Edit tour

Windows Analysis Report
VCU262Y2QB.exe

Overview

General Information

Sample name:	VCU262Y2QB.exe renamed because original name is a hash value
Original sample name:	2b8887e80909f776f73b07b6870c4f3f3be8697560e693a4786707d76aae4c01.exe
Analysis ID:	1588357
MD5:	c4407cbd68725778ecd99dc7638be000
SHA1:	0a232725a5857010de9eb61837fe6bbb3a6e151f
SHA256:	2b8887e80909f776f73b07b6870c4f3f3be8697560e693a4786707d76aae4c01
Tags:	exeSnakeKeyloggeruser-adrian__luca
Infos:

Detection

Snake Keylogger

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Snake Keylogger

AI detected suspicious sample

Machine Learning detection for sample

Self deletion via cmd or bat file

Tries to detect the country of the analysis system (by using the IP)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

VCU262Y2QB.exe (PID: 6760 cmdline: "C:\Users\user\Desktop\VCU262Y2QB.exe" MD5: C4407CBD68725778ECD99DC7638BE000)

VCU262Y2QB.exe (PID: 6828 cmdline: "C:\Users\user\Desktop\VCU262Y2QB.exe" MD5: C4407CBD68725778ECD99DC7638BE000)

cmd.exe (PID: 824 cmdline: "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\VCU262Y2QB.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1752 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

choice.exe (PID: 6448 cmdline: choice /C Y /N /D Y /T 3 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Username": "info@gzdled.com.tr", "Password": "Gozdeled1048", "Host": "mail.gzdled.com.tr", "Port": "587", "Token": "8043217727:AAHet_KMDJubZguJgq0Cp7yrQCzgcnbbXpU", "Chat_id": "6247294228", "Version": "5.1"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.2924867689.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2924867689.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000002.00000002.2924867689.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1491f:$a1: get_encryptedPassword 0x14c0b:$a2: get_encryptedUsername 0x1472b:$a3: get_timePasswordChanged 0x14826:$a4: get_passwordField 0x14935:$a5: set_encryptedPassword 0x15fd0:$a7: get_logins 0x15f33:$a10: KeyLoggerEventArgs 0x15b9e:$a11: KeyLoggerEventArgsEventHandler
00000002.00000002.2924867689.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x182f8:$x1: $%SMTPDV$ 0x1835e:$x2: $#TheHashHere%& 0x19a4c:$x3: %FTPDV$ 0x19b40:$x4: $%TelegramDv$ 0x15b9e:$x5: KeyLoggerEventArgs 0x15f33:$x5: KeyLoggerEventArgs 0x19a70:$m2: Clipboard Logs ID 0x19c90:$m2: Screenshot Logs ID 0x19da0:$m2: keystroke Logs ID 0x1a07a:$m3: SnakePW 0x19c68:$m4: \SnakeKeylogger\
00000000.00000002.3938041321.00000000033D9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.3938041321.00000000033D9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.3938041321.00000000033D9000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf4237:$a1: get_encryptedPassword 0x114e67:$a1: get_encryptedPassword 0x135887:$a1: get_encryptedPassword 0xf4523:$a2: get_encryptedUsername 0x115153:$a2: get_encryptedUsername 0x135b73:$a2: get_encryptedUsername 0xf4043:$a3: get_timePasswordChanged 0x114c73:$a3: get_timePasswordChanged 0x135693:$a3: get_timePasswordChanged 0xf413e:$a4: get_passwordField 0x114d6e:$a4: get_passwordField 0x13578e:$a4: get_passwordField 0xf424d:$a5: set_encryptedPassword 0x114e7d:$a5: set_encryptedPassword 0x13589d:$a5: set_encryptedPassword 0xf58e8:$a7: get_logins 0x116518:$a7: get_logins 0x136f38:$a7: get_logins 0xf584b:$a10: KeyLoggerEventArgs 0x11647b:$a10: KeyLoggerEventArgs 0x136e9b:$a10: KeyLoggerEventArgs
00000000.00000002.3938041321.00000000033D9000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xf7c10:$x1: $%SMTPDV$ 0x118840:$x1: $%SMTPDV$ 0x139260:$x1: $%SMTPDV$ 0xf7c76:$x2: $#TheHashHere%& 0x1188a6:$x2: $#TheHashHere%& 0x1392c6:$x2: $#TheHashHere%& 0xf9364:$x3: %FTPDV$ 0x119f94:$x3: %FTPDV$ 0x13a9b4:$x3: %FTPDV$ 0xf9458:$x4: $%TelegramDv$ 0x11a088:$x4: $%TelegramDv$ 0x13aaa8:$x4: $%TelegramDv$ 0xf54b6:$x5: KeyLoggerEventArgs 0xf584b:$x5: KeyLoggerEventArgs 0x1160e6:$x5: KeyLoggerEventArgs 0x11647b:$x5: KeyLoggerEventArgs 0x136b06:$x5: KeyLoggerEventArgs 0x136e9b:$x5: KeyLoggerEventArgs 0xf9388:$m2: Clipboard Logs ID 0xf95a8:$m2: Screenshot Logs ID 0xf96b8:$m2: keystroke Logs ID
00000002.00000002.2926305512.0000000003151000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: VCU262Y2QB.exe PID: 6760	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: VCU262Y2QB.exe PID: 6760	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: VCU262Y2QB.exe PID: 6760	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x9f464:$a1: get_encryptedPassword 0x9f6af:$a2: get_encryptedUsername 0x9f293:$a3: get_timePasswordChanged 0x9f375:$a4: get_passwordField 0x9f47a:$a5: set_encryptedPassword 0xa1353:$a7: get_logins 0xa12d4:$a10: KeyLoggerEventArgs 0xa1042:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: VCU262Y2QB.exe PID: 6760	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xa1042:$x5: KeyLoggerEventArgs 0xa12d4:$x5: KeyLoggerEventArgs 0xa1b18:$x5: KeyLoggerEventArgs 0xa1e79:$x5: KeyLoggerEventArgs 0xa3450:$m2: Clipboard Logs ID 0xa3547:$m2: Screenshot Logs ID 0xa359d:$m2: keystroke Logs ID 0xa36d2:$m3: SnakePW 0xa3533:$m4: \SnakeKeylogger\
Process Memory Space: VCU262Y2QB.exe PID: 6828	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: VCU262Y2QB.exe PID: 6828	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: VCU262Y2QB.exe PID: 6828	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x8037:$a1: get_encryptedPassword 0x8319:$a2: get_encryptedUsername 0x7e4d:$a3: get_timePasswordChanged 0x7f48:$a4: get_passwordField 0x804d:$a5: set_encryptedPassword 0xa52d:$a7: get_logins 0xa490:$a10: KeyLoggerEventArgs 0xa0fb:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: VCU262Y2QB.exe PID: 6828	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xa0fb:$x5: KeyLoggerEventArgs 0xa490:$x5: KeyLoggerEventArgs 0xad97:$x5: KeyLoggerEventArgs 0xb0f8:$x5: KeyLoggerEventArgs 0xc757:$m2: Clipboard Logs ID 0xc84e:$m2: Screenshot Logs ID 0xc8a4:$m2: keystroke Logs ID 0xc9d9:$m3: SnakePW 0xc83a:$m4: \SnakeKeylogger\
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.VCU262Y2QB.exe.34b8718.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.VCU262Y2QB.exe.34b8718.3.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.VCU262Y2QB.exe.34b8718.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12d1f:$a1: get_encryptedPassword 0x1300b:$a2: get_encryptedUsername 0x12b2b:$a3: get_timePasswordChanged 0x12c26:$a4: get_passwordField 0x12d35:$a5: set_encryptedPassword 0x143d0:$a7: get_logins 0x14333:$a10: KeyLoggerEventArgs 0x13f9e:$a11: KeyLoggerEventArgsEventHandler
0.2.VCU262Y2QB.exe.34b8718.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a84a:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x19a7c:$a3: \Google\Chrome\User Data\Default\Login Data 0x19eaf:$a4: \Orbitum\User Data\Default\Login Data 0x1aeee:$a5: \Kometa\User Data\Default\Login Data
2.2.VCU262Y2QB.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.VCU262Y2QB.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.VCU262Y2QB.exe.34b8718.3.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1390c:$s1: UnHook 0x13913:$s2: SetHook 0x1391b:$s3: CallNextHook 0x13928:$s4: _hook
2.2.VCU262Y2QB.exe.400000.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
2.2.VCU262Y2QB.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14b1f:$a1: get_encryptedPassword 0x14e0b:$a2: get_encryptedUsername 0x1492b:$a3: get_timePasswordChanged 0x14a26:$a4: get_passwordField 0x14b35:$a5: set_encryptedPassword 0x161d0:$a7: get_logins 0x16133:$a10: KeyLoggerEventArgs 0x15d9e:$a11: KeyLoggerEventArgsEventHandler
0.2.VCU262Y2QB.exe.34b8718.3.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x166f8:$x1: $%SMTPDV$ 0x1675e:$x2: $#TheHashHere%& 0x17e4c:$x3: %FTPDV$ 0x17f40:$x4: $%TelegramDv$ 0x13f9e:$x5: KeyLoggerEventArgs 0x14333:$x5: KeyLoggerEventArgs 0x17e70:$m2: Clipboard Logs ID 0x18090:$m2: Screenshot Logs ID 0x181a0:$m2: keystroke Logs ID 0x1847a:$m3: SnakePW 0x18068:$m4: \SnakeKeylogger\
2.2.VCU262Y2QB.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c64a:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b87c:$a3: \Google\Chrome\User Data\Default\Login Data 0x1bcaf:$a4: \Orbitum\User Data\Default\Login Data 0x1ccee:$a5: \Kometa\User Data\Default\Login Data
2.2.VCU262Y2QB.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1570c:$s1: UnHook 0x15713:$s2: SetHook 0x1571b:$s3: CallNextHook 0x15728:$s4: _hook
2.2.VCU262Y2QB.exe.400000.0.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x184f8:$x1: $%SMTPDV$ 0x1855e:$x2: $#TheHashHere%& 0x19c4c:$x3: %FTPDV$ 0x19d40:$x4: $%TelegramDv$ 0x15d9e:$x5: KeyLoggerEventArgs 0x16133:$x5: KeyLoggerEventArgs 0x19c70:$m2: Clipboard Logs ID 0x19e90:$m2: Screenshot Logs ID 0x19fa0:$m2: keystroke Logs ID 0x1a27a:$m3: SnakePW 0x19e68:$m4: \SnakeKeylogger\
0.2.VCU262Y2QB.exe.34d9348.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.VCU262Y2QB.exe.34d9348.2.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.VCU262Y2QB.exe.34d9348.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12d1f:$a1: get_encryptedPassword 0x1300b:$a2: get_encryptedUsername 0x12b2b:$a3: get_timePasswordChanged 0x12c26:$a4: get_passwordField 0x12d35:$a5: set_encryptedPassword 0x143d0:$a7: get_logins 0x14333:$a10: KeyLoggerEventArgs 0x13f9e:$a11: KeyLoggerEventArgsEventHandler
0.2.VCU262Y2QB.exe.34d9348.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a84a:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x19a7c:$a3: \Google\Chrome\User Data\Default\Login Data 0x19eaf:$a4: \Orbitum\User Data\Default\Login Data 0x1aeee:$a5: \Kometa\User Data\Default\Login Data
0.2.VCU262Y2QB.exe.34d9348.2.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1390c:$s1: UnHook 0x13913:$s2: SetHook 0x1391b:$s3: CallNextHook 0x13928:$s4: _hook
0.2.VCU262Y2QB.exe.34d9348.2.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x166f8:$x1: $%SMTPDV$ 0x1675e:$x2: $#TheHashHere%& 0x17e4c:$x3: %FTPDV$ 0x17f40:$x4: $%TelegramDv$ 0x13f9e:$x5: KeyLoggerEventArgs 0x14333:$x5: KeyLoggerEventArgs 0x17e70:$m2: Clipboard Logs ID 0x18090:$m2: Screenshot Logs ID 0x181a0:$m2: keystroke Logs ID 0x1847a:$m3: SnakePW 0x18068:$m4: \SnakeKeylogger\
0.2.VCU262Y2QB.exe.34d9348.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.VCU262Y2QB.exe.34d9348.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.VCU262Y2QB.exe.34d9348.2.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.VCU262Y2QB.exe.34d9348.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14b1f:$a1: get_encryptedPassword 0x3553f:$a1: get_encryptedPassword 0x14e0b:$a2: get_encryptedUsername 0x3582b:$a2: get_encryptedUsername 0x1492b:$a3: get_timePasswordChanged 0x3534b:$a3: get_timePasswordChanged 0x14a26:$a4: get_passwordField 0x35446:$a4: get_passwordField 0x14b35:$a5: set_encryptedPassword 0x35555:$a5: set_encryptedPassword 0x161d0:$a7: get_logins 0x36bf0:$a7: get_logins 0x16133:$a10: KeyLoggerEventArgs 0x36b53:$a10: KeyLoggerEventArgs 0x15d9e:$a11: KeyLoggerEventArgsEventHandler 0x367be:$a11: KeyLoggerEventArgsEventHandler
0.2.VCU262Y2QB.exe.34d9348.2.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c64a:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3d06a:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b87c:$a3: \Google\Chrome\User Data\Default\Login Data 0x3c29c:$a3: \Google\Chrome\User Data\Default\Login Data 0x1bcaf:$a4: \Orbitum\User Data\Default\Login Data 0x3c6cf:$a4: \Orbitum\User Data\Default\Login Data 0x1ccee:$a5: \Kometa\User Data\Default\Login Data 0x3d70e:$a5: \Kometa\User Data\Default\Login Data
0.2.VCU262Y2QB.exe.34d9348.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1570c:$s1: UnHook 0x3612c:$s1: UnHook 0x15713:$s2: SetHook 0x36133:$s2: SetHook 0x1571b:$s3: CallNextHook 0x3613b:$s3: CallNextHook 0x15728:$s4: _hook 0x36148:$s4: _hook
0.2.VCU262Y2QB.exe.34d9348.2.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x184f8:$x1: $%SMTPDV$ 0x38f18:$x1: $%SMTPDV$ 0x1855e:$x2: $#TheHashHere%& 0x38f7e:$x2: $#TheHashHere%& 0x19c4c:$x3: %FTPDV$ 0x3a66c:$x3: %FTPDV$ 0x19d40:$x4: $%TelegramDv$ 0x3a760:$x4: $%TelegramDv$ 0x15d9e:$x5: KeyLoggerEventArgs 0x16133:$x5: KeyLoggerEventArgs 0x367be:$x5: KeyLoggerEventArgs 0x36b53:$x5: KeyLoggerEventArgs 0x19c70:$m2: Clipboard Logs ID 0x19e90:$m2: Screenshot Logs ID 0x19fa0:$m2: keystroke Logs ID 0x3a690:$m2: Clipboard Logs ID 0x3a8b0:$m2: Screenshot Logs ID 0x3a9c0:$m2: keystroke Logs ID 0x1a27a:$m3: SnakePW 0x3ac9a:$m3: SnakePW 0x19e68:$m4: \SnakeKeylogger\
0.2.VCU262Y2QB.exe.34b8718.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.VCU262Y2QB.exe.34b8718.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.VCU262Y2QB.exe.34b8718.3.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.VCU262Y2QB.exe.34b8718.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14b1f:$a1: get_encryptedPassword 0x3574f:$a1: get_encryptedPassword 0x5616f:$a1: get_encryptedPassword 0x14e0b:$a2: get_encryptedUsername 0x35a3b:$a2: get_encryptedUsername 0x5645b:$a2: get_encryptedUsername 0x1492b:$a3: get_timePasswordChanged 0x3555b:$a3: get_timePasswordChanged 0x55f7b:$a3: get_timePasswordChanged 0x14a26:$a4: get_passwordField 0x35656:$a4: get_passwordField 0x56076:$a4: get_passwordField 0x14b35:$a5: set_encryptedPassword 0x35765:$a5: set_encryptedPassword 0x56185:$a5: set_encryptedPassword 0x161d0:$a7: get_logins 0x36e00:$a7: get_logins 0x57820:$a7: get_logins 0x16133:$a10: KeyLoggerEventArgs 0x36d63:$a10: KeyLoggerEventArgs 0x57783:$a10: KeyLoggerEventArgs
0.2.VCU262Y2QB.exe.34b8718.3.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c64a:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3d27a:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x5dc9a:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b87c:$a3: \Google\Chrome\User Data\Default\Login Data 0x3c4ac:$a3: \Google\Chrome\User Data\Default\Login Data 0x5cecc:$a3: \Google\Chrome\User Data\Default\Login Data 0x1bcaf:$a4: \Orbitum\User Data\Default\Login Data 0x3c8df:$a4: \Orbitum\User Data\Default\Login Data 0x5d2ff:$a4: \Orbitum\User Data\Default\Login Data 0x1ccee:$a5: \Kometa\User Data\Default\Login Data 0x3d91e:$a5: \Kometa\User Data\Default\Login Data 0x5e33e:$a5: \Kometa\User Data\Default\Login Data
0.2.VCU262Y2QB.exe.34b8718.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1570c:$s1: UnHook 0x3633c:$s1: UnHook 0x56d5c:$s1: UnHook 0x15713:$s2: SetHook 0x36343:$s2: SetHook 0x56d63:$s2: SetHook 0x1571b:$s3: CallNextHook 0x3634b:$s3: CallNextHook 0x56d6b:$s3: CallNextHook 0x15728:$s4: _hook 0x36358:$s4: _hook 0x56d78:$s4: _hook
0.2.VCU262Y2QB.exe.34b8718.3.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x184f8:$x1: $%SMTPDV$ 0x39128:$x1: $%SMTPDV$ 0x59b48:$x1: $%SMTPDV$ 0x1855e:$x2: $#TheHashHere%& 0x3918e:$x2: $#TheHashHere%& 0x59bae:$x2: $#TheHashHere%& 0x19c4c:$x3: %FTPDV$ 0x3a87c:$x3: %FTPDV$ 0x5b29c:$x3: %FTPDV$ 0x19d40:$x4: $%TelegramDv$ 0x3a970:$x4: $%TelegramDv$ 0x5b390:$x4: $%TelegramDv$ 0x15d9e:$x5: KeyLoggerEventArgs 0x16133:$x5: KeyLoggerEventArgs 0x369ce:$x5: KeyLoggerEventArgs 0x36d63:$x5: KeyLoggerEventArgs 0x573ee:$x5: KeyLoggerEventArgs 0x57783:$x5: KeyLoggerEventArgs 0x19c70:$m2: Clipboard Logs ID 0x19e90:$m2: Screenshot Logs ID 0x19fa0:$m2: keystroke Logs ID
0.2.VCU262Y2QB.exe.3428078.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.VCU262Y2QB.exe.3428078.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.VCU262Y2QB.exe.3428078.4.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.VCU262Y2QB.exe.3428078.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xa51bf:$a1: get_encryptedPassword 0xc5def:$a1: get_encryptedPassword 0xe680f:$a1: get_encryptedPassword 0xa54ab:$a2: get_encryptedUsername 0xc60db:$a2: get_encryptedUsername 0xe6afb:$a2: get_encryptedUsername 0xa4fcb:$a3: get_timePasswordChanged 0xc5bfb:$a3: get_timePasswordChanged 0xe661b:$a3: get_timePasswordChanged 0xa50c6:$a4: get_passwordField 0xc5cf6:$a4: get_passwordField 0xe6716:$a4: get_passwordField 0xa51d5:$a5: set_encryptedPassword 0xc5e05:$a5: set_encryptedPassword 0xe6825:$a5: set_encryptedPassword 0xa6870:$a7: get_logins 0xc74a0:$a7: get_logins 0xe7ec0:$a7: get_logins 0xa67d3:$a10: KeyLoggerEventArgs 0xc7403:$a10: KeyLoggerEventArgs 0xe7e23:$a10: KeyLoggerEventArgs
0.2.VCU262Y2QB.exe.3428078.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0xa5dac:$s1: UnHook 0xc69dc:$s1: UnHook 0xe73fc:$s1: UnHook 0xa5db3:$s2: SetHook 0xc69e3:$s2: SetHook 0xe7403:$s2: SetHook 0xa5dbb:$s3: CallNextHook 0xc69eb:$s3: CallNextHook 0xe740b:$s3: CallNextHook 0xa5dc8:$s4: _hook 0xc69f8:$s4: _hook 0xe7418:$s4: _hook
0.2.VCU262Y2QB.exe.3428078.4.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xa8b98:$x1: $%SMTPDV$ 0xc97c8:$x1: $%SMTPDV$ 0xea1e8:$x1: $%SMTPDV$ 0xa8bfe:$x2: $#TheHashHere%& 0xc982e:$x2: $#TheHashHere%& 0xea24e:$x2: $#TheHashHere%& 0xaa2ec:$x3: %FTPDV$ 0xcaf1c:$x3: %FTPDV$ 0xeb93c:$x3: %FTPDV$ 0xaa3e0:$x4: $%TelegramDv$ 0xcb010:$x4: $%TelegramDv$ 0xeba30:$x4: $%TelegramDv$ 0xa643e:$x5: KeyLoggerEventArgs 0xa67d3:$x5: KeyLoggerEventArgs 0xc706e:$x5: KeyLoggerEventArgs 0xc7403:$x5: KeyLoggerEventArgs 0xe7a8e:$x5: KeyLoggerEventArgs 0xe7e23:$x5: KeyLoggerEventArgs 0xaa310:$m2: Clipboard Logs ID 0xaa530:$m2: Screenshot Logs ID 0xaa640:$m2: keystroke Logs ID
Click to see the 34 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:16:07.676712+0100	2803305	3	Unknown Traffic	192.168.2.12	49716	104.21.16.1	443	TCP
2025-01-11T01:16:15.170686+0100	2803305	3	Unknown Traffic	192.168.2.12	49721	104.21.16.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:16:02.502862+0100	2803274	2	Potentially Bad Traffic	192.168.2.12	49710	158.101.44.242	80	TCP
2025-01-11T01:16:05.512800+0100	2803274	2	Potentially Bad Traffic	192.168.2.12	49710	158.101.44.242	80	TCP
2025-01-11T01:16:06.971618+0100	2803274	2	Potentially Bad Traffic	192.168.2.12	49710	158.101.44.242	80	TCP
2025-01-11T01:16:11.174849+0100	2803274	2	Potentially Bad Traffic	192.168.2.12	49717	158.101.44.242	80	TCP
2025-01-11T01:16:14.581011+0100	2803274	2	Potentially Bad Traffic	192.168.2.12	49720	158.101.44.242	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000002.00000002.2924867689.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Username": "info@gzdled.com.tr", "Password": "Gozdeled1048", "Host": "mail.gzdled.com.tr", "Port": "587", "Token": "8043217727:AAHet_KMDJubZguJgq0Cp7yrQCzgcnbbXpU", "Chat_id": "6247294228", "Version": "5.1"}

