3181C574E00218DFDB18DFA9D984A9DBBF2BF88310F14D469E819AB365DB349981CF10

Function 0299C1D2 Relevance: 6.4, Strings: 5, Instructions: 184COMMON

Download Yara Rule

Strings

Lj@p, xrefs: 0299C3C5
0o@p, xrefs: 0299C242
PH]q, xrefs: 0299C438
PH]q, xrefs: 0299C427
Lj@p, xrefs: 0299C3AF

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: 6a18f509236dfbe389656badccf9c68d276bead8d8a60f9094eb4c1448b91482
Instruction ID: 015a8e1bb7735c42ee6e5af43e52be8732688d89c7fca9a9399cf1ac57f83620
Opcode Fuzzy Hash: 6a18f509236dfbe389656badccf9c68d276bead8d8a60f9094eb4c1448b91482
Instruction Fuzzy Hash: 3181C674E00218DFDB18DFAAD984A9DBBF2BF89314F14C06AD819AB365DB349941CF50

Function 0299C790 Relevance: 6.4, Strings: 5, Instructions: 184COMMON

Download Yara Rule

Strings

Lj@p, xrefs: 0299C96F
PH]q, xrefs: 0299C9E7
PH]q, xrefs: 0299C9F8
0o@p, xrefs: 0299C802
Lj@p, xrefs: 0299C985

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: d58090eb0edcbf030b41025203e00eed5b6a175ab95e58e41fb769a528afbc58
Instruction ID: 05ca6627414e7ecca344f3d1d796e3706d271e87c92be9af243c47d80fbc2695
Opcode Fuzzy Hash: d58090eb0edcbf030b41025203e00eed5b6a175ab95e58e41fb769a528afbc58
Instruction Fuzzy Hash: BF81B574E00218DFDB18DFAAD984A9DBBF2BF88310F14C46AD419AB365DB309981CF50

Function 0299C4B2 Relevance: 6.4, Strings: 5, Instructions: 184COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0299C707
Lj@p, xrefs: 0299C68F
Lj@p, xrefs: 0299C6A5
0o@p, xrefs: 0299C522
PH]q, xrefs: 0299C718

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: bb076801871f087f18bf238a4a34f3504660f01266d4375f7b504de119a3e6b8
Instruction ID: 6e878174385bfd7e35738bf3cc9ed033350543f05d3e7b69e6fb5cfd303b22aa
Opcode Fuzzy Hash: bb076801871f087f18bf238a4a34f3504660f01266d4375f7b504de119a3e6b8
Instruction Fuzzy Hash: 8A81B474E00218DFDB18DFA9D984A9DBBF2BF88310F14D46AE819AB365DB349941CF10

Function 0299CD52 Relevance: 6.4, Strings: 5, Instructions: 183COMMON

Download Yara Rule

Strings

0o@p, xrefs: 0299CDC2
Lj@p, xrefs: 0299CF2F
Lj@p, xrefs: 0299CF45
PH]q, xrefs: 0299CFB8
PH]q, xrefs: 0299CFA7

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: 7e145ec5a5f3933490ddf175ea0cab5e83a99664095430f532db995c6d65b8ae
Instruction ID: 02cdf2c6c428e6f48fc0169c6eee9dcb0626107726435ddcd7bb84f27cd95dd4
Opcode Fuzzy Hash: 7e145ec5a5f3933490ddf175ea0cab5e83a99664095430f532db995c6d65b8ae
Instruction Fuzzy Hash: F381A574E01218DFDB18DFA9D984A9DBBF6BF88310F14C46AE819AB365DB349941CF10

Function 02997680 Relevance: 5.3, Strings: 4, Instructions: 337COMMON

Download Yara Rule

Strings

(o]q, xrefs: 0299777A
(o]q, xrefs: 02997788
,aq, xrefs: 02997800
,aq, xrefs: 029977F2

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$,aq$,aq
API String ID: 0-1947289240
Opcode ID: fbb38b9774199c2c018d2f5f7d2706dddfe5e78326e8c55b1960e0049f90ebfc
Instruction ID: e533dd1ebcd96fcf26314046527f47f8cd254afbf85236e172536fccd27b4e36
Opcode Fuzzy Hash: fbb38b9774199c2c018d2f5f7d2706dddfe5e78326e8c55b1960e0049f90ebfc
Instruction Fuzzy Hash: 51D103B0A11109DFCF14CFADC884AEEFBB6BF88364F158465E405AB2A5DB31E941CB51