Multi AV Scanner detection for submitted file

Source: VCU262Y2QB.exe	ReversingLabs: Detection: 68%
Source: VCU262Y2QB.exe	Virustotal: Detection: 71%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: VCU262Y2QB.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: VCU262Y2QB.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.12:49713 version: TLS 1.0

Source: VCU262Y2QB.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: C:\Users\GT350\source\repos\UpdatedRunpe\UpdatedRunpe\obj\x86\Debug\AQipUvwTwkLZyiCs.pdb source: VCU262Y2QB.exe, 00000000.00000002.3936703735.00000000023D1000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000000.00000002.3939604873.0000000004DE0000.00000004.08000000.00040000.00000000.sdmp

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 2.2.VCU262Y2QB.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VCU262Y2QB.exe.34d9348.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VCU262Y2QB.exe.34b8718.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VCU262Y2QB.exe.3428078.4.raw.unpack, type: UNPACKEDPE

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.16.1 104.21.16.1
Source: Joe Sandbox View	IP Address: 158.101.44.242 158.101.44.242

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.12:49720 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.12:49717 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.12:49710 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.12:49716 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.12:49721 -> 104.21.16.1:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.12:49713 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: VCU262Y2QB.exe, 00000002.00000002.2926305512.00000000032AD000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.00000000032DA000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.00000000032C8000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.00000000032BA000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.0000000003213000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: VCU262Y2QB.exe, 00000002.00000002.2926305512.00000000032AD000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.00000000032DA000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.0000000003204000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.00000000032C8000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.0000000003256000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.00000000032BA000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.0000000003213000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: VCU262Y2QB.exe, 00000002.00000002.2926305512.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: VCU262Y2QB.exe, 00000000.00000002.3938041321.00000000033D9000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2924867689.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: VCU262Y2QB.exe, 00000002.00000002.2926305512.00000000032AD000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.00000000032C8000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.00000000032BA000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.000000000322C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: VCU262Y2QB.exe, 00000002.00000002.2926305512.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: VCU262Y2QB.exe	String found in binary or memory: https://github.com/0xd4d/dnSpy/wiki/Debugging-Unity-Games
Source: VCU262Y2QB.exe, 00000002.00000002.2926305512.00000000032AD000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.00000000032C8000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.0000000003256000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.00000000032BA000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.0000000003213000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: VCU262Y2QB.exe, 00000000.00000002.3938041321.00000000033D9000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2924867689.0000000000402000.00000040.00000400.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.0000000003213000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: VCU262Y2QB.exe, 00000002.00000002.2926305512.0000000003213000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: VCU262Y2QB.exe, 00000002.00000002.2926305512.00000000032AD000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.00000000032C8000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.0000000003256000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.00000000032BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$
Source: VCU262Y2QB.exe, 00000002.00000002.2926305512.0000000003213000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189x

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.VCU262Y2QB.exe.34b8718.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.VCU262Y2QB.exe.34b8718.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.VCU262Y2QB.exe.34b8718.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 2.2.VCU262Y2QB.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.VCU262Y2QB.exe.34b8718.3.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 2.2.VCU262Y2QB.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.VCU262Y2QB.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 2.2.VCU262Y2QB.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.VCU262Y2QB.exe.34d9348.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.VCU262Y2QB.exe.34d9348.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.VCU262Y2QB.exe.34d9348.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.VCU262Y2QB.exe.34d9348.2.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.VCU262Y2QB.exe.34d9348.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.VCU262Y2QB.exe.34d9348.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.VCU262Y2QB.exe.34d9348.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.VCU262Y2QB.exe.34d9348.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.VCU262Y2QB.exe.34b8718.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.VCU262Y2QB.exe.34b8718.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.VCU262Y2QB.exe.34b8718.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.VCU262Y2QB.exe.34b8718.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.VCU262Y2QB.exe.3428078.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.VCU262Y2QB.exe.3428078.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.VCU262Y2QB.exe.3428078.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000002.00000002.2924867689.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000002.00000002.2924867689.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.3938041321.00000000033D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.3938041321.00000000033D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: VCU262Y2QB.exe PID: 6760, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: VCU262Y2QB.exe PID: 6760, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: VCU262Y2QB.exe PID: 6828, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: VCU262Y2QB.exe PID: 6828, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen

Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Code function: 0_2_00A4D364	0_2_00A4D364
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Code function: 0_2_081794F8	0_2_081794F8
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Code function: 2_2_02F4C1E9	2_2_02F4C1E9
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Code function: 2_2_02F46120	2_2_02F46120
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Code function: 2_2_02F4C7A8	2_2_02F4C7A8
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Code function: 2_2_02F4B740	2_2_02F4B740
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Code function: 2_2_02F4C4C9	2_2_02F4C4C9
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Code function: 2_2_02F44A8F	2_2_02F44A8F
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Code function: 2_2_02F4CA88	2_2_02F4CA88
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Code function: 2_2_02F46898	2_2_02F46898
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Code function: 2_2_02F49868	2_2_02F49868
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Code function: 2_2_02F4BEA7	2_2_02F4BEA7
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Code function: 2_2_02F4CD69	2_2_02F4CD69
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Code function: 2_2_02F43570	2_2_02F43570
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Code function: 2_2_02F4BF08	2_2_02F4BF08

Source: VCU262Y2QB.exe, 00000000.00000002.3936703735.00000000023D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAQipUvwTwkLZyiCs.dll: vs VCU262Y2QB.exe
Source: VCU262Y2QB.exe, 00000000.00000002.3936703735.00000000023D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs VCU262Y2QB.exe
Source: VCU262Y2QB.exe, 00000000.00000002.3939363854.0000000004D70000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameExample.dll0 vs VCU262Y2QB.exe
Source: VCU262Y2QB.exe, 00000000.00000002.3939604873.0000000004DE0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameAQipUvwTwkLZyiCs.dll: vs VCU262Y2QB.exe
Source: VCU262Y2QB.exe, 00000000.00000002.3935496193.000000000063E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs VCU262Y2QB.exe
Source: VCU262Y2QB.exe, 00000000.00000002.3938041321.00000000033D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameExample.dll0 vs VCU262Y2QB.exe
Source: VCU262Y2QB.exe, 00000000.00000002.3938041321.00000000033D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs VCU262Y2QB.exe
Source: VCU262Y2QB.exe, 00000000.00000000.2671986070.000000000011A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameInochia.exe0 vs VCU262Y2QB.exe
Source: VCU262Y2QB.exe, 00000002.00000002.2924867689.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs VCU262Y2QB.exe
Source: VCU262Y2QB.exe	Binary or memory string: OriginalFilenameInochia.exe0 vs VCU262Y2QB.exe

Source: VCU262Y2QB.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.VCU262Y2QB.exe.34b8718.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.VCU262Y2QB.exe.34b8718.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.VCU262Y2QB.exe.34b8718.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 2.2.VCU262Y2QB.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.VCU262Y2QB.exe.34b8718.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 2.2.VCU262Y2QB.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.VCU262Y2QB.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 2.2.VCU262Y2QB.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.VCU262Y2QB.exe.34d9348.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.VCU262Y2QB.exe.34d9348.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.VCU262Y2QB.exe.34d9348.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.VCU262Y2QB.exe.34d9348.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.VCU262Y2QB.exe.34d9348.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.VCU262Y2QB.exe.34d9348.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.VCU262Y2QB.exe.34d9348.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.VCU262Y2QB.exe.34d9348.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.VCU262Y2QB.exe.34b8718.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.VCU262Y2QB.exe.34b8718.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.VCU262Y2QB.exe.34b8718.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.VCU262Y2QB.exe.34b8718.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.VCU262Y2QB.exe.3428078.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.VCU262Y2QB.exe.3428078.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.VCU262Y2QB.exe.3428078.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000002.00000002.2924867689.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000002.00000002.2924867689.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.3938041321.00000000033D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.3938041321.00000000033D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: VCU262Y2QB.exe PID: 6760, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: VCU262Y2QB.exe PID: 6760, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: VCU262Y2QB.exe PID: 6828, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: VCU262Y2QB.exe PID: 6828, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger

Source: classification engine

Classification label: mal92.troj.winEXE@8/0@2/2

Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1752:120:WilError_03

Source: VCU262Y2QB.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: VCU262Y2QB.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\VCU262Y2QB.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\VCU262Y2QB.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: VCU262Y2QB.exe	ReversingLabs: Detection: 68%
Source: VCU262Y2QB.exe	Virustotal: Detection: 71%

Source: unknown	Process created: C:\Users\user\Desktop\VCU262Y2QB.exe "C:\Users\user\Desktop\VCU262Y2QB.exe"
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process created: C:\Users\user\Desktop\VCU262Y2QB.exe "C:\Users\user\Desktop\VCU262Y2QB.exe"
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\VCU262Y2QB.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /C Y /N /D Y /T 3
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process created: C:\Users\user\Desktop\VCU262Y2QB.exe "C:\Users\user\Desktop\VCU262Y2QB.exe"	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\VCU262Y2QB.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /C Y /N /D Y /T 3	Jump to behavior

Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\VCU262Y2QB.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\VCU262Y2QB.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: VCU262Y2QB.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: VCU262Y2QB.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Source: VCU262Y2QB.exe

Static PE information: 0x81AF2B24 [Sun Dec 12 04:25:08 2038 UTC]

Source: VCU262Y2QB.exe

Static PE information: section name: .text entropy: 7.348087930069703

Hooking and other Techniques for Hiding and Protection

Self deletion via cmd or bat file

Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process created: "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\VCU262Y2QB.exe"
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process created: "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\VCU262Y2QB.exe"			Jump to behavior

Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Memory allocated: A40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Memory allocated: 23D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Memory allocated: 43D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Memory allocated: 2F00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Memory allocated: 3150000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Memory allocated: 2F80000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 599734	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 599066	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 598921	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 598809	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 598703	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 598594	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 598484	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 598375	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 598266	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 598141	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 598000	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 597890	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 597779	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 597672	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 597547	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 597438	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 597313	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 597094	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 596969	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 596850	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 596749	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 596640	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 596531	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 596418	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 596306	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 596182	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 596069	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 595813	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 595688	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 595469	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 595344	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 595234	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 595125	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 595016	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 594906	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 594797	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 594687	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 594577	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 594469	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 594344	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 594234	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 594125	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 594016	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 593905	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 593776	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 593672	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 593563	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 593438	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 593313	Jump to behavior

Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Window / User API: threadDelayed 2779			Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Window / User API: threadDelayed 7051			Jump to behavior

Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep count: 41 > 30	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -37815825351104557s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7092	Thread sleep count: 2779 > 30	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -599734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7092	Thread sleep count: 7051 > 30	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -599066s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -598921s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -598809s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -598703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -598594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -598484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -598375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -598266s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -598141s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -598000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -597890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -597779s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -597672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -597547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -597438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -597313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -597203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -597094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -596969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -596850s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -596749s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -596640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -596531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -596418s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -596306s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -596182s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -596069s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -595813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -595688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -595578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -595469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -595344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -595234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -595125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -595016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -594906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -594797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -594687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -594577s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -594469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -594344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -594234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -594125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -594016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -593905s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -593776s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -593672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -593563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -593438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe TID: 7084	Thread sleep time: -593313s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 599734	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 599066	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 598921	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 598809	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 598703	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 598594	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 598484	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 598375	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 598266	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 598141	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 598000	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 597890	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 597779	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 597672	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 597547	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 597438	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 597313	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 597094	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 596969	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 596850	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 596749	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 596640	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 596531	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 596418	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 596306	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 596182	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 596069	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 595813	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 595688	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 595469	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 595344	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 595234	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 595125	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 595016	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 594906	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 594797	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 594687	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 594577	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 594469	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 594344	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 594234	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 594125	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 594016	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 593905	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 593776	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 593672	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 593563	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 593438	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Thread delayed: delay time: 593313	Jump to behavior

Source: VCU262Y2QB.exe, 00000002.00000002.2925140498.0000000001296000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllV
Source: VCU262Y2QB.exe	Binary or memory string: ResumeVirtualMachine
Source: VCU262Y2QB.exe	Binary or memory string: iqEMUhZ
Source: VCU262Y2QB.exe	Binary or memory string: InitializeVirtualMachine
Source: VCU262Y2QB.exe, 00000002.00000002.2928239279.0000000006970000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: VCU262Y2QB.exe	Binary or memory string: get_VirtualMachine
Source: VCU262Y2QB.exe	Binary or memory string: get_MonoVirtualMachine
Source: VCU262Y2QB.exe	Binary or memory string: VirtualMachineManager

Source: C:\Users\user\Desktop\VCU262Y2QB.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\VCU262Y2QB.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\VCU262Y2QB.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process created: C:\Users\user\Desktop\VCU262Y2QB.exe "C:\Users\user\Desktop\VCU262Y2QB.exe"	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\VCU262Y2QB.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /C Y /N /D Y /T 3	Jump to behavior

Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Queries volume information: C:\Users\user\Desktop\VCU262Y2QB.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Queries volume information: C:\Users\user\Desktop\VCU262Y2QB.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VCU262Y2QB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\VCU262Y2QB.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 0.2.VCU262Y2QB.exe.34b8718.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.VCU262Y2QB.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VCU262Y2QB.exe.34d9348.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VCU262Y2QB.exe.34d9348.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VCU262Y2QB.exe.34b8718.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VCU262Y2QB.exe.3428078.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2924867689.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3938041321.00000000033D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2926305512.0000000003151000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: VCU262Y2QB.exe PID: 6760, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VCU262Y2QB.exe PID: 6828, type: MEMORYSTR