Function 0299523C Relevance: 4.2, Strings: 3, Instructions: 486COMMON

Download Yara Rule

Strings

PH]q, xrefs: 02995741
0o@p, xrefs: 0299554A
PH]q, xrefs: 02995730

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID: 0o@p$PH]q$PH]q
API String ID: 0-2023588385
Opcode ID: 8eb5aab05e9d6a1048b67bf7fbec5a94eb0795995991f16055b0d8a55e340bf6
Instruction ID: b1e4bacb6e331c4785abae028635485b980fd2ba2710ec20a6f0ee2d3e4d6f50
Opcode Fuzzy Hash: 8eb5aab05e9d6a1048b67bf7fbec5a94eb0795995991f16055b0d8a55e340bf6
Instruction Fuzzy Hash: DC61C674E00258DFDB18DFAAD984A9EBBF2BF89310F14C469D818AB365DB349941CF50

Function 0299BEF0 Relevance: 3.9, Strings: 3, Instructions: 153COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0299C158
PH]q, xrefs: 0299C147
0o@p, xrefs: 0299BF62

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID: 0o@p$PH]q$PH]q
API String ID: 0-2023588385
Opcode ID: c7eb01d10c274bcd847976e73b3e4eba29287b4e37571d804cc62fc7a6caf744
Instruction ID: 32d0225d1b616a910ba1b4a248da68b7929572f7412c01e7dfa5aa7ec340e039
Opcode Fuzzy Hash: c7eb01d10c274bcd847976e73b3e4eba29287b4e37571d804cc62fc7a6caf744
Instruction Fuzzy Hash: 8D61B674E006189FDF18DFAAD944A9EBBF2BF88314F14C46AE418AB365DB349941CF50

Function 0299A1E8 Relevance: 3.4, Strings: 2, Instructions: 907COMMON

Download Yara Rule

Strings

(o]q, xrefs: 0299A678
4']q, xrefs: 0299AC73

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID: (o]q$4']q
API String ID: 0-176817397
Opcode ID: cee2e24b9e80f845d6a899a06b78a393fe7050298487e64f99aacd3d88cf5442
Instruction ID: a3b90845e1e5e902e5ba17cea5d29fdd1f74ca2d7a8f772f0ffc91bcf5fffaac
Opcode Fuzzy Hash: cee2e24b9e80f845d6a899a06b78a393fe7050298487e64f99aacd3d88cf5442
Instruction Fuzzy Hash: BE825A71A00209DFCF15CF6CC984AAEBBF6FF88324F158959E8099B2A1D735E951CB50

Function 02996F09 Relevance: 3.0, Strings: 2, Instructions: 513COMMON

Download Yara Rule

Strings

(o]q, xrefs: 02997442
Haq, xrefs: 0299730E

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID: (o]q$Haq
API String ID: 0-903699183
Opcode ID: a078fbbaf2a25325711f2a2885dda4fa1bfe6e821045c975aa52f3f3b6b33ade
Instruction ID: aa08bd013b0e0cff60281f856b27b5c37d5bc2f8ca1d942889568a9cb4069331
Opcode Fuzzy Hash: a078fbbaf2a25325711f2a2885dda4fa1bfe6e821045c975aa52f3f3b6b33ade
Instruction Fuzzy Hash: 7912AF70A102199FDB18DFA9C844BAEBBF6FF88314F148569E805DB394DF349941CB90

Function 02997C58 Relevance: 10.6, Strings: 8, Instructions: 588COMMON

Download Yara Rule

Strings

,aq, xrefs: 02998108
(o]q, xrefs: 02997E1A
(o]q, xrefs: 02997C96
,aq, xrefs: 029980F8
(o]q, xrefs: 02998167
(o]q, xrefs: 02997D51
(o]q, xrefs: 02997D7D
(o]q, xrefs: 02998177

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$(o]q$(o]q$(o]q$(o]q$,aq$,aq
API String ID: 0-1435242062
Opcode ID: cc5f6271aca1552bbb6e6467b20573f503d2e80f959858cd21e380a2e9cb820c
Instruction ID: c696f03d5ffb39709ac93be43aaee11a2e0dc18d540ea1ad3de9282a209d0e31
Opcode Fuzzy Hash: cc5f6271aca1552bbb6e6467b20573f503d2e80f959858cd21e380a2e9cb820c
Instruction Fuzzy Hash: 82324A30A006059FCF14CF6DD884AAEBBFABF89324B1485A9E415DB3A1DB35ED41CB50