Source: Yara match	File source: 0.2.VCU262Y2QB.exe.34b8718.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.VCU262Y2QB.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VCU262Y2QB.exe.34d9348.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VCU262Y2QB.exe.34d9348.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VCU262Y2QB.exe.34b8718.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VCU262Y2QB.exe.3428078.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2924867689.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3938041321.00000000033D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: VCU262Y2QB.exe PID: 6760, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VCU262Y2QB.exe PID: 6828, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 0.2.VCU262Y2QB.exe.34b8718.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.VCU262Y2QB.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VCU262Y2QB.exe.34d9348.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VCU262Y2QB.exe.34d9348.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VCU262Y2QB.exe.34b8718.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VCU262Y2QB.exe.3428078.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2924867689.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3938041321.00000000033D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2926305512.0000000003151000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: VCU262Y2QB.exe PID: 6760, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VCU262Y2QB.exe PID: 6828, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Disable or Modify Tools	OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	12 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
VCU262Y2QB.exe	68%	ReversingLabs	Win32.Spyware.Snakekeylogger
VCU262Y2QB.exe	72%	Virustotal		Browse
VCU262Y2QB.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	104.21.16.1	true	false	high
checkip.dyndns.com	158.101.44.242	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false		high
https://reallyfreegeoip.org/xml/8.46.123.189	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://reallyfreegeoip.org	VCU262Y2QB.exe, 00000002.00000002.2926305512.00000000032AD000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.00000000032C8000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.0000000003256000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.00000000032BA000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.0000000003213000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/8.46.123.189x	VCU262Y2QB.exe, 00000002.00000002.2926305512.0000000003213000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/0xd4d/dnSpy/wiki/Debugging-Unity-Games	VCU262Y2QB.exe	false	high
http://checkip.dyndns.org	VCU262Y2QB.exe, 00000002.00000002.2926305512.00000000032AD000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.00000000032DA000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.0000000003204000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.00000000032C8000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.0000000003256000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.00000000032BA000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.0000000003213000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.com	VCU262Y2QB.exe, 00000002.00000002.2926305512.00000000032AD000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.00000000032DA000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.00000000032C8000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.00000000032BA000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.0000000003213000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	VCU262Y2QB.exe, 00000002.00000002.2926305512.0000000003151000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/q	VCU262Y2QB.exe, 00000000.00000002.3938041321.00000000033D9000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2924867689.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/8.46.123.189$	VCU262Y2QB.exe, 00000002.00000002.2926305512.00000000032AD000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.00000000032C8000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.0000000003256000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.00000000032BA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.org	VCU262Y2QB.exe, 00000002.00000002.2926305512.00000000032AD000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.00000000032C8000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.00000000032BA000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.000000000322C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	VCU262Y2QB.exe, 00000000.00000002.3938041321.00000000033D9000.00000004.00000800.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2924867689.0000000000402000.00000040.00000400.00020000.00000000.sdmp, VCU262Y2QB.exe, 00000002.00000002.2926305512.0000000003213000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.16.1	reallyfreegeoip.org	United States		13335	CLOUDFLARENETUS	false
158.101.44.242	checkip.dyndns.com	United States		31898	ORACLE-BMC-31898US	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588357
Start date and time:	2025-01-11 01:14:26 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	VCU262Y2QB.exe renamed because original name is a hash value
Original Sample Name:	2b8887e80909f776f73b07b6870c4f3f3be8697560e693a4786707d76aae4c01.exe
Detection:	MAL
Classification:	mal92.troj.winEXE@8/0@2/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 71 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.23.242.162, 52.149.20.212, 13.107.246.45
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target VCU262Y2QB.exe, PID 6828 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
19:16:05	API Interceptor	138x Sleep call for process: VCU262Y2QB.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.16.1	NFhRxwbegd.exe	Get hash	malicious	FormBook	Browse	www.kkpmoneysocial.top/86am/
104.21.16.1	JNKHlxGvw4.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	188387cm.n9shteam.in/videolinePipeHttplowProcessorgamelocalTemp.php
158.101.44.242	WGi85dsMNp.exe	Get hash	malicious	GuLoader	Browse	checkip.dyndns.org/
	3i1gMM8K4z.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	vnV17JImCH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	PK5pHX4Gu5.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	b5BQbAhwVD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	SABXJ1B5c8.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	jxy62Zm6c4.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	MzqLQjCwrw.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	RmIYOfX0yO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	h1HIe1rt4D.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	tVuAoupHhZ.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Kb94RzMYNf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	WGi85dsMNp.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.130.0
	wymvwQ4mC4.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	H75MnQEha8.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	WGi85dsMNp.exe	Get hash	malicious	GuLoader	Browse	158.101.44.242
	3i1gMM8K4z.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	2NJzy3tiny.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
reallyfreegeoip.org	h1HIe1rt4D.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	tVuAoupHhZ.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.32.1
	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.80.1
	Kb94RzMYNf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	WGi85dsMNp.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.16.1
	wymvwQ4mC4.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	H75MnQEha8.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.112.1
	3i1gMM8K4z.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	2NJzy3tiny.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.32.1
	z87sammylastborn.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	http://unikuesolutions.com/ck/bd/%7BRANDOM_NUMBER05%7D/YmVuc29uLmxpbkB2aGFjb3JwLmNvbQ==	Get hash	malicious	Unknown	Browse	188.114.97.3
	h1HIe1rt4D.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	http://unikuesolutions.com/ck/bd/%7BRANDOM_NUMBER05%7D/YmVuc29uLmxpbkB2aGFjb3JwLmNvbQ==	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://txto.eu.org/	Get hash	malicious	Unknown	Browse	104.21.16.1
	ru52XOQ1p7.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	tVuAoupHhZ.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.32.1
	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.80.1
	phish_alert_sp2_2.0.0.0(4).eml	Get hash	malicious	Unknown	Browse	172.66.0.227
	https://app.online.mt.com/e/es?s=961579678&e=14507707&elqTrackId=4f40dcb3a3854013ad3a46d461cc3aff&elq=5140e028df1a42afab491350388fd129&elqaid=221811&elqat=1&elqcst=272&elqcsid=2325629&elqak=8AF5D97DFF9E423CC7C7524F5CA3C1A86F5F67341B9DF612D5A2FB20DE928F2AA351	Get hash	malicious	Unknown	Browse	172.66.0.227
	https://app.online.mt.com/e/es?s=961579678&e=14507707&elqTrackId=4f40dcb3a3854013ad3a46d461cc3aff&elq=5140e028df1a42afab491350388fd129&elqaid=221811&elqat=1&elqcst=272&elqcsid=2325629&elqak=8AF5D97DFF9E423CC7C7524F5CA3C1A86F5F67341B9DF612D5A2FB20DE928F2AA351	Get hash	malicious	Unknown	Browse	172.66.0.227
ORACLE-BMC-31898US	h1HIe1rt4D.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	tVuAoupHhZ.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	phish_alert_sp2_2.0.0.0(4).eml	Get hash	malicious	Unknown	Browse	192.29.202.93
	https://app.online.mt.com/e/es?s=961579678&e=14507707&elqTrackId=4f40dcb3a3854013ad3a46d461cc3aff&elq=5140e028df1a42afab491350388fd129&elqaid=221811&elqat=1&elqcst=272&elqcsid=2325629&elqak=8AF5D97DFF9E423CC7C7524F5CA3C1A86F5F67341B9DF612D5A2FB20DE928F2AA351	Get hash	malicious	Unknown	Browse	192.29.202.93
	https://app.online.mt.com/e/es?s=961579678&e=14507707&elqTrackId=4f40dcb3a3854013ad3a46d461cc3aff&elq=5140e028df1a42afab491350388fd129&elqaid=221811&elqat=1&elqcst=272&elqcsid=2325629&elqak=8AF5D97DFF9E423CC7C7524F5CA3C1A86F5F67341B9DF612D5A2FB20DE928F2AA351	Get hash	malicious	Unknown	Browse	192.29.202.93
	WGi85dsMNp.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.130.0
	wymvwQ4mC4.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	WGi85dsMNp.exe	Get hash	malicious	GuLoader	Browse	158.101.44.242
	3i1gMM8K4z.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	2NJzy3tiny.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	h1HIe1rt4D.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.16.1
	tVuAoupHhZ.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.16.1
	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.16.1
	Kb94RzMYNf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	WGi85dsMNp.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.16.1
	wymvwQ4mC4.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.16.1
	H75MnQEha8.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	3i1gMM8K4z.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	2NJzy3tiny.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	z87sammylastborn.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.337433815181913
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	VCU262Y2QB.exe
File size:	553'472 bytes
MD5:	c4407cbd68725778ecd99dc7638be000
SHA1:	0a232725a5857010de9eb61837fe6bbb3a6e151f
SHA256:	2b8887e80909f776f73b07b6870c4f3f3be8697560e693a4786707d76aae4c01
SHA512:	4ba0d5c953ce0ee4c984f36360c60fa4212d77633ec24b8bbff91ead5dbbd853272c9c6b4700e0db6865bc6678bd356c039a7623d134ff44068e107b3ad80376
SSDEEP:	12288:YiU+RfWk1Sm5bpviLs+fMKqirYo4A4OPoTo84RPlA24:Yi3fWxIbZiLsSPWotf
TLSH:	B0C4BF2972E8E317D5AF0B3AF43411005B7ABE93B19AEF0D5C44A5EF0D53BD199122A3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$+................0..h............... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4887de
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x81AF2B24 [Sun Dec 12 04:25:08 2038 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x88790	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8a000	0x596	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x867e4	0x86800	63fda6f3138ba46403304e0b8af4d0a3	False	0.6022867536013011	data	7.348087930069703	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x8a000	0x596	0x600	bb337337fd525b603631f27b8432eb2e	False	0.41015625	data	4.03984594780929	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x8c000	0xc	0x200	ea0438b2ffa5d5203b31ad259aa8633b	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x8a0a0	0x30c	data			0.4230769230769231
RT_MANIFEST	0x8a3ac	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T01:16:02.502862+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.12	49710	158.101.44.242	80	TCP
2025-01-11T01:16:05.512800+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.12	49710	158.101.44.242	80	TCP
2025-01-11T01:16:06.971618+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.12	49710	158.101.44.242	80	TCP
2025-01-11T01:16:07.676712+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.12	49716	104.21.16.1	443	TCP
2025-01-11T01:16:11.174849+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.12	49717	158.101.44.242	80	TCP
2025-01-11T01:16:14.581011+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.12	49720	158.101.44.242	80	TCP
2025-01-11T01:16:15.170686+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.12	49721	104.21.16.1	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:16:00.586738110 CET	49710	80	192.168.2.12	158.101.44.242
Jan 11, 2025 01:16:00.593197107 CET	80	49710	158.101.44.242	192.168.2.12
Jan 11, 2025 01:16:00.593290091 CET	49710	80	192.168.2.12	158.101.44.242
Jan 11, 2025 01:16:00.593540907 CET	49710	80	192.168.2.12	158.101.44.242
Jan 11, 2025 01:16:00.599878073 CET	80	49710	158.101.44.242	192.168.2.12
Jan 11, 2025 01:16:01.547848940 CET	80	49710	158.101.44.242	192.168.2.12
Jan 11, 2025 01:16:01.555723906 CET	49710	80	192.168.2.12	158.101.44.242
Jan 11, 2025 01:16:01.560568094 CET	80	49710	158.101.44.242	192.168.2.12
Jan 11, 2025 01:16:02.456558943 CET	80	49710	158.101.44.242	192.168.2.12
Jan 11, 2025 01:16:02.502861977 CET	49710	80	192.168.2.12	158.101.44.242
Jan 11, 2025 01:16:02.506635904 CET	49713	443	192.168.2.12	104.21.16.1
Jan 11, 2025 01:16:02.506674051 CET	443	49713	104.21.16.1	192.168.2.12
Jan 11, 2025 01:16:02.506792068 CET	49713	443	192.168.2.12	104.21.16.1
Jan 11, 2025 01:16:02.513675928 CET	49713	443	192.168.2.12	104.21.16.1
Jan 11, 2025 01:16:02.513705969 CET	443	49713	104.21.16.1	192.168.2.12
Jan 11, 2025 01:16:02.974597931 CET	443	49713	104.21.16.1	192.168.2.12
Jan 11, 2025 01:16:02.974680901 CET	49713	443	192.168.2.12	104.21.16.1
Jan 11, 2025 01:16:03.113687038 CET	49713	443	192.168.2.12	104.21.16.1
Jan 11, 2025 01:16:03.113740921 CET	443	49713	104.21.16.1	192.168.2.12
Jan 11, 2025 01:16:03.114151001 CET	443	49713	104.21.16.1	192.168.2.12
Jan 11, 2025 01:16:03.159312010 CET	49713	443	192.168.2.12	104.21.16.1
Jan 11, 2025 01:16:03.220719099 CET	49713	443	192.168.2.12	104.21.16.1
Jan 11, 2025 01:16:03.263326883 CET	443	49713	104.21.16.1	192.168.2.12
Jan 11, 2025 01:16:03.336007118 CET	443	49713	104.21.16.1	192.168.2.12
Jan 11, 2025 01:16:03.336071014 CET	443	49713	104.21.16.1	192.168.2.12
Jan 11, 2025 01:16:03.336179018 CET	49713	443	192.168.2.12	104.21.16.1
Jan 11, 2025 01:16:03.341748953 CET	49713	443	192.168.2.12	104.21.16.1
Jan 11, 2025 01:16:03.344970942 CET	49710	80	192.168.2.12	158.101.44.242
Jan 11, 2025 01:16:03.349802971 CET	80	49710	158.101.44.242	192.168.2.12
Jan 11, 2025 01:16:05.501965046 CET	80	49710	158.101.44.242	192.168.2.12
Jan 11, 2025 01:16:05.512799978 CET	49710	80	192.168.2.12	158.101.44.242
Jan 11, 2025 01:16:05.517672062 CET	80	49710	158.101.44.242	192.168.2.12
Jan 11, 2025 01:16:06.921073914 CET	80	49710	158.101.44.242	192.168.2.12
Jan 11, 2025 01:16:06.935237885 CET	49716	443	192.168.2.12	104.21.16.1
Jan 11, 2025 01:16:06.935260057 CET	443	49716	104.21.16.1	192.168.2.12
Jan 11, 2025 01:16:06.935332060 CET	49716	443	192.168.2.12	104.21.16.1
Jan 11, 2025 01:16:06.935592890 CET	49716	443	192.168.2.12	104.21.16.1
Jan 11, 2025 01:16:06.935605049 CET	443	49716	104.21.16.1	192.168.2.12
Jan 11, 2025 01:16:06.971617937 CET	49710	80	192.168.2.12	158.101.44.242
Jan 11, 2025 01:16:07.410878897 CET	443	49716	104.21.16.1	192.168.2.12
Jan 11, 2025 01:16:07.455996037 CET	49716	443	192.168.2.12	104.21.16.1
Jan 11, 2025 01:16:07.562263966 CET	49716	443	192.168.2.12	104.21.16.1
Jan 11, 2025 01:16:07.562273979 CET	443	49716	104.21.16.1	192.168.2.12
Jan 11, 2025 01:16:07.676706076 CET	443	49716	104.21.16.1	192.168.2.12
Jan 11, 2025 01:16:07.676774979 CET	443	49716	104.21.16.1	192.168.2.12
Jan 11, 2025 01:16:07.676846027 CET	49716	443	192.168.2.12	104.21.16.1
Jan 11, 2025 01:16:07.708126068 CET	49716	443	192.168.2.12	104.21.16.1
Jan 11, 2025 01:16:07.994405031 CET	49710	80	192.168.2.12	158.101.44.242
Jan 11, 2025 01:16:07.995775938 CET	49717	80	192.168.2.12	158.101.44.242
Jan 11, 2025 01:16:07.999492884 CET	80	49710	158.101.44.242	192.168.2.12
Jan 11, 2025 01:16:07.999553919 CET	49710	80	192.168.2.12	158.101.44.242
Jan 11, 2025 01:16:08.000602007 CET	80	49717	158.101.44.242	192.168.2.12
Jan 11, 2025 01:16:08.000684023 CET	49717	80	192.168.2.12	158.101.44.242
Jan 11, 2025 01:16:08.000806093 CET	49717	80	192.168.2.12	158.101.44.242
Jan 11, 2025 01:16:08.005563974 CET	80	49717	158.101.44.242	192.168.2.12
Jan 11, 2025 01:16:11.124875069 CET	80	49717	158.101.44.242	192.168.2.12
Jan 11, 2025 01:16:11.142447948 CET	49719	443	192.168.2.12	104.21.16.1
Jan 11, 2025 01:16:11.142491102 CET	443	49719	104.21.16.1	192.168.2.12
Jan 11, 2025 01:16:11.142556906 CET	49719	443	192.168.2.12	104.21.16.1
Jan 11, 2025 01:16:11.146064997 CET	49719	443	192.168.2.12	104.21.16.1
Jan 11, 2025 01:16:11.146085024 CET	443	49719	104.21.16.1	192.168.2.12
Jan 11, 2025 01:16:11.174849033 CET	49717	80	192.168.2.12	158.101.44.242
Jan 11, 2025 01:16:11.618767977 CET	443	49719	104.21.16.1	192.168.2.12
Jan 11, 2025 01:16:11.620455980 CET	49719	443	192.168.2.12	104.21.16.1
Jan 11, 2025 01:16:11.620476961 CET	443	49719	104.21.16.1	192.168.2.12
Jan 11, 2025 01:16:11.747899055 CET	443	49719	104.21.16.1	192.168.2.12
Jan 11, 2025 01:16:11.747972965 CET	443	49719	104.21.16.1	192.168.2.12
Jan 11, 2025 01:16:11.748022079 CET	49719	443	192.168.2.12	104.21.16.1
Jan 11, 2025 01:16:11.748425961 CET	49719	443	192.168.2.12	104.21.16.1
Jan 11, 2025 01:16:11.751631021 CET	49717	80	192.168.2.12	158.101.44.242
Jan 11, 2025 01:16:11.752770901 CET	49720	80	192.168.2.12	158.101.44.242
Jan 11, 2025 01:16:11.756671906 CET	80	49717	158.101.44.242	192.168.2.12
Jan 11, 2025 01:16:11.756720066 CET	49717	80	192.168.2.12	158.101.44.242
Jan 11, 2025 01:16:11.757632017 CET	80	49720	158.101.44.242	192.168.2.12
Jan 11, 2025 01:16:11.757725000 CET	49720	80	192.168.2.12	158.101.44.242
Jan 11, 2025 01:16:11.757834911 CET	49720	80	192.168.2.12	158.101.44.242
Jan 11, 2025 01:16:11.762813091 CET	80	49720	158.101.44.242	192.168.2.12
Jan 11, 2025 01:16:14.536998987 CET	80	49720	158.101.44.242	192.168.2.12
Jan 11, 2025 01:16:14.538244009 CET	49721	443	192.168.2.12	104.21.16.1
Jan 11, 2025 01:16:14.538270950 CET	443	49721	104.21.16.1	192.168.2.12
Jan 11, 2025 01:16:14.538357973 CET	49721	443	192.168.2.12	104.21.16.1
Jan 11, 2025 01:16:14.538603067 CET	49721	443	192.168.2.12	104.21.16.1
Jan 11, 2025 01:16:14.538609028 CET	443	49721	104.21.16.1	192.168.2.12
Jan 11, 2025 01:16:14.581011057 CET	49720	80	192.168.2.12	158.101.44.242
Jan 11, 2025 01:16:15.016558886 CET	443	49721	104.21.16.1	192.168.2.12
Jan 11, 2025 01:16:15.018378019 CET	49721	443	192.168.2.12	104.21.16.1
Jan 11, 2025 01:16:15.018388033 CET	443	49721	104.21.16.1	192.168.2.12
Jan 11, 2025 01:16:15.170711994 CET	443	49721	104.21.16.1	192.168.2.12
Jan 11, 2025 01:16:15.170778036 CET	443	49721	104.21.16.1	192.168.2.12
Jan 11, 2025 01:16:15.170994997 CET	49721	443	192.168.2.12	104.21.16.1
Jan 11, 2025 01:16:15.172804117 CET	49721	443	192.168.2.12	104.21.16.1
Jan 11, 2025 01:16:15.177850008 CET	49723	80	192.168.2.12	158.101.44.242
Jan 11, 2025 01:16:15.182701111 CET	80	49723	158.101.44.242	192.168.2.12
Jan 11, 2025 01:16:15.182774067 CET	49723	80	192.168.2.12	158.101.44.242
Jan 11, 2025 01:16:15.182893038 CET	49723	80	192.168.2.12	158.101.44.242
Jan 11, 2025 01:16:15.187715054 CET	80	49723	158.101.44.242	192.168.2.12
Jan 11, 2025 01:16:17.763827085 CET	80	49723	158.101.44.242	192.168.2.12
Jan 11, 2025 01:16:17.768522978 CET	49727	80	192.168.2.12	158.101.44.242
Jan 11, 2025 01:16:17.773319960 CET	80	49727	158.101.44.242	192.168.2.12
Jan 11, 2025 01:16:17.773400068 CET	49727	80	192.168.2.12	158.101.44.242
Jan 11, 2025 01:16:17.773529053 CET	49727	80	192.168.2.12	158.101.44.242
Jan 11, 2025 01:16:17.778315067 CET	80	49727	158.101.44.242	192.168.2.12
Jan 11, 2025 01:16:17.815378904 CET	49723	80	192.168.2.12	158.101.44.242
Jan 11, 2025 01:16:20.570597887 CET	80	49727	158.101.44.242	192.168.2.12
Jan 11, 2025 01:16:20.574697971 CET	49728	443	192.168.2.12	104.21.16.1
Jan 11, 2025 01:16:20.574743986 CET	443	49728	104.21.16.1	192.168.2.12
Jan 11, 2025 01:16:20.574795961 CET	49728	443	192.168.2.12	104.21.16.1
Jan 11, 2025 01:16:20.575320005 CET	49728	443	192.168.2.12	104.21.16.1
Jan 11, 2025 01:16:20.575336933 CET	443	49728	104.21.16.1	192.168.2.12
Jan 11, 2025 01:16:20.575669050 CET	49723	80	192.168.2.12	158.101.44.242
Jan 11, 2025 01:16:20.580749989 CET	80	49723	158.101.44.242	192.168.2.12
Jan 11, 2025 01:16:20.580816031 CET	49723	80	192.168.2.12	158.101.44.242
Jan 11, 2025 01:16:20.612260103 CET	49727	80	192.168.2.12	158.101.44.242
Jan 11, 2025 01:16:21.054590940 CET	443	49728	104.21.16.1	192.168.2.12
Jan 11, 2025 01:16:21.064265966 CET	49728	443	192.168.2.12	104.21.16.1
Jan 11, 2025 01:16:21.064300060 CET	443	49728	104.21.16.1	192.168.2.12
Jan 11, 2025 01:16:21.187195063 CET	443	49728	104.21.16.1	192.168.2.12
Jan 11, 2025 01:16:21.187351942 CET	443	49728	104.21.16.1	192.168.2.12
Jan 11, 2025 01:16:21.187439919 CET	49728	443	192.168.2.12	104.21.16.1
Jan 11, 2025 01:16:21.188113928 CET	49728	443	192.168.2.12	104.21.16.1
Jan 11, 2025 01:16:21.192423105 CET	49727	80	192.168.2.12	158.101.44.242
Jan 11, 2025 01:16:21.193037033 CET	49729	80	192.168.2.12	158.101.44.242
Jan 11, 2025 01:16:21.199079037 CET	80	49727	158.101.44.242	192.168.2.12
Jan 11, 2025 01:16:21.199140072 CET	49727	80	192.168.2.12	158.101.44.242
Jan 11, 2025 01:16:21.199433088 CET	80	49729	158.101.44.242	192.168.2.12
Jan 11, 2025 01:16:21.199502945 CET	49729	80	192.168.2.12	158.101.44.242
Jan 11, 2025 01:16:21.199685097 CET	49729	80	192.168.2.12	158.101.44.242
Jan 11, 2025 01:16:21.204435110 CET	80	49729	158.101.44.242	192.168.2.12
Jan 11, 2025 01:16:23.769712925 CET	80	49729	158.101.44.242	192.168.2.12
Jan 11, 2025 01:16:23.815471888 CET	49729	80	192.168.2.12	158.101.44.242
Jan 11, 2025 01:16:23.993812084 CET	49720	80	192.168.2.12	158.101.44.242
Jan 11, 2025 01:16:23.993956089 CET	49729	80	192.168.2.12	158.101.44.242