Function 029964A8 Relevance: 2.8, Strings: 2, Instructions: 328COMMON

Download Yara Rule

Strings

Haq, xrefs: 02996593
Haq, xrefs: 029965C6

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID: Haq$Haq
API String ID: 0-4016896955
Opcode ID: c4208e0a2d2a975a4de167c9c53cec0cf1f026565feb07c4ea7980c07344a401
Instruction ID: 7cf278093bdc1c04e861ec3501aae944c65ca4b0fde55c7c689e6718d3408458
Opcode Fuzzy Hash: c4208e0a2d2a975a4de167c9c53cec0cf1f026565feb07c4ea7980c07344a401
Instruction Fuzzy Hash: 40B1EA317002119FCF199F2DC858B7A7BEABF89364F048969E906CB394DB38C841CB91

Function 02996A08 Relevance: 2.7, Strings: 2, Instructions: 230COMMON

Download Yara Rule

Strings

,aq, xrefs: 02996AE8
,aq, xrefs: 02996ADE

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID: ,aq$,aq
API String ID: 0-2990736959
Opcode ID: 687c3b6c60ee56567b22276d58f97523dee2aef0f1cc65e82e3eb841d005b7ec
Instruction ID: c346a311fe8b0e711adb52662a68690490c69c191d7950c3d08b9cd4919046c9
Opcode Fuzzy Hash: 687c3b6c60ee56567b22276d58f97523dee2aef0f1cc65e82e3eb841d005b7ec
Instruction Fuzzy Hash: AC819034B015098FCF14DF6DC484A6AB7BAFF89328B158569E505E7364EB31E841CBA0

Function 02999D90 Relevance: 2.6, Strings: 2, Instructions: 149COMMON

Download Yara Rule

Strings

4']q, xrefs: 02999ECD
4']q, xrefs: 02999EE4

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: be7c9f7398b3703a52df6d04842f7f295b3fcad9b4faec9258f6135efb2e7c37
Instruction ID: 98f351f87d743d57650658934362868112ac504a060bc629862dfd31cde4b981
Opcode Fuzzy Hash: be7c9f7398b3703a52df6d04842f7f295b3fcad9b4faec9258f6135efb2e7c37
Instruction Fuzzy Hash: ED5170307002059FEB149AADC944B6E7BEEEF88361F14886AE908CB295DB75DC41CB51

Function 02993428 Relevance: 2.6, Strings: 2, Instructions: 112COMMON

Download Yara Rule

Strings

Xaq, xrefs: 0299345E
Xaq, xrefs: 02993435

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID: Xaq$Xaq
API String ID: 0-1488805882
Opcode ID: 59a4790e7a2dcf382dbe00c7df3a22041d758a39eb2cbb51e4b255a5eaefeb45
Instruction ID: f2e1d8abadd4e60940691d7bf6affe2d88d29194f80e23bb003a89279270d283
Opcode Fuzzy Hash: 59a4790e7a2dcf382dbe00c7df3a22041d758a39eb2cbb51e4b255a5eaefeb45
Instruction Fuzzy Hash: 7F312531B003258BDF1D8E6E4A9427EA6DEBBC9264F044879D81EC3384DB74CC458299

Function 02999058 Relevance: 2.6, Strings: 2, Instructions: 101COMMON

Download Yara Rule

Strings

$]q, xrefs: 02999137
$]q, xrefs: 02999114

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 1fc08324b111dae6319c09fdba6e6055b6b2611d081632dabcdbee8d62b677d4
Instruction ID: a68e5014ab0370176488c46be70091b8f739c1fc73092c97883f49b3aa545c67
Opcode Fuzzy Hash: 1fc08324b111dae6319c09fdba6e6055b6b2611d081632dabcdbee8d62b677d4
Instruction Fuzzy Hash: D131A4303441118FEF259B3DDC9877E77A9FB85664B15485ED426CB391DB29CC80CB92

Function 02990C8F Relevance: 1.7, Strings: 1, Instructions: 404COMMON

Download Yara Rule

Strings

LR]q, xrefs: 02990E5E

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 6c877d03239b9d9e17c89a63a1b30740aa6c8b05087667640ad59a84b0c01c14
Instruction ID: ce3c5bcfd923403711036eb859fd9a8aea42d8a912d5d12fdfb0bd267014296c
Opcode Fuzzy Hash: 6c877d03239b9d9e17c89a63a1b30740aa6c8b05087667640ad59a84b0c01c14
Instruction Fuzzy Hash: 1C22FF78D00219DFCB54EF64EA84A9DBBB6FF48304F1085A6D819AB758DB345E49CF40

Function 02990CA0 Relevance: 1.6, Strings: 1, Instructions: 395COMMON

Download Yara Rule

Strings

LR]q, xrefs: 02990E5E

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 0438f49aff9f32c728cc2557ed7b8f27b1267701b76e10bae0e88d02d9a63dcb
Instruction ID: fbfda37af0bb90e968b247d321ce873628b449fc5751f055785abbcd52249920
Opcode Fuzzy Hash: 0438f49aff9f32c728cc2557ed7b8f27b1267701b76e10bae0e88d02d9a63dcb
Instruction Fuzzy Hash: 9322FF78D00219DFCB54EF64EA84A9DBBB6FF48304F1085A6D819AB758DB346E85CF40

Function 0299B052 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

(o]q, xrefs: 0299B1D9

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID: (o]q
API String ID: 0-794736227
Opcode ID: d405d8892f8d1c86986da7b0158e940a5b4e259c72ce501c66478559abe22a35
Instruction ID: 78493e2564a928cddb224aff66ceaff29982d79eae2201fc0952d00f0075f3e3
Opcode Fuzzy Hash: d405d8892f8d1c86986da7b0158e940a5b4e259c72ce501c66478559abe22a35
Instruction Fuzzy Hash: F641C532B002149FCB189F69D85876E7BFAFBC8610F144469D516E7390DE399C01CBA4

Function 02998238 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e30b163685be3b8c8d0b4eeaf1aa06e0af027d7166378b595c756b2fbd1ec888
Instruction ID: d85446d3d614e0813503d5fa01f249ac0505ac56056695fa2b72a7c48eff8f68
Opcode Fuzzy Hash: e30b163685be3b8c8d0b4eeaf1aa06e0af027d7166378b595c756b2fbd1ec888
Instruction Fuzzy Hash: 047119347006058FCF14DF2DC899A6E7BEABF4A264B5904AAE906DB3B1DB74DC41CB50

Function 0299D36A Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ec1df37beea062bf22cd762ee7b8fa9f24add0f6bd95cc0d5b6f8a523e8f1ba
Instruction ID: 80094114d11cd5a6d4eafae75e56e44472f19af364b9b65a23cf3a3fd67d0ff9
Opcode Fuzzy Hash: 5ec1df37beea062bf22cd762ee7b8fa9f24add0f6bd95cc0d5b6f8a523e8f1ba
Instruction Fuzzy Hash: A651F670AA5343CFC3543F26E5AC13A7BA5FB0F3977456D20E12E86098DB3950A4CB21

Function 0299D378 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 802061e61b602856e1675db4cc6ba465f892d119e29453c62786ad73b6e6a0bb
Instruction ID: 88b22ade1c4860365d3e1008e7e04e702a76f81148e3644a2d2628b41eee5cf6
Opcode Fuzzy Hash: 802061e61b602856e1675db4cc6ba465f892d119e29453c62786ad73b6e6a0bb
Instruction Fuzzy Hash: 3151C270AA5343CFC3543F22A5AC13A7BA1FB0F7A73456D20E12E86098DB3910A4CB12

Function 0299D032 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3549b276856ff67e263150668bf1f3e86545ada58b752e657e1e0882245a2fc5
Instruction ID: 177823a6e5dcbcd451c15004b17f67a661738ac8201401417e91ac5aadf8184f
Opcode Fuzzy Hash: 3549b276856ff67e263150668bf1f3e86545ada58b752e657e1e0882245a2fc5
Instruction Fuzzy Hash: 2D519374E01218DFDB58DFA9D98499DBBF2FF89310F208169E819AB364DB31A901CF50

Function 02993908 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 418493ab4207308c7f82cbb50e7b3f21e11a645f3f2547f05694e3664be9043e
Instruction ID: 59d0e28743b484702e6dae342dbe211cd99612d31f4fa9d05b669fd2bb62af22
Opcode Fuzzy Hash: 418493ab4207308c7f82cbb50e7b3f21e11a645f3f2547f05694e3664be9043e
Instruction Fuzzy Hash: 4B519874E01208DFCB08DFA9D59099DBBF2FF8D314B209469E419AB364DB31A945CF50