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:16:00.473233938 CET	59023	53	192.168.2.12	1.1.1.1
Jan 11, 2025 01:16:00.480349064 CET	53	59023	1.1.1.1	192.168.2.12
Jan 11, 2025 01:16:02.498317003 CET	50574	53	192.168.2.12	1.1.1.1
Jan 11, 2025 01:16:02.505886078 CET	53	50574	1.1.1.1	192.168.2.12

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 01:16:00.473233938 CET	192.168.2.12	1.1.1.1	0x346e	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:16:02.498317003 CET	192.168.2.12	1.1.1.1	0xaf1b	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 01:16:00.480349064 CET	1.1.1.1	192.168.2.12	0x346e	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 01:16:00.480349064 CET	1.1.1.1	192.168.2.12	0x346e	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:16:00.480349064 CET	1.1.1.1	192.168.2.12	0x346e	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:16:00.480349064 CET	1.1.1.1	192.168.2.12	0x346e	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:16:00.480349064 CET	1.1.1.1	192.168.2.12	0x346e	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:16:00.480349064 CET	1.1.1.1	192.168.2.12	0x346e	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:16:02.505886078 CET	1.1.1.1	192.168.2.12	0xaf1b	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:16:02.505886078 CET	1.1.1.1	192.168.2.12	0xaf1b	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:16:02.505886078 CET	1.1.1.1	192.168.2.12	0xaf1b	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:16:02.505886078 CET	1.1.1.1	192.168.2.12	0xaf1b	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:16:02.505886078 CET	1.1.1.1	192.168.2.12	0xaf1b	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:16:02.505886078 CET	1.1.1.1	192.168.2.12	0xaf1b	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:16:02.505886078 CET	1.1.1.1	192.168.2.12	0xaf1b	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.12	49710	158.101.44.242	80	6828	C:\Users\user\Desktop\VCU262Y2QB.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:16:00.593540907 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 01:16:01.547848940 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:16:01 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: a8cce52d69575bf519550a33fb77e127 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 11, 2025 01:16:01.555723906 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 01:16:02.456558943 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:16:02 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 946f467aef6a94102d8f51ddef1df8f1 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 11, 2025 01:16:03.344970942 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 01:16:05.501965046 CET	730	IN	HTTP/1.1 502 Bad Gateway Date: Sat, 11 Jan 2025 00:16:05 GMT Content-Type: text/html Content-Length: 547 Connection: keep-alive X-Request-ID: 1d3158cc9c2def8f66b1fd73e5f98a3f Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 [TRUNCATED] Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Jan 11, 2025 01:16:05.512799978 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 01:16:06.921073914 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:16:06 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 4a2a5c218f1bdfabc3a4f89aabbcb15f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.12	49717	158.101.44.242	80	6828	C:\Users\user\Desktop\VCU262Y2QB.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:16:08.000806093 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 01:16:11.124875069 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:16:11 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2c2b38c74f357063ba55cc17922033f4 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.12	49720	158.101.44.242	80	6828	C:\Users\user\Desktop\VCU262Y2QB.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:16:11.757834911 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 01:16:14.536998987 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:16:14 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 04f4a3db5d1533b0d6bfdf1ceeeef37a Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.12	49723	158.101.44.242	80	6828	C:\Users\user\Desktop\VCU262Y2QB.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:16:15.182893038 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 01:16:17.763827085 CET	730	IN	HTTP/1.1 502 Bad Gateway Date: Sat, 11 Jan 2025 00:16:17 GMT Content-Type: text/html Content-Length: 547 Connection: keep-alive X-Request-ID: 9c1f934dd3d480c1b4d3da95fd80823e Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 [TRUNCATED] Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.12	49727	158.101.44.242	80	6828	C:\Users\user\Desktop\VCU262Y2QB.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:16:17.773529053 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 01:16:20.570597887 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:16:20 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: ceb7af79ffcd544c8806c15336a92180 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.12	49729	158.101.44.242	80	6828	C:\Users\user\Desktop\VCU262Y2QB.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:16:21.199685097 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 01:16:23.769712925 CET	730	IN	HTTP/1.1 502 Bad Gateway Date: Sat, 11 Jan 2025 00:16:23 GMT Content-Type: text/html Content-Length: 547 Connection: keep-alive X-Request-ID: f7c8a3030a3745e5b13c1c3dfcacaf86 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 [TRUNCATED] Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.12	49713	104.21.16.1	443	6828	C:\Users\user\Desktop\VCU262Y2QB.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 00:16:03 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-11 00:16:03 UTC	851	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:16:03 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1869352 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wrItRlGoRiC5Gi4FyKbiUfu5tDLHAmf3EvJmXFmL7umZSpoI7NzpfxVK0nm2wHQMTxosFgsysxYeL4e%2FQW8Hdp8RSIZOTEjDKNmRfo5SAxmy6jteZzVi2Yq1Tl0f7BSt2GDl39gA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9000b7447c648ce0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1819&min_rtt=1811&rtt_var=696&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1554845&cwnd=215&unsent_bytes=0&cid=5047d3f49f43645f&ts=373&x=0"
2025-01-11 00:16:03 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.12	49716	104.21.16.1	443	6828	C:\Users\user\Desktop\VCU262Y2QB.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 00:16:07 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-11 00:16:07 UTC	853	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:16:07 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1869356 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Id8O9PHshT4loZx47oYsRHSM1wdlcheQLeG3Y7XZSq9SBMtSiVb%2B91HnyEulkuVO98nzXVrpKHqFkhpLgiBhUXu2PIh2F24rfDlkAUaakVPwkoAwlJ7xZ%2BBavMFAj4VZu5Lhk6zK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9000b75f9d7c1899-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1627&min_rtt=1620&rtt_var=622&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1739130&cwnd=153&unsent_bytes=0&cid=36ea5aa2bffaad9c&ts=271&x=0"
2025-01-11 00:16:07 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.12	49719	104.21.16.1	443	6828	C:\Users\user\Desktop\VCU262Y2QB.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 00:16:11 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-11 00:16:11 UTC	855	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:16:11 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1869360 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wVI2fCSX8qoV1Mg%2Fdx9gvzjQJWsowa2g4AY48e07C6Z2ajV70mwQK5Sv8yctLNg%2BEyYQdx5cgdlY6qyDVBXGpdaH7ppKBNLNqCp9pSSG%2FqwZUIQP5ATdklPYtmzlI9X9j0ibqruT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9000b7790d551899-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1652&min_rtt=1625&rtt_var=628&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1796923&cwnd=153&unsent_bytes=0&cid=e014aeb08cf9da9e&ts=132&x=0"
2025-01-11 00:16:11 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.12	49721	104.21.16.1	443	6828	C:\Users\user\Desktop\VCU262Y2QB.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 00:16:15 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-11 00:16:15 UTC	861	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:16:15 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1869364 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oRrLtk9opy2GYKn2EtmPF%2Fob%2Bvyq56%2BPibLBIlIR8X%2BfcvLpHKkgBUoqdISIP5t4QRbbjYE8yCqfyNs%2BkGaQmftTEQxdV6h5vNRXAHb9Zr4jhQ8w%2BXjujvpGnbX0iqjMjNS1CRyz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9000b78e6bd37293-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1932&min_rtt=1923&rtt_var=728&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1518460&cwnd=158&unsent_bytes=0&cid=eb0b7a4822125b86&ts=165&x=0"
2025-01-11 00:16:15 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.12	49728	104.21.16.1	443	6828	C:\Users\user\Desktop\VCU262Y2QB.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 00:16:21 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-11 00:16:21 UTC	857	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:16:21 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1869370 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1tpT4lDMa83bCtfcRkJChIF35p4pnz6gai5Vb0ZeO9DjuRF%2FXEdxnnwP2qpPA4mvATvlPNG8NrkoZTcrH7t%2FZJ7v7QbgcACMy4As9ZyZQ%2BKnufRryeD3Lhma1uEV%2FUWtiiP7JRIj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9000b7b40f931899-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1552&min_rtt=1545&rtt_var=593&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1823860&cwnd=153&unsent_bytes=0&cid=af222674a4c7ef1b&ts=141&x=0"
2025-01-11 00:16:21 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Target ID:	0
Start time:	19:15:57
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\VCU262Y2QB.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\VCU262Y2QB.exe"
Imagebase:	0x90000
File size:	553'472 bytes
MD5 hash:	C4407CBD68725778ECD99DC7638BE000
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.3938041321.00000000033D9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.3938041321.00000000033D9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.3938041321.00000000033D9000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.3938041321.00000000033D9000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	19:15:58
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\VCU262Y2QB.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\VCU262Y2QB.exe"
Imagebase:	0xd40000
File size:	553'472 bytes
MD5 hash:	C4407CBD68725778ECD99DC7638BE000
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2924867689.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000002.00000002.2924867689.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000002.00000002.2924867689.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000002.00000002.2924867689.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000002.00000002.2926305512.0000000003151000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	19:16:22
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\VCU262Y2QB.exe"
Imagebase:	0x1f0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	19:16:22
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff704000000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	19:16:22
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /C Y /N /D Y /T 3
Imagebase:	0xb30000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.5%
Total number of Nodes:	118
Total number of Limit Nodes:	13