Function 0299A463 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2745efe18b51f221ea760893788bf69dc394b0c7012c973edbc687a9626153e8
Instruction ID: efba715b29ac7c66a71170c4054a82076af024f8021d6465cf376bbe2b565d03
Opcode Fuzzy Hash: 2745efe18b51f221ea760893788bf69dc394b0c7012c973edbc687a9626153e8
Instruction Fuzzy Hash: 30415F31A04249DFCF11CFA8C848B9EBFB6EF49364F048555E819AB395D335E960CBA1

Function 02997530 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b04fe690bb52187f7476089d1f086a280fea1efac2dee334c5792f162d8a98a1
Instruction ID: 67ca086ba4ff0c851d033b711ccc245b01f317f3623fa4efa7582ad37a8658f4
Opcode Fuzzy Hash: b04fe690bb52187f7476089d1f086a280fea1efac2dee334c5792f162d8a98a1
Instruction Fuzzy Hash: CA41C271A00209DFDF14CFA8C904BAABBFAFB44314F04886AE415DB291DB75DD55CB91

Function 029957C8 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f096140d9f1311f5f2cbff98c61ecc1aa455ae8a9c3143b45010e734d4f6a576
Instruction ID: 42acd9915263af38f2e03de3ce200671114ca45ae8d6f99859ad65ae3976c2a1
Opcode Fuzzy Hash: f096140d9f1311f5f2cbff98c61ecc1aa455ae8a9c3143b45010e734d4f6a576
Instruction Fuzzy Hash: D1319331A1010A9FCF069F69D458AAF3BA6FF48354F444415F915DB290CB38CC61DB90

Function 02999CD9 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d375794eef57f8afb591080d2fb76ea8db513e18ff45cee9e826adbba329458c
Instruction ID: 8e4fe65bebe0364d7b36b0d918cf420e1079d2f69b2a9b10b48aef29e3b03207
Opcode Fuzzy Hash: d375794eef57f8afb591080d2fb76ea8db513e18ff45cee9e826adbba329458c
Instruction Fuzzy Hash: 4E31CD30600245DFDB11DF2CC884AABBBF9EF49360F5488AAE844DB215D731FA11CBA1

Function 029984E0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfc4e3ed1599bef0c57dff9509c797d4cc9a169ad412edf6dccc2fc1d62e7afe
Instruction ID: c832a39f3c4a73bcab4382c166b3236586ddc97426973ff53aa67f22fa0c5935
Opcode Fuzzy Hash: bfc4e3ed1599bef0c57dff9509c797d4cc9a169ad412edf6dccc2fc1d62e7afe
Instruction Fuzzy Hash: FF219D313102014BDF14572D8898B7E369BAFC6668F1444BDD906CB3A4EF29CC46D782

Function 02992060 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3fd88c8f1afb8c3357211a0c926bb3738035ac116cb579e62e991a88784bef7
Instruction ID: 1301578d8b156f46da3496ee1f72e988d54054395bc33ed76764939e75a0f2b3
Opcode Fuzzy Hash: e3fd88c8f1afb8c3357211a0c926bb3738035ac116cb579e62e991a88784bef7
Instruction Fuzzy Hash: BE21A135E00115AFCF24DF68D840AAE77AAEB9D264F10C419DC0A9B344DB35EA46CBD2

Function 0299D5B9 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 816dfb8c438b5db9683e8ba05bd33684691edb97c2ceae229b9e9eb6cb4609d1
Instruction ID: 98b8a2a176da2178e929b854955154ece1bbbfb42ff7c8ce88c3f932e01ab35e
Opcode Fuzzy Hash: 816dfb8c438b5db9683e8ba05bd33684691edb97c2ceae229b9e9eb6cb4609d1
Instruction Fuzzy Hash: 1E212630C11219DEDF11EFE8D9446EDBBB4FF4A314F009629E41877254EB30AA5ACB91

Function 02996870 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9559a59a3929e099e982acbbf77cf8cad10b38e7a1575edd7fea9f32533f1d77
Instruction ID: bdec20b0b78ff90633781f95490646d7d14221e9a8e0fd8b406d005520f00a2a
Opcode Fuzzy Hash: 9559a59a3929e099e982acbbf77cf8cad10b38e7a1575edd7fea9f32533f1d77
Instruction Fuzzy Hash: 3E21D535B006129FCB19AB2AC45892EB7AAFFC47697154579E91ADB390CF34DC02CBD0

Function 029957B8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9988bd5288b8f167cb92c185c9b4093bd17009a253ae065fe1219c73b0b01952
Instruction ID: 40086595e334f2cce44bcbed720d65575f5aac2f71ba742d49a20e1e7f172f0b
Opcode Fuzzy Hash: 9988bd5288b8f167cb92c185c9b4093bd17009a253ae065fe1219c73b0b01952
Instruction Fuzzy Hash: AE212732A101199FCF05AF69D448BAB3BAAFB48328F444065F915CB384CB38CD55CBE0

Function 0299215C Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c69db10d7e58b2dcc72d9d94ae4cf91b5b478f1fb5cb1dbecdd438169633f4f4
Instruction ID: 930ff1dadbcb1aa413757ccf5ed0a418761fb2666eb57370518156f97c936959
Opcode Fuzzy Hash: c69db10d7e58b2dcc72d9d94ae4cf91b5b478f1fb5cb1dbecdd438169633f4f4
Instruction Fuzzy Hash: 87115E31E0424DAFCF019BBC9C115DEBB35FF89320B248757D566B7191EA31291AC791

Function 0299D6B7 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49cf93ec3424acd4640995fad9b8e4fb70cc9413f8c0f6b1553a6a6c980b55d4
Instruction ID: 66bde73529ba6ba26476db1d306d8386056c202e2bb18f278443efd9565efb68
Opcode Fuzzy Hash: 49cf93ec3424acd4640995fad9b8e4fb70cc9413f8c0f6b1553a6a6c980b55d4
Instruction Fuzzy Hash: 83210434A012189FCF08DFB4E990AEEB7B2FB8A304F109529D41577394CB399942CA65

Function 029939ED Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fce64e97d1e215534693ff602d3cafec46707bbbb04893672616298a5cb39a5
Instruction ID: a770eb6e9cd7e37c9cd6aa85db6d502a399669899045bb4c8266392f18e16335
Opcode Fuzzy Hash: 3fce64e97d1e215534693ff602d3cafec46707bbbb04893672616298a5cb39a5
Instruction Fuzzy Hash: 2F31A674E15209DFCF44DFA8E6948ADBBB2FF49315B20846AE809AB364D735AD05CF40

Function 029984D1 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f28cc48c5eb0ba11b020b2afe7444b3efd8caaee818f22b6d68542e37497a0d4
Instruction ID: ccda8f7cde198fa45a27903c347c7be6cb18a14d88d7736caf3b9fb115b17bb0
Opcode Fuzzy Hash: f28cc48c5eb0ba11b020b2afe7444b3efd8caaee818f22b6d68542e37497a0d4
Instruction Fuzzy Hash: B51170313501119FDF145B2DC998B7E369FBFC5668B1845ADE902CB2A4EF28C848D683

Function 029998C1 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73955a27929f60bf983988a02fa39ef79e305062e5a781e255dfaf7a6c54d6d0
Instruction ID: 2eb8be7b6050acefd2851956ed03a5bad8b91a6ac68d328e75f4e15a29fcb391
Opcode Fuzzy Hash: 73955a27929f60bf983988a02fa39ef79e305062e5a781e255dfaf7a6c54d6d0
Instruction Fuzzy Hash: B9219C30E011599FDF05CFAAD658AEEBFBAAF48304F18806AE451E7294DB359901DF50

Function 0299D6C8 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c8ab3be0f9143453ad804498f5bba24b7375c9c3898e0530e05871c2a409d6a
Instruction ID: 77666b2dd6f4212c038f6fd831f172de17ac19fc6914768041153bc7a3740397
Opcode Fuzzy Hash: 1c8ab3be0f9143453ad804498f5bba24b7375c9c3898e0530e05871c2a409d6a
Instruction Fuzzy Hash: B821C434A11208DFCF08EFB4D554AEDB7B2FB89304F10A529D41577394CB39A941CE69

Function 02991F61 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fef15cbba9eff7fa12917fe2a51b279814c51226e2cc64a2d2ec5da6ffe3f57
Instruction ID: e697fd7287a789d1ccedfd6c0afbe529cb7c385c6fb7d99f483c5e52b2a2e4a6
Opcode Fuzzy Hash: 0fef15cbba9eff7fa12917fe2a51b279814c51226e2cc64a2d2ec5da6ffe3f57
Instruction Fuzzy Hash: D121F2B4D0520A8FCB00EFA8D8455EEBFF1BB19300F00456AD809B3354EB345A95CBA1