Executed Functions

Function 081794F8 Relevance: .4, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3940653866.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_VCU262Y2QB.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 62325034b94d2d2e1c567c5078c6eb54fbf2f872f75ed7ce3dee002e65755316
Instruction ID: a79255958099fdb8d134bb91b404f381c3e473af1bf061e0121a741f7f68eb8c
Opcode Fuzzy Hash: 62325034b94d2d2e1c567c5078c6eb54fbf2f872f75ed7ce3dee002e65755316
Instruction Fuzzy Hash: 5AF13A70A00209CFEB14DFA9C844BADBBF1FF88305F15816DE409AB265DB79A949CF50

Function 00A4ADA8 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00A4AFFE

Memory Dump Source

Source File: 00000000.00000002.3936440394.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_VCU262Y2QB.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: e6e01fdbab682950a39d5429ef30552c7aea57b73d1bf176a6875fdc292bf824
Instruction ID: ead90c5cf2571603380949be41dd5da1aa2f0f1d257ed1da208be02b1333ca4f
Opcode Fuzzy Hash: e6e01fdbab682950a39d5429ef30552c7aea57b73d1bf176a6875fdc292bf824
Instruction Fuzzy Hash: 19715674A00B058FDB24DF2AD44175ABBF1FF88304F108A2DE59AD7A50D735E849CB92

Function 00A45A84 Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3936440394.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b52d395ed10134c2ee97bae96d112c6d6905a3ac45af8032073ed42cd4002a6
Instruction ID: f35d5e4c3eb903a008e1011f4fef9bb425a022850ef3289106d80fb926b8bb41
Opcode Fuzzy Hash: 8b52d395ed10134c2ee97bae96d112c6d6905a3ac45af8032073ed42cd4002a6
Instruction Fuzzy Hash: 1F31AC79C05A49CFDF21CFB8C8597DDBBB0EF82314F24829AC445AB292C7766906CB51

Function 00A4590D Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00A459C9

Memory Dump Source

Source File: 00000000.00000002.3936440394.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_VCU262Y2QB.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 428e46c078b5ea61ee97ad21e8d3f4050cceaaa61dac546f48a8a00b97728fb4
Instruction ID: 2f8b1b8c372074a81564c7eeeb5e3a9797a4c79ffd74e7e4d35605621b19b220
Opcode Fuzzy Hash: 428e46c078b5ea61ee97ad21e8d3f4050cceaaa61dac546f48a8a00b97728fb4
Instruction Fuzzy Hash: 0241D170D00719CBEF24CFA9C884BCDBBB6BF89704F20816AD508AB251DB756946CF91

Function 00A44248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00A459C9

Memory Dump Source

Source File: 00000000.00000002.3936440394.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_VCU262Y2QB.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 92cc51b382e6646840e5aae4afc52e720ea8f988df49368b0fd1e665c5d69e93
Instruction ID: bddb65d13b3888aad23980d0406982d491229c3bf1cfd00afe9c5310685a442f
Opcode Fuzzy Hash: 92cc51b382e6646840e5aae4afc52e720ea8f988df49368b0fd1e665c5d69e93
Instruction Fuzzy Hash: ED41D170C0071DCBEB24CFAAC884B8DBBB5FF89704F20816AD508AB251DB756946CF91

Function 00A4B790 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00A4D646,?,?,?,?,?), ref: 00A4D707

Memory Dump Source

Source File: 00000000.00000002.3936440394.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_VCU262Y2QB.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8dfd6bffc08f793dc7d6216760166495a8baabc956ae2e7dc62b23534aa78531
Instruction ID: a338b4b6dffe285efdca84ea44f640b0219dafbe4ba11ddfd7188b1dba8c16b1
Opcode Fuzzy Hash: 8dfd6bffc08f793dc7d6216760166495a8baabc956ae2e7dc62b23534aa78531
Instruction Fuzzy Hash: 8521E4B5900349EFDB10CFAAD884ADEBBF4EB48310F14841AE918B3350D378A950CFA5

Function 00A4D679 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00A4D646,?,?,?,?,?), ref: 00A4D707

Memory Dump Source

Source File: 00000000.00000002.3936440394.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_VCU262Y2QB.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7e93d7f37f6dc09798df5d327a97b90fcd76aa7d714a08672f5644f5a15f79ee
Instruction ID: 8339da93b2c125a6a7ce120d332fe5089c6e3adf877e19da1b3391ddc5f51c70
Opcode Fuzzy Hash: 7e93d7f37f6dc09798df5d327a97b90fcd76aa7d714a08672f5644f5a15f79ee
Instruction Fuzzy Hash: 5021E4B5900249DFDB10CFAAD984ADEBBF5EB48310F14802AE918A7351D378A944CFA5

Function 08170563 Relevance: 1.6, APIs: 1, Instructions: 59
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,?,?,?), ref: 081705E5

Memory Dump Source

Source File: 00000000.00000002.3940653866.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_VCU262Y2QB.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 4ce6b1ca01041fa936abf99aa19da88c8d1f11d18063d6ea5d876cc162c53e50
Instruction ID: 853020f62ad431ea455bc761e0e5a85262d9b66667f4d31d399fd5242ef4366d
Opcode Fuzzy Hash: 4ce6b1ca01041fa936abf99aa19da88c8d1f11d18063d6ea5d876cc162c53e50
Instruction Fuzzy Hash: 9C217CB18087898FDB11CF99C844BDEBFF4EF4A310F14809ED554A7662C338A944CBA1

Function 08170588 Relevance: 1.5, APIs: 1, Instructions: 48
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,?,?,?), ref: 081705E5

Memory Dump Source

Source File: 00000000.00000002.3940653866.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_VCU262Y2QB.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 95390428f0b251b5aec5faa528cb3d733da2887703a89ae23c8c215099f6731b
Instruction ID: f1670d0771895090cf250199d9a5481e3c6343f85c44c0b3a7634517b082e8ba
Opcode Fuzzy Hash: 95390428f0b251b5aec5faa528cb3d733da2887703a89ae23c8c215099f6731b
Instruction Fuzzy Hash: 8F1125B1800349CFDB10CF9AC845BDEBBF8EB48320F108419D554A3240C378A984CFA1

Function 00A4AF98 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00A4AFFE

Memory Dump Source

Source File: 00000000.00000002.3936440394.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_VCU262Y2QB.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d6cd902bf3d4f91c5a929629e65a4f4fe0f3582540c9cb61a1387fc6766878ae
Instruction ID: b6b1fc3c423474544a2006c2034c8f1e970d77a2b0cb92cf0aa31dae89f2b140
Opcode Fuzzy Hash: d6cd902bf3d4f91c5a929629e65a4f4fe0f3582540c9cb61a1387fc6766878ae
Instruction Fuzzy Hash: BA11DFB5C006498FDB20CFAAD444BDEFBF4AB88314F10846AD929A7610D379A545CFA1

Function 081708A0 Relevance: 1.5, APIs: 1, Instructions: 46
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 08171F1D

Memory Dump Source

Source File: 00000000.00000002.3940653866.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_VCU262Y2QB.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: ac9f3a67b18f7df9b0f8841c51f7469f87f7a689c68eb8e2ea90a38f00db2600
Instruction ID: 725eec96647b3bc260813b425803bf420ae7073f34a5a5baf930f3ec856e5f90
Opcode Fuzzy Hash: ac9f3a67b18f7df9b0f8841c51f7469f87f7a689c68eb8e2ea90a38f00db2600
Instruction Fuzzy Hash: AA1130B18003489FDB20DFAAC544B9EBBF8EF48320F20845AD619A3200C379A944CFA1

Function 0817A258 Relevance: 1.5, APIs: 1, Instructions: 46
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,0817981F), ref: 0817A2BD

Memory Dump Source

Source File: 00000000.00000002.3940653866.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_VCU262Y2QB.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 87c6717e0cdf94e197a02006e27135dda25f689b70762e6d52f76c329653913a
Instruction ID: b8ce74269ea19da5d90083036f423023ec2445169392aaf8ee95799e112da50b
Opcode Fuzzy Hash: 87c6717e0cdf94e197a02006e27135dda25f689b70762e6d52f76c329653913a
Instruction Fuzzy Hash: 9711FEB5C046598FCB10CFAAD484BCEBBF4EF48314F10852AD528A3650D379A685CFA5

Function 08171EC0 Relevance: 1.5, APIs: 1, Instructions: 46
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 08171F1D

Memory Dump Source

Source File: 00000000.00000002.3940653866.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_VCU262Y2QB.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: f2e7f252e3771805b7b4b420e752b8c9ebea213d71bff7f1fd3774951ee21df7
Instruction ID: 243715d19f0b36829f10f7f537b0c317077b291ba80793c7a138a609eee76912
Opcode Fuzzy Hash: f2e7f252e3771805b7b4b420e752b8c9ebea213d71bff7f1fd3774951ee21df7
Instruction Fuzzy Hash: 241103B1800649CFDB20DF9AD485BDEBBF4EF48324F208459D519A7610C779A548CFA1

Function 081787C4 Relevance: 1.5, APIs: 1, Instructions: 46
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,0817981F), ref: 0817A2BD

Memory Dump Source

Source File: 00000000.00000002.3940653866.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_VCU262Y2QB.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 69d1eddf40aec9fbfcf17e5377b2997e19f21c743c5e75d65746897b35e6d05f
Instruction ID: bc39dede656944ac1587f74115c221d9519ee4d759dbd6541daddfe3a25f6751
Opcode Fuzzy Hash: 69d1eddf40aec9fbfcf17e5377b2997e19f21c743c5e75d65746897b35e6d05f
Instruction Fuzzy Hash: 5D111DB1C047888FDB20CFAAD444B9EBBF4EF48314F10802AD928B3200D379A544CFA5

Function 008DD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3936127832.00000000008DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8dd000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38e4baab1dbcecc5ada5e61809ad31ea6d0aa82696de759eaec93d24edf6a5c2
Instruction ID: 7d84625fe1f10396cd93842d21d5faaa7b2e98c11a1b2a4a839692db7b9e65c9
Opcode Fuzzy Hash: 38e4baab1dbcecc5ada5e61809ad31ea6d0aa82696de759eaec93d24edf6a5c2
Instruction Fuzzy Hash: 6421F171500344EFDB15DF24E980F26BF76FB88318F20C66AE9058A356C33AD856CBA1

Function 008ED01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3936209251.00000000008ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 008ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ed000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54cc408bac167eda301d47890bfd1c6cd797960580cdf9299543b69ea2ca6ab4
Instruction ID: 3f23faf61ff89a240ba5b900a95a6d811980c01b556489a5e9a671eea014cc8a
Opcode Fuzzy Hash: 54cc408bac167eda301d47890bfd1c6cd797960580cdf9299543b69ea2ca6ab4
Instruction Fuzzy Hash: A0212271604784EFCB14DF25D980B16BBA1FB89314F28C56DD90A8B292C33AD84BCA61

Function 008ED2BC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3936209251.00000000008ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 008ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ed000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 009e588b506fe38cb4646de07bdf539fa13c1e8b9557cd21dad4c89f91187206
Instruction ID: c09012b3966ca4af45a1fd80394154d064e365976b1376bd65ba99b544e4ec32
Opcode Fuzzy Hash: 009e588b506fe38cb4646de07bdf539fa13c1e8b9557cd21dad4c89f91187206
Instruction Fuzzy Hash: 41216875504384DFDB00DF15D5C0B2ABB65FB85324F20C56DD9098B382D33AD80ACAA2

Function 008ED006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3936209251.00000000008ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 008ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ed000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7035c1e64b235180b1eff08242052a5a546c9c70aa0c6954e838a3d2c1163277
Instruction ID: 665b1915595ea709ad975cb003fcb3446bda8cb147c469d8cc5594d72aecf5d2
Opcode Fuzzy Hash: 7035c1e64b235180b1eff08242052a5a546c9c70aa0c6954e838a3d2c1163277
Instruction Fuzzy Hash: 3A214F755087849FCB02CF14D994715BF71FB46314F28C5EAD8498B2A7C33A985ACB62

Function 008DD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3936127832.00000000008DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8dd000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7328aad906307f87a639ae946db57a35503b58b28594a988dc7ce012466a0042
Instruction ID: bdb4f9be18af150d4e56bc624b6212c3c8e01ea028d319c7ada55fc979d986cf
Opcode Fuzzy Hash: 7328aad906307f87a639ae946db57a35503b58b28594a988dc7ce012466a0042
Instruction Fuzzy Hash: 5A11B176504280DFCB15CF10D5C4B16BF71FB88324F24C6AAD8494B656C33AD856CBA1

Function 008ED2B7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3936209251.00000000008ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 008ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ed000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 296aed39e50b2be89e29007edf28e118c2410cc531b03b83390ffbfdf496a8bb
Instruction ID: f1bc256c9bf1f8751634ecc6afe1ffede147757fe39176706cbb62db14f37747
Opcode Fuzzy Hash: 296aed39e50b2be89e29007edf28e118c2410cc531b03b83390ffbfdf496a8bb
Instruction Fuzzy Hash: 14119D7A504284CFCB11CF10D5C4B19FB61FB85324F28C6AAD8494B796C33AD80ACBA2

Non-executed Functions

Function 00A4D364 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3936440394.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 891ed12407d1e7319e99e846b7947d042c800981c88e8e5b304cdf96843f1aa0
Instruction ID: af8807eada96056bae766d17024118e9cbc5d16b5ac0483e26f4a158a8f0b840
Opcode Fuzzy Hash: 891ed12407d1e7319e99e846b7947d042c800981c88e8e5b304cdf96843f1aa0
Instruction Fuzzy Hash: A0A15B3AE002098FCF05DFA4C94459EBBB2FFC5300B25957AE905AB266EB35ED55CB40

Analysis Process: VCU262Y2QB.exePID: 6828, Parent PID: 6760COMMON

Executed Functions

Function 02F4C4C9 Relevance: 1.4, Strings: 1, Instructions: 182COMMON

Download Yara Rule

Strings

8, xrefs: 02F4C4C9

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID: 8
API String ID: 0-4194326291
Opcode ID: b3323ca164b58cdf676be710cc8650e6279d9183baf4e8b878af577c542951c4
Instruction ID: 5e5ee2eda718c4fbca9f4cc521a9a2464e3bdbf69afdeea6d5df71f0a97a31c1
Opcode Fuzzy Hash: b3323ca164b58cdf676be710cc8650e6279d9183baf4e8b878af577c542951c4
Instruction Fuzzy Hash: 3281D374E01218CFEB14CFAAD944A9DBBF2BF88340F14D06AD909AB365DB749985CF10