Function 02991F08 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03c58241283d7e7605e474fa639dc62da4af8ce7de509d3dc35f670f16ea1a35
Instruction ID: 6631a7ce236af1069d393cb0ffdb9011da60addce7be0b77ddebb4843db547c6
Opcode Fuzzy Hash: 03c58241283d7e7605e474fa639dc62da4af8ce7de509d3dc35f670f16ea1a35
Instruction Fuzzy Hash: 5D212274C0460E8FCB00EFA8D4485EEBFB5FF49354F14456AD849B7264EB305A95CBA1

Function 02996009 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80191cb0c038fe857a0c54bbe1415ae24f59d19ef454cb62fb6a6b315428ec85
Instruction ID: f3c2d895baac7f45708d56f99170a3e66d07a3004412251cf1ab4e3253a74ff4
Opcode Fuzzy Hash: 80191cb0c038fe857a0c54bbe1415ae24f59d19ef454cb62fb6a6b315428ec85
Instruction Fuzzy Hash: ED018433B001157BDF169E599C14BFF3AAFEBC86A0F18812AF515E7280DB7AC9118794

Function 0299AD40 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ce1a274172933cf074b21448dd797541dfc2ebe63e785ba74f1e80dd586c034
Instruction ID: fecee793b65d103b0ec87bbc1c9e58ae9e5c1df567ec4c1d98af0b2ae760d93c
Opcode Fuzzy Hash: 6ce1a274172933cf074b21448dd797541dfc2ebe63e785ba74f1e80dd586c034
Instruction Fuzzy Hash: 3AF096357406105F9F155A2FD858A2A77DDEFC5A773158479E505CB375DF20CC028790

Function 02992010 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4717f9ae0812c8e3949b53235c1ae58f81e962b4c01c071d96b29688cac52616
Instruction ID: c38cf50d89e0859ab7cd5aebe286db63bad9658e7fa3073aa7ad7cbd5a75f0b4
Opcode Fuzzy Hash: 4717f9ae0812c8e3949b53235c1ae58f81e962b4c01c071d96b29688cac52616
Instruction Fuzzy Hash: 4EE0D831D1039A9FCB119AA5DC014DFBB34EDA3210B454157D1643B241E760290A87B1

Function 02994EE8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 222b68fb0b70cc4edd623ae4f561d0e1ca1f610be0c451045e2cd54e3ee71b40
Instruction ID: 020420b4bdb82d539d6bb5b0c1b356b1f3b8c13a2e6ba0831e87cc0577179e21
Opcode Fuzzy Hash: 222b68fb0b70cc4edd623ae4f561d0e1ca1f610be0c451045e2cd54e3ee71b40
Instruction Fuzzy Hash: 18F01570D4020AAFDF40EFB8C80A7AFBBB5AB08244F604979E005F3240EB7886418FD0

Function 02994F98 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f08798c9554d68568dee2238a6da82ab2a1034795ce65bb348557a1075079a51
Instruction ID: 72f70d4ce4de2e701fd084ca209d51f56c5ec6415747e350e7091db25431c5f0
Opcode Fuzzy Hash: f08798c9554d68568dee2238a6da82ab2a1034795ce65bb348557a1075079a51
Instruction Fuzzy Hash: AAE08C3331052127E6555A6CE848BFB138EDFC8660F004678F801DB398EF2CAE5683D1

Function 02994EF8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9f8c0176d8c0cf224e9904340d571a60b92f5bb97ab5215f1f2d9c5815c58d9
Instruction ID: dbdb75ba6322bc674570a67563dca7cc8c5239b2847e4d7de10c517138586a8b
Opcode Fuzzy Hash: e9f8c0176d8c0cf224e9904340d571a60b92f5bb97ab5215f1f2d9c5815c58d9
Instruction Fuzzy Hash: 2CE0C270D4020A9FDF40EFB884097AEBBF5AB48350F60486AC115E3240EB7486418F81

Function 02992020 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f633d6a8dc6fe0afbd81b18d982659e9524849f9eaf433fd881978d879202327
Instruction ID: 2d6707e3fd42b7d1f3103e89c27e73df1d19edefd0e9b4ef59037cf632b731a8
Opcode Fuzzy Hash: f633d6a8dc6fe0afbd81b18d982659e9524849f9eaf433fd881978d879202327
Instruction Fuzzy Hash: 67D05B31D2022B97CB11E7A5DC044DFF738EED5265B504626D51837140FB703659C6E1