Function 02F49868 Relevance: .9, Instructions: 855COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9cd3ea8da8b59b72edde20f27c523202b386a5b528ebcee57043d0732dffac3
Instruction ID: 36df06acfcdb568375b9e2c89a55caf078405139cec38958a476021658030c65
Opcode Fuzzy Hash: d9cd3ea8da8b59b72edde20f27c523202b386a5b528ebcee57043d0732dffac3
Instruction Fuzzy Hash: 7E728D31A40209DFDB15CF68C894AAEBFB2FF88354F158559EA159B2A1DBB0ED40CF50

Function 02F46120 Relevance: .5, Instructions: 514COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea0868e0107aa89291c366866dde06d2a4dc4bac8754c6bf1e35abe5c1f65430
Instruction ID: f8d636189b8fc64be9979d1ee07a4421ced82691fae1e8c0e0b3de48f52517a6
Opcode Fuzzy Hash: ea0868e0107aa89291c366866dde06d2a4dc4bac8754c6bf1e35abe5c1f65430
Instruction Fuzzy Hash: AB127A70A002199FDB14DF69C854BAEBBBAFF89380F108569E916DB394DF749C41CB50

Function 02F4B740 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 620f5d7465deeea194736b93ef85babc6777cd4d84bf4691105b5cb394bd70d3
Instruction ID: 666f9c696613dd9b66293db04ed16d0d848d6b6d7e472722258d9dcb2a385ad8
Opcode Fuzzy Hash: 620f5d7465deeea194736b93ef85babc6777cd4d84bf4691105b5cb394bd70d3
Instruction Fuzzy Hash: B7E1FA75E00218CFDB14DFA9C884A9DBBB2FF49359F158069E909AB362DB71E841CF50

Function 02F46898 Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5936f6d25a2ad2ca2e7f67193877fe0c8d4073cda3c89ec5ce43e9f43662dc6b
Instruction ID: 2ca55c2904451758ba43dcd19fb590b803cf126f5b75fd27c0bdc94c9f9ee4f0
Opcode Fuzzy Hash: 5936f6d25a2ad2ca2e7f67193877fe0c8d4073cda3c89ec5ce43e9f43662dc6b
Instruction Fuzzy Hash: 80D13C71E00109DFCB14CFA9C984AADBBB6FF8A385F148165E615EB264DBB0DD41CB50

Function 02F44A8F Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9071a2ed261c3de145cfe3b97539293d9581d0ca39f7c79548f5e280bab39eb1
Instruction ID: 26ea27e52ce9dcdcbd9f79a9842baf598088317c65cde196fbfa5d3d38b345d1
Opcode Fuzzy Hash: 9071a2ed261c3de145cfe3b97539293d9581d0ca39f7c79548f5e280bab39eb1
Instruction Fuzzy Hash: 9BA14671E00258CFDB14CFAAD894B9DBFB2FF89340F1480AAD948AB265DB749945CF50

Function 02F4BEA7 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 482fd593880d8b1ac5e9f31cbda96999cb7ab68326a1e5d1c2333b4098d6bb16
Instruction ID: 5652355de3a5ae361b3afc6280ca2a10a904773735bd5034e3378dd43fd717f6
Opcode Fuzzy Hash: 482fd593880d8b1ac5e9f31cbda96999cb7ab68326a1e5d1c2333b4098d6bb16
Instruction Fuzzy Hash: 9F91E374E00218DFEB14DFAAD844A9DBBF2BF88344F14D06AD509AB365DB749981CF50

Function 02F4C1E9 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b61588556b1640bf6307c419debbc2b99ca1c6febbd841ad3bd0e04d253885e3
Instruction ID: f39257c8a051d742abe31217a1156fda6737daa1c71079316bdd72cf551eb031
Opcode Fuzzy Hash: b61588556b1640bf6307c419debbc2b99ca1c6febbd841ad3bd0e04d253885e3
Instruction Fuzzy Hash: 2181E774E01218CFDB14CFAAD984AADBBF2BF89304F14D06AD909AB365DB749945CF10

Function 02F4C7A8 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 251023c2d3b0d73cff3e59ae3ea82478c79a8b09c6673dfa0221126a37a8fa8a
Instruction ID: 9e1956832e180b338c0eccd597dfb4669722cab1f0d7f4384129766068d5d48f
Opcode Fuzzy Hash: 251023c2d3b0d73cff3e59ae3ea82478c79a8b09c6673dfa0221126a37a8fa8a
Instruction Fuzzy Hash: 7781D274E01218DFEB14CFAAD854A9DBBF2BF88300F10D06AD949AB365DB749985CF11

Function 02F4CA88 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6540b65d2868ece259dcc0bf63d1cb26c93035be1e7be30eeac5b8fa357fcb29
Instruction ID: f1efbc6e462bae15c866e959e065fab0d43bf8465ce73c8c1ec7ebde1f1aa7b4
Opcode Fuzzy Hash: 6540b65d2868ece259dcc0bf63d1cb26c93035be1e7be30eeac5b8fa357fcb29
Instruction Fuzzy Hash: 1881A175E01218CFDB14CFAAD884A9DBBF2BF88340F14D06AD909AB365DB749985CF50

Function 02F4CD69 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38f1635c573bdefaf385a90b6d1bc5a138305f9615de12d59ccebed231f17187
Instruction ID: b9a3610d5ae3e3017143e09ee4000a721712bda614677859837102a978cb7f94
Opcode Fuzzy Hash: 38f1635c573bdefaf385a90b6d1bc5a138305f9615de12d59ccebed231f17187
Instruction Fuzzy Hash: 7D81D574E01218CFDB14CFAAD884A9DBBF2BF88310F14D06AE919AB365DB749945CF50

Function 02F4BF08 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e65a48cae9abf42550159c931963aa54d17967b03c8b7c6df19c552bcaddbde8
Instruction ID: daed62c0848e779076b520122203bdc725656871b8d24a13d6597ba01a056efb
Opcode Fuzzy Hash: e65a48cae9abf42550159c931963aa54d17967b03c8b7c6df19c552bcaddbde8
Instruction Fuzzy Hash: 6D61C475E01208DFEB14CFAAD844A9DBBF2BF88350F14D06AD918AB365DB749845CF50

Function 02F495E4 Relevance: 1.4, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

T, xrefs: 02F495F6

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID: T
API String ID: 0-3187964512
Opcode ID: bf26b8045ed9cbfcc0e187953a4cd36a571f34bc116c8d341702d07a02c743f0
Instruction ID: 0c0764b4a75d2a0219b60f03cc9e41242d062b6f0dcc265f49fb344b6e19eba9
Opcode Fuzzy Hash: bf26b8045ed9cbfcc0e187953a4cd36a571f34bc116c8d341702d07a02c743f0
Instruction Fuzzy Hash: FC51E271B042498FDB01DB69C844BBF7FAADF85390F14896AD605DB291DFE9CC428B60

Function 02F47808 Relevance: .7, Instructions: 690COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac7ac194a36f4f963551676e2f8daf5b948094f57d92f52b808ac13696e17953
Instruction ID: 6d88a655d556b187b18ab6c556804c239df7c8c4bdff7c34445a3c9c8c9258e7
Opcode Fuzzy Hash: ac7ac194a36f4f963551676e2f8daf5b948094f57d92f52b808ac13696e17953
Instruction Fuzzy Hash: 6652E970A0021CCFEB249BA5C854BAEBB76FF85740F5080ADD60A6B395CB349D85DF61

Function 02F46E70 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fda5d8fb19c0750904b8ccc81cd9c144b12d1d0529de38b0d5b8319fd41d933
Instruction ID: c6fae93904a5d4e67f1acc82201b7fe3b517e27cc700a82a565660ab7e2d3fc9
Opcode Fuzzy Hash: 7fda5d8fb19c0750904b8ccc81cd9c144b12d1d0529de38b0d5b8319fd41d933
Instruction Fuzzy Hash: 77123930A00208DFDB14DFA9D884AAEBBF6FF89354F148559EA49DB261DB70ED41CB50

Function 02F4A828 Relevance: .4, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7503dbc7b31c67e790289e30558e69944b9a1919f1346ce2c30207b5150642ca
Instruction ID: 69bd07dccbcb279411f859ac7e83a55f39be52d237265d2772384082e0f8dca9
Opcode Fuzzy Hash: 7503dbc7b31c67e790289e30558e69944b9a1919f1346ce2c30207b5150642ca
Instruction Fuzzy Hash: ECF16D71E40214CFCB05CFA9C598AADBBF2FF88354B1A8059E615AB361CB75ED41CB50

Function 02F40C8F Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc239596e21b85cb845eef0011cc7eec134e2807fb4e13b30ca31928fa748454
Instruction ID: 240ff050c387d8fe5d3b4e832d8effbfa0972dd825532b65922b7f49bf07246e
Opcode Fuzzy Hash: cc239596e21b85cb845eef0011cc7eec134e2807fb4e13b30ca31928fa748454
Instruction Fuzzy Hash: 65220374E4020ACFCB54DF65E988A9DBBB6FF48340F1085A9D919A7314DB346E89CF50

Function 02F40CA0 Relevance: .4, Instructions: 395COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1802a57e989d1a5b36c2470058da906d99ecd58b604c1cef45eea1ec321ad187
Instruction ID: b855dd7f8036fe8ec7f2d2da09513c4fe6d096a4df208ce0ad91cdad5ed7aecc
Opcode Fuzzy Hash: 1802a57e989d1a5b36c2470058da906d99ecd58b604c1cef45eea1ec321ad187
Instruction Fuzzy Hash: 2A220474E4020ACFCB54DF66E988A9DBBB6FF48340F1085A9D919A7314DB346E89CF50

Function 02F48801 Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0414db323d23ec4899513535cf4587a8ddcf81c22269d314281e5f410c1fc08
Instruction ID: b4042c41f671929210f6c153bc0b11a75cd3800f6125863045ed663e729fcc65
Opcode Fuzzy Hash: d0414db323d23ec4899513535cf4587a8ddcf81c22269d314281e5f410c1fc08
Instruction Fuzzy Hash: CEB16C71B005018FDB259A29CC58B397A96FF84AC5F1804AAE652CF3B5DFE9CC41C752

Function 02F456B0 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7842bd8e692fc5c8992122e96d664f73eef58e0fe141c802b488668d1ea533e9
Instruction ID: c7aee6b00aaa6359acd8e4fb6f5465aa238f7b574654be0eca8ef754dd9dc231
Opcode Fuzzy Hash: 7842bd8e692fc5c8992122e96d664f73eef58e0fe141c802b488668d1ea533e9
Instruction Fuzzy Hash: 31B1C131B002198FDB15AF34C858B2A7FE2EB99394F448569EA06CB390DFB5CC45CB90

Function 02F49180 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29e3a25b8c6c78057fd7d636b7f10363261a8a3cc8d4f6747e89b460ab751a10
Instruction ID: 8ee0fb607ef0f4c5bbcc4e42300b6982cc91356953c846979538032f00d73373
Opcode Fuzzy Hash: 29e3a25b8c6c78057fd7d636b7f10363261a8a3cc8d4f6747e89b460ab751a10
Instruction Fuzzy Hash: 8D812A31A006059FC711CF68CC84AABBBB5FF853A4B548265DA58C7355CBB1F912CBA0

Function 02F45C10 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e4f1ffabcfd82aaa16cfbbd682a1b4490b0aacb3b078983ba2696501c1e6c76
Instruction ID: a83ad2ef921d8c1a35a57a502b6e1a732df3196aa7e239fa43476708ab1ff393
Opcode Fuzzy Hash: 7e4f1ffabcfd82aaa16cfbbd682a1b4490b0aacb3b078983ba2696501c1e6c76
Instruction Fuzzy Hash: 2A81A135B00105CFCB14EF79C888A6ABBB2FF99294B948069D606DB365DF71EC41CB90

Function 02F47450 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25b6f2fc453c75dfd1c94c8688636c6736c1a4d5e55d5ba40ba33c243deb4aae
Instruction ID: 54d3318e6cad2d83478a01a38674974d7616c982f6124ff37feda140a02c8001
Opcode Fuzzy Hash: 25b6f2fc453c75dfd1c94c8688636c6736c1a4d5e55d5ba40ba33c243deb4aae
Instruction Fuzzy Hash: BD713734B002458FDB14EF28C888A6ABFEAAF49384F1544A9EA15CB371DFB0DC41CB50

Function 02F4D382 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 565a11cc9d2e283e58a292280f4a1307657cdfca47302c4ab35646e6afecc38a
Instruction ID: 07a40297afc474dfb3c169932b140eec835ed5b9b82bd25d4732e3d2f356f9ab
Opcode Fuzzy Hash: 565a11cc9d2e283e58a292280f4a1307657cdfca47302c4ab35646e6afecc38a
Instruction Fuzzy Hash: CA51D171AE634B8FD3006F32A5BC53ABB64FB5F7A77846D10E52E85445CB3140A8DE22

Function 02F4D390 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d72275271217897fdfda8c660fb296a83ca08ae36b42e24d5adc69edd2f66cf
Instruction ID: c8807cd302d1efc2127e774b2848eb28964e17583c42460a887a1078d86a6afb
Opcode Fuzzy Hash: 1d72275271217897fdfda8c660fb296a83ca08ae36b42e24d5adc69edd2f66cf
Instruction Fuzzy Hash: A551A070AE634B8F93006F32A5BC53ABB65FB4F7A77846D10E42E85015CB3100A8DE12

Function 02F493A0 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31c07d16bd66d707f02aaa990c1e350ac9bcfaa9d1ccb414c2796688909cd038
Instruction ID: 9591d61428f539f6c361434803010a8ef991a45812b9463a51d868619447ff71
Opcode Fuzzy Hash: 31c07d16bd66d707f02aaa990c1e350ac9bcfaa9d1ccb414c2796688909cd038
Instruction Fuzzy Hash: 4C516035B002149FDB009F69C944B6FBBE6EF893A4F54C465EA09CB3A1DBB1DC018B61

Function 02F4D048 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d41f95e0c82716e87326e9863288c4686dc4089997e9edeb149fd5eee0dc3650
Instruction ID: df299882b4bfd9be9eacc217a911138303f06bd59fac9a127da90bca34f23bc7
Opcode Fuzzy Hash: d41f95e0c82716e87326e9863288c4686dc4089997e9edeb149fd5eee0dc3650
Instruction Fuzzy Hash: 8A519475E01208DFDB54DFAAD98499DBBF2FF89300F249169E909AB364DB30A845CF50

Function 02F43908 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f26adc39ce4c832eb420437e77b1b4a74d4e7eda3a08af44a566a875dc80ca69
Instruction ID: 8f7ff747258cee55a0759805ff7af693666e792e53312e3f831746e46c52dc09
Opcode Fuzzy Hash: f26adc39ce4c832eb420437e77b1b4a74d4e7eda3a08af44a566a875dc80ca69
Instruction Fuzzy Hash: 5F519375E01208CFCB08DFAAD99499DBBB2FF89310B608469D905AB364DB35AD45CF50

Function 02F49A73 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61f9f744f51dd9e677cb8e7c729d4af82c8444838857190d8edb60a0da11bcfa
Instruction ID: 3037ca02883130d1eb632e48d31332ef21e5cdeae75a1b0c7fd55e8bb201e382
Opcode Fuzzy Hash: 61f9f744f51dd9e677cb8e7c729d4af82c8444838857190d8edb60a0da11bcfa
Instruction Fuzzy Hash: E5418E31B04249DFCF11CFA4C844B9EBFB2EF49394F048556EA15AB251D7B5EA14CB60

Function 02F4A660 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f3ffa082dadb55a6afad67cdcfc31f547abc3de463deace22837990009d4958
Instruction ID: e0550f838a07a8635d7789289a190ef76048e83081dec7537792d974a03b6044
Opcode Fuzzy Hash: 9f3ffa082dadb55a6afad67cdcfc31f547abc3de463deace22837990009d4958
Instruction Fuzzy Hash: 8F41D236B402089FCB159B69D828BAEBBF6EFC9251F148469D916D7390CE758C01CBA0

Function 02F46748 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 378d04ecd90665ea09a82584e7763023b86fe0b3e1f533b61a6c63ca5dfe64f4
Instruction ID: dfd526e1bbfc99e760723927676061f418c4ef52aa4f3a0333e3b58259a9ac79
Opcode Fuzzy Hash: 378d04ecd90665ea09a82584e7763023b86fe0b3e1f533b61a6c63ca5dfe64f4
Instruction Fuzzy Hash: 6141BD71A002089FDB148F64C808FBABBBAEF85390F04C46AE955DB250DBB5DD55DF60

Function 02F43428 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d9169834baab1697894193b03010501f905f62892987b7986f3f1a455026bde
Instruction ID: 58d87c91f0ac6d364711b164fec338f30f516ec3b0cb84dda2307df2feae81bb
Opcode Fuzzy Hash: 6d9169834baab1697894193b03010501f905f62892987b7986f3f1a455026bde
Instruction Fuzzy Hash: EC31D772F003158BDB19997A8A943BEB9DAABC4290F78447DDA16C3394DFF4CC4487A1

Function 02F44DD0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72c2b2cf27a2bde1aec64da7d85c39aa921603cf67450424a2cb30604384fe1d
Instruction ID: 504cc86ddba977a4aebdd2ed9ba40d4eb1658482f9befb6a5a583a6dfd6f25e5
Opcode Fuzzy Hash: 72c2b2cf27a2bde1aec64da7d85c39aa921603cf67450424a2cb30604384fe1d
Instruction Fuzzy Hash: 5D316031B442099FCB059FA4D858BBF7BA7EB88394F108424FA169B290CF75CC65CB90

Function 02F476F8 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce2c8042ef952446392a52defb99da884fb5187fcca03f618642e21b9f127fdc
Instruction ID: 4a54fcd68b7017712bd030c8ba4dbd99729646906f305c872a536a6908b86b45
Opcode Fuzzy Hash: ce2c8042ef952446392a52defb99da884fb5187fcca03f618642e21b9f127fdc
Instruction Fuzzy Hash: 2421B335B001094BDB143639C458B3EBA97DFC86D9F648039DA02CB794EFE9C8429791

Function 02F4A819 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c974d02006c95f8606b99f26e3e25479955db67b35c683f96854aba53a50c4df
Instruction ID: 3cb007f6c70bffe1b2a5159b6cae13de3aa72f7f5718c9d22c199c724411df95
Opcode Fuzzy Hash: c974d02006c95f8606b99f26e3e25479955db67b35c683f96854aba53a50c4df
Instruction Fuzzy Hash: 6D31A471E405098FDB04CFA9C8A8AAEBBB3FF88354B158155E615973A5CB74ED02CB90

Function 02F42060 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 681bb9a71efa77b2c6c43a3770161166fcfab6bb657bc6621884c561854a30e3
Instruction ID: 60f1db03a7835cd93d2811a9426675e7bbcbea3c1a8fe3b7fc149a45b04966d0
Opcode Fuzzy Hash: 681bb9a71efa77b2c6c43a3770161166fcfab6bb657bc6621884c561854a30e3
Instruction Fuzzy Hash: 9121A436A001159FDF14DF24D840AAE7BA9EF9C690B20C069E9199B344DF75EA41CBD1

Function 02F4D5D1 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bd46f6ea4bb524f2357a6719197eed1a60bca8831366f99e2a56710be80fc8d
Instruction ID: 5dc05acac1542d15649656fca42f25c7f96cb3d5352483a510220ffc23cf02cf
Opcode Fuzzy Hash: 1bd46f6ea4bb524f2357a6719197eed1a60bca8831366f99e2a56710be80fc8d
Instruction Fuzzy Hash: BA213B31C50219DFCB10EFA9D8446ECFBB5FF4A304F509529D90877254EB70669ACB90

Function 02F45A78 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fd71651e190e5cdcbb263e81ea7e65894fdc2257bfa617b86932c6cb5d188
Instruction ID: c586867124abd3328e4d68dad72a6c36d43d008a185205af13c9e07b028c6551
Opcode Fuzzy Hash: b18fd71651e190e5cdcbb263e81ea7e65894fdc2257bfa617b86932c6cb5d188
Instruction Fuzzy Hash: 87210231B406118FC719AA69D89892EBBA7FF847E4754457AEA16DB350CF70DC06CBC0

Function 02F4D6CF Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b63aa47e266d8e4527122d845bf013b670d3b0f17a0bbc8149ec5cb54cfa99df
Instruction ID: 06a4d6a72b6915dbfc6942b6a1054f28a0c1d865fe0acb9f290c5e7ce405d2b5
Opcode Fuzzy Hash: b63aa47e266d8e4527122d845bf013b670d3b0f17a0bbc8149ec5cb54cfa99df
Instruction Fuzzy Hash: 23212735E422089FDB44DFB5D890AEDB7B2FF8A344F509429C80177390DB769845CA65

Function 02F439ED Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 085d8eafeb830d324f6c826b0d3c654e17ba6406450daedbba7a120683f69ae2
Instruction ID: 452f9d49bc0610537caa86414f32ebdad0a04dd43db94607a2c826e89771c7b8
Opcode Fuzzy Hash: 085d8eafeb830d324f6c826b0d3c654e17ba6406450daedbba7a120683f69ae2
Instruction Fuzzy Hash: 4E31C579E01309CFCB04DFA8E9948ADBBB6FF49301B204469E919AB324DB35AD45CF40

Function 02F44DC1 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 953097745aa453cfec89b0a5715479a9d7e884eb2d2bccb9e8bdd626bb1e4389
Instruction ID: 5176e02a5581a0de1e4fe2dc3f1a3e53cd97975979f41b0c065b84e73e41cc66
Opcode Fuzzy Hash: 953097745aa453cfec89b0a5715479a9d7e884eb2d2bccb9e8bdd626bb1e4389
Instruction Fuzzy Hash: A921B431B442099FCB15AF64D80877B7BA6EB887A4F108025FA159B380CF74DD55CBD0

Function 02F48ED9 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dca6766878eab574c5477e8da0f162a3551eebb459140659c1db07ab6daf7279
Instruction ID: f9a93f2c39f8eb5749655e202b1c46792e8684c1ae01d515954fe2356ef29fc0
Opcode Fuzzy Hash: dca6766878eab574c5477e8da0f162a3551eebb459140659c1db07ab6daf7279
Instruction Fuzzy Hash: 90216B30E01249EFDB04CFA5E854AEEBFBBEF48394F14815AF551A6290DB349981CF50

Function 02F4D6E0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd1cfc36a1c1a46065bef7abebd748363561c92a9d74df76b7d823f80605e88c
Instruction ID: 59432f4b244f9ee83853e0f3d2c212ffb6ff03e8dacc51993403fec117ee28b2
Opcode Fuzzy Hash: fd1cfc36a1c1a46065bef7abebd748363561c92a9d74df76b7d823f80605e88c
Instruction Fuzzy Hash: E3210034E422089FCB44DFB5D850AEEB7B2FF8A344F209429C50177390DB7A9845CA64

Function 02F41F61 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 814342327a32ff967877676ec6c1b3a0c9704dd327d3f6c53f490de3e7184bff
Instruction ID: 6520f02cab49103651a21ab5d3d0b76ee31e08f9bc2bb7078b6d0b6181d88196
Opcode Fuzzy Hash: 814342327a32ff967877676ec6c1b3a0c9704dd327d3f6c53f490de3e7184bff
Instruction Fuzzy Hash: 2E21B274C052498FCB01DFB9D8955EDBFF0FF4A240F10456AD845B7214EB305A96CBA1

Function 02F4560F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 628c12b2f0503857d66540305e68d66217e5d3b949425941ab229d47abe2e3b7
Instruction ID: 8bd1368270d7943efb57a3237e34a9641d05e0ffd6a55b8be876ba6276cb92a1
Opcode Fuzzy Hash: 628c12b2f0503857d66540305e68d66217e5d3b949425941ab229d47abe2e3b7
Instruction Fuzzy Hash: B901F972B001056FCB029E549814AFF3FA7DBD97D0B18806AFA15DB240CE75CC159FA0

Function 02F42010 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ee1dda73ed481d9b11f7183bfc61124d64f85fd6de037e100173ed542192b72
Instruction ID: c89b39fdb9ad6e6e3829939fceaeb89d036a67e40070c6db66901236ae7b17e4
Opcode Fuzzy Hash: 5ee1dda73ed481d9b11f7183bfc61124d64f85fd6de037e100173ed542192b72
Instruction Fuzzy Hash: 56E09232C243EA4BCB0297708C602DEBF34EFA7211F1845D6D4A42B156EBA0165BC7A1

Function 02F42020 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 951908a4b2d951050f99d3dcabd07d21f593f36aaaebd9a61e213896c7cce07e
Instruction ID: daf5192e2d83f7b05157a70f881d6f7553ce3c5a5224041422b1faa6ca38cece
Opcode Fuzzy Hash: 951908a4b2d951050f99d3dcabd07d21f593f36aaaebd9a61e213896c7cce07e
Instruction Fuzzy Hash: 22D01732D2026A978B05A6A5DC048EEB739EE96221BA08626E52437140EB706669C7E1

Function 02F48270 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: ab7d567245dfd895857a9a27e4e4597da8b5349c07d981213b52a2989c70f8d5
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: 60C01233A0C5282AA625108E7C44AABAA8CE2C16F8A250237FA1C9320098829C8041E4

Function 02F4A71D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 396f022a3641b21c8989447acf3f141de3871e4cdfd6ce2c6c789720420a8462
Instruction ID: 082b446ba83c1faa0119bb6f69c50e045094fb95a8ccf276203eabf56c1dddbd
Opcode Fuzzy Hash: 396f022a3641b21c8989447acf3f141de3871e4cdfd6ce2c6c789720420a8462
Instruction Fuzzy Hash: BBD0677BB410089FCB049F98E8449DDF7B6FB9C221B048516E925A7260C6319921DBA0

Function 02F45EB0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 106462b63c7b788fd10c91b9a6b42d1b902aef8137360bdee2b1db3969055f17
Instruction ID: 724890bf543a4a4ff0d2abb83b4e8ccab9861c88b914a24730742caae3c68c23
Opcode Fuzzy Hash: 106462b63c7b788fd10c91b9a6b42d1b902aef8137360bdee2b1db3969055f17
Instruction Fuzzy Hash: 2CD02B7000838A8FD307BB32FE242553F1ADF41749F4044E5CC140A086EBAE4C594751

Function 02F45EC0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2925992618.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_VCU262Y2QB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 717a3f68858fcf58aad72e7c4bd09f47f3cb6e980c4e4789f03440d0cc0bb3d2
Instruction ID: 057e42086aa5372babd0ed105dc35b3c234abedb1095c5c9a65be05e24db2abe
Opcode Fuzzy Hash: 717a3f68858fcf58aad72e7c4bd09f47f3cb6e980c4e4789f03440d0cc0bb3d2
Instruction Fuzzy Hash: F4C0223014030ECBC248BB33FE04894330FEA80780B408520900806044DFBCAC800690

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report VCU262Y2QB.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
VCU262Y2QB.exe

Function 00A4ADA8 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Function 00A45A84 Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Function 00A4590D Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Function 00A44248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 00A4B790 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 00A4D679 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Function 08170563 Relevance: 1.6, APIs: 1, Instructions: 59
windowCOMMON

Function 08170588 Relevance: 1.5, APIs: 1, Instructions: 48
windowCOMMON

Function 00A4AF98 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 081708A0 Relevance: 1.5, APIs: 1, Instructions: 46
comCOMMON

Function 0817A258 Relevance: 1.5, APIs: 1, Instructions: 46
windowCOMMON

Function 08171EC0 Relevance: 1.5, APIs: 1, Instructions: 46
comCOMMON

Function 081787C4 Relevance: 1.5, APIs: 1, Instructions: 46
windowCOMMON