Function 02996CA9 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b4470ec2535b49152c4d3a32ca3961d419d11cadedc9cfd274adb2636cef9e6
Instruction ID: 87158e22972a666c2938a10dc8baacfaf5cbe20988b6fd3d4e527e7a07939171
Opcode Fuzzy Hash: 3b4470ec2535b49152c4d3a32ca3961d419d11cadedc9cfd274adb2636cef9e6
Instruction Fuzzy Hash: 28D05E328A42050BCA08A721EE06FA732AEAB80209F404620B4064A5A9DF7C9A1886E0

Function 0299B10D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ec11f5a55c165b5c46ab27b8aa5ef1587207e6b649d382f64c18645eea42667
Instruction ID: af1703af98c2c182643448b3b72c4d96a792000ea53971dd28eb0f84bc9f21bf
Opcode Fuzzy Hash: 1ec11f5a55c165b5c46ab27b8aa5ef1587207e6b649d382f64c18645eea42667
Instruction Fuzzy Hash: 21D0673AB400189FCB049F99E8448DDBBB6FB98221B048516E915E7261C6319961DB54

Function 02996CB8 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fea582bb00ca6cf8bd9806a47159b25cd27e8c675d0c3a6ba5c8598367a2394
Instruction ID: 9c5d5c0c7a79cb863c9bfb49b33c64c9e9d6a663ea2d0aa00dd5727c0ee820c0
Opcode Fuzzy Hash: 9fea582bb00ca6cf8bd9806a47159b25cd27e8c675d0c3a6ba5c8598367a2394
Instruction Fuzzy Hash: FFC012308743094FC64DFB65FB46D15376EBBC0608F504521E0060B56DDF78584C86A0

Function 02999A50 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22ecbdc694ed64630cd37779dcac7e7e2b04223e1774f7aa7f84956b962578ac
Instruction ID: 1e2d13e1f224c904b6a144c71b93aa73d0588719b2e40bf7cbe39b8b4dc644ed
Opcode Fuzzy Hash: 22ecbdc694ed64630cd37779dcac7e7e2b04223e1774f7aa7f84956b962578ac
Instruction Fuzzy Hash: A5B092276820109BEA008100EE0DB7F5B0CD3C1351F649173B0A4C1A88C02D8F2287B2

Non-executed Functions

Function 02993572 Relevance: 2.8, Strings: 2, Instructions: 298COMMON

Download Yara Rule

Strings

$]q, xrefs: 02993596
Xaq, xrefs: 029935AF

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID: Xaq$$]q
API String ID: 0-1280934391
Opcode ID: acbc2ad4cb14c3270d77f2bc593253a3f83b29c605c223aec8e00aa0f21052ed
Instruction ID: 471ff85f96511e3ed509503e47e47c6f86cc396431860f11bdc1c4af7dc2c4eb
Opcode Fuzzy Hash: acbc2ad4cb14c3270d77f2bc593253a3f83b29c605c223aec8e00aa0f21052ed
Instruction Fuzzy Hash: 7CA19174B042589BDF189F79845427EBBA7BFC8720B048969E846E7388CE35C847C795

Function 02996E88 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;]q, xrefs: 02996EC6
\;]q, xrefs: 02996EBA
\;]q, xrefs: 02996E9E
\;]q, xrefs: 02996E94

Memory Dump Source

Source File: 00000000.00000002.2238732708.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_tVuAoupHhZ.jbxd

Similarity

API ID:
String ID: \;]q$\;]q$\;]q$\;]q
API String ID: 0-2351511683
Opcode ID: eb4fc90dd4910a22a08144d0080c7529e4d6ae873dab4347b3f6ee138186c8eb
Instruction ID: 12b424500ebac0d3222574d5987ff5ca04dbbc0e1ce1c129d6b4a530137c64ad
Opcode Fuzzy Hash: eb4fc90dd4910a22a08144d0080c7529e4d6ae873dab4347b3f6ee138186c8eb
Instruction Fuzzy Hash: 47018F317401148FCF648FADC494A2577EEAF88A74725457AE502CB3B4DB31EC61C790

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report tVuAoupHhZ.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\tVuAoupHhZ.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
tVuAoupHhZ.exe